GDPR and buying B2B contact data: what buyers must check

B2B contact data, meaning the names, job titles, work email addresses and phone numbers of people at companies, is the raw material of outbound sales. Under the GDPR it is also personal data. Buying it is lawful in many situations, but the buyer takes on obligations of its own, and the quality of the provider's compliance work shapes how risky your campaigns are. This guide explains what to check before you buy and what you must do afterwards.

This guide is general information, not legal advice. Data protection and marketing rules differ by country and change over time. Ask your data protection officer or a lawyer how they apply to your plans.

Business contact details are personal data

The GDPR protects information about identifiable people, including people acting in a professional capacity. A work email address that contains someone's name, a direct-dial number, or a name combined with a job title all identify a person. Generic mailboxes such as an info or sales address are usually not personal data, but they are rarely what buyers want.

So when you buy a contact list that covers people in the EU or UK, both the provider and you are processing personal data. Both of you need a lawful basis, and both must respect the rights of the people on the list.

What to ask the provider

Where the data came from

Ask for the sources and collection methods: company websites, public registries, professional directories, events, partner data or user-contributed data. Be wary of vague answers such as "proprietary sources". A provider that cannot say how a record was obtained cannot show that it was obtained lawfully.

The lawful basis and the legitimate interests assessment

Most B2B data providers rely on legitimate interests under Article 6(1)(f). That requires a documented legitimate interests assessment (LIA) that identifies the interest, shows the processing is necessary and balances it against the rights and reasonable expectations of the people concerned. Ask whether the provider has one and what it concludes. Some providers rely on consent collected through their own services instead; ask to see how and when that consent was obtained.

How transparency was handled

When personal data is not collected from the person directly, Article 14 requires that they be told who holds their data, for what purpose, where it came from and what their rights are. This must happen within a reasonable period and at the latest within one month, or at the latest at the first communication if the data is used to contact them, or when the data is first disclosed to another recipient. Ask whether the provider sends notices, how it handles objections and how it records them.

Accuracy, minimization and suppression

• How often are records re-verified, and how are people who changed jobs removed?
• Does the provider hold only work-related fields, or also personal social profiles, home addresses or private numbers?
• Does it keep a suppression list of people who objected, and will it pass objections and erasure requests on to buyers?

Your obligations as the buyer

Buying a list does not transfer the provider's compliance to you. Once you hold the data, you are a controller for your own use of it.

1. Document your own lawful basis. If you rely on legitimate interests, write an LIA for your specific campaign.
2. Tell people where you got their data. Your first message needs to meet Article 14: who you are, why you have their details, the source and how to object.
3. Honor objections immediately. The right to object to direct marketing under Article 21 is absolute. Once someone objects, stop using their data for marketing and add them to your suppression list.
4. Keep only what you need. Import the fields your campaign needs, set a retention period and delete records that have not engaged within it.
5. Record the processing. Add the dataset to your records of processing activities, and consider whether a data protection impact assessment is needed for large-scale or novel uses.
6. Check international transfers. If data moves between the EU or UK and other countries, confirm the transfer mechanism, such as an adequacy decision or standard contractual clauses.

Email and phone rules sit on top of the GDPR

Marketing messages are also governed by national ePrivacy rules, which differ more between countries than the GDPR does:

• United Kingdom: under PECR, marketing emails to corporate subscribers do not need prior consent, but you must identify yourself and give a valid way to opt out. Sole traders and some partnerships count as individual subscribers, who generally must have consented. Marketing calls should be screened against the telephone preference services.
• Germany: rules are stricter. Marketing emails generally require prior consent, including in a B2B context, and marketing calls to businesses need at least presumed consent.
• Other countries: approaches vary. Some allow B2B emails that are relevant to the recipient's role, provided they include an opt-out; others require consent.

Set your outreach rules per country before you import the list, not after the first complaint.

Contract terms to put in place

• A clear allocation of roles, usually controller to controller
• Warranties that the data was collected lawfully and that notices and LIAs exist
• An obligation to pass on objections, erasure requests and corrections promptly
• Data protection terms covering security, breaches and international transfers
• Evidence or audit rights, at least for the LIA and source documentation

Red flags

• No answer, or a vague one, to "where did this record come from?"
• Personal email addresses or private mobile numbers sold as business contacts without explanation
• Claims of being "GDPR certified" with no detail on what was certified, by whom and against which scheme
• No process for objections or suppression
• Volumes or prices that suggest the data was copied from sites that prohibit it

On DataStoa you can compare providers of B2B contact data, decision-maker data and email and phone validation, and ask each of them these questions through an inquiry before you buy.

Frequently asked questions

Is it legal to buy B2B contact data in Europe?

It can be, if the provider collected the data lawfully, a valid lawful basis covers both the provider's sale and your use, and the people concerned are informed and able to object. The details depend on the country and the channel you use, so take advice for your situation.

Do I need consent to email business contacts?

It depends on the country and on whether the recipient counts as a corporate or an individual subscriber. The UK, for example, does not require prior consent for marketing emails to corporate subscribers, while Germany generally does.

What should my first email include?

At minimum: who you are, why you are contacting the person, where you obtained their details and how they can object or unsubscribe. A link to your privacy notice helps you meet the full Article 14 requirements.

What if someone asks where I got their data?

They have a right to know, so tell them the source. If they object or ask for erasure, act promptly and inform the provider so the record is suppressed upstream as well.