GDPR Compliance & B2B Data
GDPR decisions for B2B prospecting data
Work through purpose, lawful basis, balancing, transparency, objections and retention while distinguishing GDPR from channel-specific marketing rules.
At a glance
Course plan
- 01Define the purpose and applicable rules
- 02Assess lawful basis and balance interests
- 03Provide information and respect objections
- 04Set retention and review the data lifecycle
01Define the purpose and applicable rules
Describe the exact prospecting activity before collecting data: the audience, professional problem, information needed and proposed channel. A named work email or identifiable business mobile number can be personal data. Separate information about an organisation from information relating to an identifiable person. Map where the people and organisations involved are located, because applicable obligations may depend on more than your own location.
Identify which data protection and electronic marketing rules apply, including relevant national implementations and differences between recipient types. GDPR does not provide a universal permission to send B2B marketing. Document questions that need advice rather than filling gaps with assumptions. This course provides educational guidance, not legal advice; obtain jurisdiction-specific professional advice for uncertain, high-risk or cross-border situations.
02Assess lawful basis and balance interests
Choose and document an appropriate lawful basis for each processing purpose before starting. If considering legitimate interests, articulate the specific interest, test whether the processing is necessary and assess the impact on the individual. Consider less intrusive alternatives. Legitimate interests are not automatically available because a person works for a business or their contact details appear in a public source.
In a balancing assessment, examine professional relevance, source, reasonable expectations, likely intrusion and potential harm. Describe safeguards such as data minimisation, narrow targeting and easy objection, but do not assume safeguards rescue an unsuitable activity. Record the conclusion and reasons, then revisit them when the purpose or context changes. Separately check whether the chosen communication channel requires consent or another condition.
03Provide information and respect objections
Prepare clear privacy information explaining who is responsible, why data is used, the lawful basis, relevant sources, recipients, retention approach and applicable rights. When obtaining data indirectly, assess the timing requirements under GDPR Article 14, including information at first communication where applicable. Do not assume that a public source removes transparency duties, and verify whether any claimed exception genuinely applies.
Make the right to object to direct marketing easy to understand and exercise, and bring it explicitly to the person's attention where required. When someone objects to processing for direct marketing, stop that use, including related profiling. Distinguish marketing objections from other rights requests and route each appropriately. Keep only justified suppression information needed to avoid renewed contact, with controlled access and an appropriate retention rationale.
04Set retention and review the data lifecycle
Define retention criteria connected to the prospecting purpose rather than keeping every contact indefinitely. Consider how quickly role information becomes outdated, whether any meaningful interaction occurred and whether another obligation affects particular records. Set review points and a practical deletion or anonymisation process. A retention period copied from another organisation is not a substitute for reasoning about your own processing.
Map data sources, recipients and any service providers, including relevant contractual, security and international transfer considerations. Limit access to people who need it and establish a way to correct inaccurate details. Review a small sample against your documented rules: lawful basis, information provided, objections honoured and retention decisions. Record gaps and corrective actions without claiming that a checklist proves complete legal compliance.
Worked example
A consultancy considers contacting named purchasing managers in two countries. It maps the proposed data and email channel, checks each country's marketing requirements and assesses any proposed legitimate interests basis. It prepares source-specific privacy information, an objection process and justified retention criteria. If a required condition is missing, it does not launch that activity.
Pitfalls to avoid
- Assuming publicly available work details can be reused without a lawful basis or transparency.
- Confusing a GDPR lawful basis with permission under national electronic marketing rules.
- Keeping dormant prospect records indefinitely or deleting every suppression record without considering renewed-contact risk.
Practise
Course progress
This shareable badge records self-declared course completion. It is not an accreditation or an independently verified certification.
Frequently asked questions
Is consent always required for B2B prospecting?
There is no universal answer. The lawful basis for personal data processing and the rules for the chosen marketing channel must both be assessed for the relevant jurisdiction, recipient and activity.
Can I keep a minimal record after a marketing objection?
A limited suppression record may be appropriate to prevent renewed marketing. Determine its lawful basis, content, access controls and retention according to the circumstances and applicable requirements.
Define the purpose and applicable rules — What should be understood?
Describe the exact prospecting activity before collecting data: the audience, professional problem, information needed and proposed channel. A named work email or identifiable business mobile number can be personal data. Separate information about an organisation from information relating to an identifiable person.
Assess lawful basis and balance interests — What should be understood?
Choose and document an appropriate lawful basis for each processing purpose before starting. If considering legitimate interests, articulate the specific interest, test whether the processing is necessary and assess the impact on the individual. Consider less intrusive alternatives. Legitimate interests are not automatically available because a person works for a business or their contact details appear in a public source.
Provide information and respect objections — What should be understood?
Prepare clear privacy information explaining who is responsible, why data is used, the lawful basis, relevant sources, recipients, retention approach and applicable rights. When obtaining data indirectly, assess the timing requirements under GDPR Article 14, including information at first communication where applicable.
Set retention and review the data lifecycle — What should be understood?
Define retention criteria connected to the prospecting purpose rather than keeping every contact indefinitely. Consider how quickly role information becomes outdated, whether any meaningful interaction occurred and whether another obligation affects particular records. Set review points and a practical deletion or anonymisation process.
Define the purpose and applicable rules — What should be checked?
Define retention criteria connected to the prospecting purpose rather than keeping every contact indefinitely. Consider how quickly role information becomes outdated, whether any meaningful interaction occurred and whether another obligation affects particular records. Set review points and a practical deletion or anonymisation process.