The GDPR did not make lead generation impossible, only sloppiness. If your legal bases, processes and tooling are in order, you simply keep growing. This is what you need to arrange.

Contact details are personal data

A business email address containing a name, a direct phone number, a LinkedIn profile: under the GDPR these are all personal data. Anyone generating leads (B2B or B2C) is processing personal data and needs a valid legal basis to do so.

For B2B marketing, "legitimate interest" is often the workable basis: direct marketing to business decision-makers can fall under it, provided you document a balancing test and offer a clear opt-out. For B2C marketing, consent is more often required or safer. Consent must be free, specific and demonstrable: a pre-ticked box does not count.

Email, phone and tracking: what is allowed when

  • Cold business email: only with opt-in or under strict conditions; check national e-privacy rules alongside the GDPR
  • Phone acquisition towards companies: allowed with opt-out, but respect objections immediately and record them
  • Consumer marketing: stricter requirements; often consent and respect for do-not-call registers
  • Tracking and marketing cookies on your site: always prior consent via a consent banner, otherwise no pixel

The information duty almost everyone forgets

If you do not collect data directly from the person, for example via data providers or scraping, Article 14 applies: within a month or at first contact you must tell the individual what data you hold, for what purpose, and where it came from. Include this in your first outreach or privacy statement.

Data subject rights: build the process

Access, correction, erasure, objection: every request must be handled within a month. In practice this means one central email address, a suppression list so removed contacts are never re-imported, and logging of every opt-out.

Working compliantly is a competitive advantage: clean data, better deliverability and outreach that does not feel like spam demonstrably converts better.

The practical checklist

  • Legal basis documented per channel (balancing test or consent log)
  • Data processing agreements with CRM, email and advertising platforms
  • Retention periods set: remove leads that have been silent for two years
  • Opt-out in every message and a suppression list in your CRM
  • Consent banner for cookies, connected to your tag manager

Frequently asked questions

Does the GDPR also apply to B2C lead generation?

Yes. The GDPR applies to any processing of personal data of natural persons in the EU, whether you collect B2B or B2C leads. For B2C, consent is more often the right or safer basis, and telecom and consumer rules often apply on top of the GDPR.

Can I use LinkedIn profiles for cold outreach?

A LinkedIn profile contains personal data. You need a valid legal basis, must inform the individual (often under Article 14) and must respect objections. Scraping against the terms of use or without a legal basis is risky. Treat LinkedIn data as carefully as any other lead source.

Consent is an active, free and specific yes from the individual, and it must be demonstrable. Legitimate interest requires a balancing test: your interest must not disproportionately harm the individual’s privacy, and there must be a clear opt-out. For B2B direct marketing, legitimate interest is often workable; for many B2C channels, consent is stronger or required.

How long may I keep lead data?

Only as long as needed for the purpose, no longer. Set retention periods (for example delete or anonymise leads that have been silent for a long time) and document them. The GDPR does not prescribe a fixed number of months; proportionality matters.

What should I do if someone objects or asks for erasure?

Handle the request within a month, erase or block the data where required, and put the contact on a suppression list so it is not re-imported. Log the opt-out. Objections to direct marketing should in principle be honoured.

Are marketing cookies on my landing page always subject to consent?

Marketing and tracking cookies that are not strictly necessary require prior consent via a consent banner. Without consent you must not load a marketing pixel. Strictly necessary functional cookies for the service usually fall outside that requirement.

This article is general information, not legal advice. Consult a privacy lawyer for your specific situation.