The GDPR did not make lead generation impossible, only sloppiness. If your legal bases, processes and tooling are in order, you simply keep growing. This is what you need to arrange.

Contact details are personal data

A business email address containing a name, a direct phone number, a LinkedIn profile: under the GDPR these are all personal data. Anyone generating B2B leads is by definition processing personal data and needs a valid legal basis to do so.

For B2B marketing, "legitimate interest" is often the workable basis: direct marketing to business decision-makers can fall under it, provided you document a balancing test and offer a clear opt-out. Consent is the stronger basis, but it must be free, specific and demonstrable: a pre-ticked box does not count.

Email, phone and tracking: what is allowed when

  • Cold business email: only with opt-in or under strict conditions; check national e-privacy rules alongside the GDPR
  • Phone acquisition towards companies: allowed with opt-out, but respect objections immediately and record them
  • Tracking and marketing cookies on your site: always prior consent via a consent banner, otherwise no pixel

The information duty almost everyone forgets

If you do not collect data directly from the person, for example via data providers or scraping, Article 14 applies: within a month or at first contact you must tell the individual what data you hold, for what purpose, and where it came from. Include this in your first outreach or privacy statement.

Data subject rights: build the process

Access, correction, erasure, objection: every request must be handled within a month. In practice this means one central email address, a suppression list so removed contacts are never re-imported, and logging of every opt-out.

Working compliantly is a competitive advantage: clean data, better deliverability and outreach that does not feel like spam demonstrably converts better.

The practical checklist

  • Legal basis documented per channel (balancing test or consent log)
  • Data processing agreements with CRM, email and advertising platforms
  • Retention periods set: remove leads that have been silent for two years
  • Opt-out in every message and a suppression list in your CRM
  • Consent banner for cookies, connected to your tag manager

This article is general information, not legal advice. Consult a privacy lawyer for your specific situation.