B2B data and GDPR: what you can store, use and email

October 30, 2026

B2B data and GDPR can feel like a legal minefield, but for most sales teams it boils down to a few operational rules. This practical reading gives you a checklist for storing, using, and emailing business contacts without crossing the line.

Lawful Basis For Business Contacts

Under GDPR, you need a lawful basis to process personal data like a business contact's name and email. For B2B prospecting, legitimate interest is often the most practical basis, but it requires a balancing test: you must show a genuine business need that doesn't override the individual's rights. Document this assessment for each data source—whether it's a lead generation tool, a conference list, or a LinkedIn export.

Consent is another option, but it's harder to obtain and manage for B2B cold outreach. If you rely on legitimate interest, keep your use narrow: relevant, role-based contacts whose data you've collected from public or professional sources. Avoid scraping personal emails or using data for purposes unrelated to the contact's job.

Conduct and record a Legitimate Interest Assessment (LIA) for each data source.
Prefer professional contact details over personal ones.
Ensure the contact's role aligns with your offer (e.g., a CFO for finance software).
Never use B2B data for unrelated marketing without a new basis.

What The First Email Must Say

Your first outreach email must be transparent about who you are and why you're contacting them. Include your company name, a clear statement of purpose, and a link to your privacy policy. Under GDPR, you also need to provide the source of the contact's data and your lawful basis—legitimate interest—in a concise way.

Keep it human: explain why you're reaching out and how it benefits them. Avoid vague claims. Make it easy for them to opt out; a simple 'reply STOP' or an unsubscribe link is fine. This transparency builds trust and reduces spam complaints, which can harm your sender reputation.

Identify yourself and your company clearly.
State the purpose of the email and why you're contacting them.
Include a link to your privacy policy and mention legitimate interest.
Provide a simple opt-out mechanism.
Mention how you found their contact details.

Opt-Out Handling And Suppression Lists

When someone opts out, honor it immediately—no exceptions. GDPR requires you to stop processing for marketing purposes, and continuing to email after an opt-out is a compliance risk. Implement a suppression list that's checked before every send, and ensure it's updated across all systems (CRM, email platform, etc.).

Suppression lists should include not just opt-outs but also hard bounces and complaints. Regularly audit your lists to remove duplicates and inactive contacts. Document your opt-out process so you can demonstrate compliance if asked.

Action opt-outs within 24 hours across all systems.
Maintain a central suppression list and check it before each campaign.
Include hard bounces and spam complaints in the suppression list.
Train your sales team to respect opt-outs even in manual outreach.

Retention And Deletion

GDPR's storage limitation principle means you shouldn't keep personal data longer than necessary. For B2B contacts, define a retention period based on your sales cycle and engagement. For example, if a contact hasn't engaged in 12–24 months, consider deleting or anonymizing their data.

Implement automated deletion or review processes. Document your retention policy and make sure it's applied consistently. If someone requests erasure, you must comply unless you have a legal reason to keep the data. Regularly purge old leads from your CRM to keep your database clean and compliant.

Set a clear retention period (e.g., 18 months of inactivity).
Automate deletion or flagging of stale contacts.
Document and follow a data erasure request procedure.
Review retention policies annually.

What To Keep In Your DPA

If you use third-party tools for lead generation, email sending, or CRM, you need a Data Processing Agreement (DPA) with each vendor. The DPA should outline the scope of data processing, security measures, sub-processors, and breach notification timelines. Ensure the vendor complies with GDPR and that data transfers outside the EU are safeguarded (e.g., Standard Contractual Clauses).

Keep a record of all DPAs and review them when vendors change their terms. Your DPA should also specify how data is returned or deleted at the end of the contract. This protects you if a vendor mishandles data.

Have a DPA with every vendor that processes personal data.
Check for sub-processor clauses and data transfer safeguards.
Ensure breach notification is within 72 hours.
Include data deletion/return terms at contract end.

Building A Compliant Prospecting Workflow

Putting it all together: a compliant B2B prospecting workflow starts with sourcing data responsibly, documenting your lawful basis, and being transparent in your outreach. Use tools that support suppression lists and retention policies, and train your team on GDPR basics.

Regular audits—quarterly or annually—help catch issues early. Remember, GDPR is about accountability: if you can't prove you're compliant, you're not. Keep records of your LIAs, opt-outs, and retention actions.

Source B2B contacts from reputable providers with clear data origins.
Integrate suppression lists and retention rules into your CRM.
Train sales and marketing on GDPR do's and don'ts.
Conduct regular compliance audits and update documentation.

GDPR doesn't have to block your B2B sales—it's about being transparent and organized. Use this checklist to audit your current process and make compliance a habit, not an afterthought.

Useful links

FAQ

Can I email B2B contacts without consent under GDPR?

Yes, if you rely on legitimate interest and meet the balancing test. You must still provide transparency and an opt-out. Consent is not always required for B2B outreach, but you must document your assessment.

What should I do if someone opts out of my emails?

Immediately add them to your suppression list and stop all marketing emails. Confirm the opt-out if possible. Do not email them again unless they re-opt-in.

How long can I keep B2B contact data?

Only as long as necessary for your purpose. Define a retention period (e.g., 18–24 months of inactivity) and delete or anonymize data after that. Document your policy.

Do I need a DPA with my CRM provider?

Yes, if the CRM processes personal data on your behalf. Ensure the DPA covers GDPR requirements like security, sub-processors, and breach notification.