B2B lead generation needs a review of the applicable data-protection and electronic-marketing rules. Public contact data, a business email address or a provider’s compliance claim does not create a blanket permission to send outreach. This article is general information, not legal advice or a compliance certification.
Separate obtaining contact data from permission to use it
Begin by documenting the intended campaign: countries, recipient types, contact fields, collection source, message channel and purpose. Identify which organizations are responsible for each step. A tool can supply a record or an export, while the sender still needs to decide whether and how the record may be used.
Review lawful basis and applicable marketing rules
The GDPR sets requirements for personal-data processing. Article 6 describes lawful bases; legitimate interest requires an assessment rather than an automatic exemption for B2B marketing. Article 14 addresses information when data was not obtained from the individual. Article 21 addresses objections to direct marketing. Article 37 describes circumstances requiring a data protection officer; it does not set a universal €50 million revenue threshold.
Electronic-marketing rules are a separate part of the review. The UK ICO’s business-to-business marketing guidance distinguishes corporate subscribers from sole traders and some partnerships under PECR, and explains that the UK GDPR still applies when personal data is processed in a business context. UK guidance is not a substitute for the rules applicable in each EU country. The ICO page also states that its guidance is under review following legislative changes.
Build a practical review record before outreach
Use the European Data Protection Board’s small-business guide to structure the assessment. Its guidance addresses processing records, lawful processing, transparency and responsibilities. Keep a review record that your team can maintain when a campaign, provider or target region changes.
- Describe the campaign’s purpose and the exact data fields used.
- Record the data source, collection date and relevant provider documentation.
- Document the applicable lawful basis and any required consent or balancing assessment.
- Decide which notices, retention limits, safeguards and provider agreements your workflow needs.
- Assign an owner for requests and objections, and review the record when the workflow changes.
Plan for individual rights and objections
The EDPB’s guidance on individual rights explains access, correction, erasure and objection rights. Put a request-handling process in place, ensure responsible staff can find the relevant records, and review the applicable response requirements. Keep a suppression process so an objection is not lost when a list is imported again. A general timetable for replying to rights requests is not permission to continue direct marketing after an objection.
Evaluate a data provider without a compliance ranking
Ask the provider about the data supplied, sourcing documentation, applicable contractual terms, security controls and request-handling arrangements. Review your own use of the records separately. This article does not rank vendors by legal compliance, promise a particular enforcement outcome or assert a typical fine range.
Evascrape is a contact-data extraction product with CSV and API delivery. It does not replace a sender’s legal assessment or authorize an outreach campaign. Read the product documentation for the actual workflow, and the existing data-use information when evaluating the service.
Sources and review date
Reviewed on 3 October 2026 against the linked EU regulation, EDPB guidance and UK ICO guidance. Check the current rules and national regulator guidance for your specific jurisdiction. Seek qualified advice where your assessment needs a legal conclusion.
Frequently asked questions
Is every B2B outreach campaign lawful under GDPR?
No. A business audience or publicly available contact address does not automatically make a campaign lawful. Assess the applicable jurisdiction, purpose, data, recipients and electronic-marketing rules before sending.
Does legitimate interest automatically authorize cold email?
No. Assess whether the processing has an appropriate lawful basis and whether separate electronic-marketing rules require consent. The answer depends on the circumstances and jurisdiction.
Does a public email address remove data-protection obligations?
No. Publicly available personal data can still be subject to data-protection requirements. Review your purpose, notices, lawful basis and individual rights.
Is there a universal €50M revenue threshold for appointing a DPO?
No such threshold is provided by GDPR Article 37. Evaluate the circumstances described in that article, including relevant processing activities, and applicable national rules.
Can I wait 30 days before stopping direct marketing after an objection?
Do not treat the general response timetable for rights requests as permission to continue direct marketing. The GDPR right to object to direct marketing requires that the data no longer be processed for that purpose.
Does choosing a data provider guarantee that my outreach is compliant?
No. A provider’s location, public-data sourcing or marketing claim does not determine whether your own processing and outreach are lawful. Obtain advice for your specific workflow when needed.