Key takeaways
- Business contact details are personal data under GDPR.
- B2B prospecting usually relies on legitimate interest, which needs a documented balancing test.
- People must be told where their data came from and how to object.
- A compliant data source does not make your own use of the data compliant.
What does GDPR compliance mean for sales teams
For sales teams, GDPR compliance means every contact in your CRM is there for a reason you can explain and the person can find out about it and opt out. The law applies to individuals' data, and a named person at a company is an individual.
The UK has its own version, UK GDPR, which follows the same principles. Email and phone marketing rules sit alongside it, in PECR in the UK and in national ePrivacy laws across the EU, and some of those rules treat corporate addresses differently from individuals' addresses.
What does GDPR ask of B2B prospecting
GDPR asks B2B prospecting to rest on a lawful basis, to be transparent and to respect objections. Each of those turns into a practical habit for the team.
- Lawful basis: usually legitimate interest, backed by a written assessment that the outreach is relevant to the person's role and that their interests are not overridden.
- Transparency: tell people who you are, where you got their details and how to object, normally in your first message or a linked privacy notice.
- Objection: stop at once when someone opts out, and keep a suppression record so they are not added again.
- Minimisation and accuracy: hold only what the outreach needs and remove details you know are wrong.
- Retention: delete contacts who never engage after a period you have decided and written down.
What does GDPR compliant data settle for the sender
GDPR compliant data settles how the provider collected and handles the data; it does not settle your own use of it. Once the contacts sit in your CRM, you are a controller of that data and carry your own duties.
That means you still need your own lawful basis for contacting each person, your own privacy notice, a way to handle objections and access requests, and records of what you decided. Ask any data provider what they can share to support your transparency notice.
What are the most common GDPR mistakes in sales
The most common GDPR mistakes in sales are messaging people with no link to what you sell, failing to say where their details came from and losing track of who opted out. Each one is a process gap rather than a legal puzzle.
Importing an old spreadsheet with no record of where it came from is another frequent problem. If you cannot explain a contact's origin, the safest choice is usually not to contact them.
Where Pebbles Ai fits
- CapabilityProspecting & customer recordsLeads found with Find fresh leads come from Pebbles Ai's own growing B2B contact database, which is GDPR compliant. They land as contacts in a segment in the CRM (in Beta); your own lawful basis, notice and opt-out handling remain yours.
- CapabilityAI workspaceIn Manual mode, email sends and other actions that reach the outside world wait for your approval, which gives a checkpoint before any message to a new contact goes out.
Common questions
Does GDPR apply to business email addresses?
Yes, when the address identifies a person, such as a first name and surname at a company domain. A generic address like a shared sales inbox is generally not personal data.
Do you need consent for B2B cold email under GDPR?
Not always. Many B2B senders rely on legitimate interest, but national email marketing rules may still apply, so check the rules for each country you send to or take legal advice.
Does GDPR apply to companies outside the EU and UK?
Yes, if they offer goods or services to people in the EU or UK or monitor their behaviour. Where the sender is based does not decide it.
About this page. Written by the Pebbles Ai team for people who run sales, marketing and growth. Last updated .
