Documentation and execution resources

All processing of personal data requires a valid legal basis. In B2B commercial contact, legitimate interest is commonly invoked, but it is not automatic: it requires a documented assessment balancing your interest against the rights of the individual concerned. That assessment must exist in writing and be available if requested.

You must be able to demonstrate where each data point came from and in what context it was public. Lists of unknown provenance or acquired without guarantees make this impossible, which is itself a compliance failure regardless of how they are used.

Every commercial message must include a visible, simple opt-out mechanism that works. A broken link, a procedure requiring several steps or a route that goes unattended is equivalent to offering none.

The right to object to processing for direct marketing purposes is absolute: it admits no assessment or negotiation. You need a procedure that records each request and guarantees that person receives no further communications on any channel, not only the one through which the right was exercised.

Every communication must clearly identify who is sending it: company name, means of contact and, where applicable, additional identifying details. Concealing or obscuring sender identity is not defensible under any framework.

Individuals whose data you process have the right to know, even if they did not provide it to you directly. Your privacy policy must reflect this processing: what data, for what purpose, on what legal basis, from what origin and what rights apply.

Accessibility of a data point does not determine whether you may use it. What matters is whether your use aligns with the purpose for which it was made public. A phone number published by a business to be contacted commercially supports commercial contact; a personal data point appearing in another context does not.

Even with a valid legal basis, use must be proportionate. A reasonable number of contacts spaced over time is defensible; repeated insistence on someone who does not reply, ignoring the absence of interest, is not, even if the underlying data was legitimate.

Depending on the volume and nature of the data you process, you may be required to maintain a record of processing activities. It is worth verifying whether your case falls within that obligation based on your size and data types.

The applicable framework changes substantially depending on whether the recipient is a business or a consumer. Practices permissible in business-to-business contact do not carry over to contact with private individuals, where consent requirements are considerably stricter.