GDPR Best Practices

A short, practical guide to using B2B data responsibly under GDPR.

Have a lawful basis

Before using business data for outreach, you need a valid legal reason. For B2B marketing with publicly available business data, the most common one is “legitimate interest” (GDPR Article 6(1)(f)). In plain terms: you can process the data if you have a genuine business need and it does not override the person's rights.

Take only what you need

Export only the fields your campaign actually uses. The export builder lets you select fields, so leave out what you do not need.

Respond to requests on time

People can ask to see, fix, or delete their data. Respond to access requests within 30 days. For deletion requests, remove the data and add the contact to the suppression list so it stays removed. The built-in DSR workflow tracks each request.

Check suppression lists first

Always check suppression lists before any outreach. Exports do this automatically, and you can enable the do-not-call filter when searching for contacts.

More to read

This guide is practical advice, not legal advice. For the binding rules, see the Privacy Policy, the Acceptable Use Policy, and the rest of the Legal Center.