Your enrichment waterfall checks four data vendors in a row and finally finds a direct dial for a VP at a key account. Then she emails your rep: Where did you get my number? Nobody can say which vendor supplied it, and enriched B2B contact data privacy just became a RevOps problem.
That's daily life with B2B contact data. It's across multiple tools, and only ops knows how it got there. So RevOps needs a clear answer for how a go-to-market (GTM) intelligence platform should handle data privacy for enriched contact records.
This guide gives you a practical process you can standardize across reps and tools. It's not legal advice, so run your final policies past your counsel before you roll them out. We'll also label which rules come from EU GDPR, UK guidance, or California law.
What Counts as Personal Data in Contact Enrichment
A GTM intelligence platform should treat every enriched contact record as personal data. That means collecting only what a defined sales purpose needs, documenting your lawful basis and data sources, and honoring opt-outs and deletion requests fast. It also means limiting who can access records and purging stale ones on a schedule.
Personal data is information that can point to a specific person. The GDPR Article 4 definitions put it this way: "'personal data' means any information relating to an identified or identifiable natural person." That's the EU GDPR wording, and a person counts as identifiable even when you need to combine a few details to know who they are.
Contact enrichment means adding missing details to a contact record from outside sources. Most enriched fields are personal data. Here's how to sort them:
- Named work email: An address built from someone's name at a company domain points to one person, so it's personal data.
- Direct dial: A phone number that rings one person's desk or mobile identifies that person.
- Job title plus employer: Together, they often point to one person, like the only head of RevOps at a 40-person startup.
- LinkedIn profile URL: A profile URL identifies a named individual online, so it's personal data.
- Generic inbox or firmographics: An info@ address, headcount, or industry describes a company rather than a person, so it usually isn't personal data.
Identity resolution adds a twist most guides skip. It's the process of matching scattered clues, like an anonymous website visit or a personal email signup, to one real person and account. Person360 identity resolution does this by stitching anonymous and known activity into one person-level profile.
That helps you prioritize the right buyers. It also means a resolved profile is personal data, so govern it like any other contact record.
Lawful Basis and Consent Questions to Answer First
Under EU GDPR, you need a lawful basis, meaning a legal reason, for every use of personal data. Most B2B enrichment relies on legitimate interests rather than consent.
Consent means the person actively agreed, as opt-in B2B leads do when they check a box on your form. Legitimate interests means you have a real business reason that the person's rights don't outweigh. Document your choice once, then apply it across every tool and rep.
The Legitimate Interests Test
The UK's privacy regulator, the Information Commissioner's Office (ICO), offers a clear framework. According to the ICO legitimate interests guidance, "Legitimate interests can be broken down into a three-part test." EU GDPR uses the same legal basis, so the test works as a model for EU contacts too.
- Purpose test: Is your interest legitimate? Write it down first, like reaching buying committees at accounts that fit your ideal customer profile.
- Necessity test: Do you need this person's data for that purpose? Check whether fewer fields would do the job.
- Balancing test: Do the person's interests override yours? A work email used for relevant B2B outreach may weigh differently than a personal mobile number.
The ICO also recommends keeping a record of your legitimate interests assessment (LIA) and its outcome. Store it where security reviewers can find it, rather than in one ops person's head.
Keep one caveat in mind. Separate rules may apply to email and phone outreach. The ICO notes that legitimate interests covers direct marketing only where those rules don't require consent, so check them with counsel first.
What Changes for US and California Contacts
EU GDPR can reach companies outside Europe. Under GDPR Article 3 territorial scope, it covers a company "not established in the Union" that processes data about people in the EU. That applies when the processing relates to offering them goods or services or monitoring their behavior in the EU, so check your plays with counsel.
California closed a gap many B2B teams still assume is open. The California Consumer Privacy Act (CCPA) once had a temporary exemption covering business-to-business data. According to the California AG CCPA FAQ, "The exemptions for [...] personal information reflecting business-to-business transactions [...] expired on December 31, 2022."
So California contacts in your CRM now have rights to know about, delete, and correct their data, if your business meets the law's thresholds. And don't assume "publicly available" means exempt. California excludes only defined categories, such as certain government records.
A Step-by-Step Process for Handling Enriched Contact Data
Privacy policies break down when every rep and tool follows a different version. These five steps give RevOps one process for enriched B2B contact data privacy, standardized across reps, tools, and vendors.
Step 1: Review Every Data Source
Map where every enriched field comes from. For each one, name the vendor, the date it arrived, and how that vendor sourced it.
Under EU GDPR, people have a right to know where you found them. For data you didn't get from the person, GDPR Article 14 notice requirements require you to name "from which source the personal data originate." The notice is due "at the latest within one month," or at your first contact if you reach out sooner.
An enrichment waterfall queries several data providers in sequence until one returns a match. Every vendor in that chain adds another source to explain and another subprocessor to list. A subprocessor is a third party that handles personal data on your behalf.
Fewer vendors mean fewer sources to document. But completeness matters most: Whatever B2B data enrichment tools you use, your source map has to cover all of them.
Step 2: Minimize the Fields You Collect
Data minimization means collecting only the fields a specific purpose needs. Under the GDPR Article 5 principles, personal data must be "adequate, relevant and limited to what is necessary." If your outbound play only uses work email and title, don't enrich personal mobile numbers just because a vendor offers them.
Ask one question for every field: Which play uses this, and who reads it? If nobody can answer, turn that field off.
Accuracy is also a privacy duty. Article 5 requires personal data to be "accurate and, where necessary, kept up to date." A wrong title attached to a real person is a problem in its own right.
That's why always-on enrichment with quality control matters for privacy. In Common Room, AI quality control blocks inaccurate enrichments, and enhanced identity merging cuts duplicate records by up to 79%. The result is fewer, better records you can stand behind.
Step 3: Set and Enforce Retention Rules
Article 5 also sets a storage limitation principle. You can keep identifiable personal data "for no longer than is necessary for the purposes." GDPR doesn't set a fixed period, so you define it.
Write a rule for inactive prospects, for example, reviewing any contact with no engagement in 12 months. Then decide whether to refresh, archive, or delete those records, and put that decision on a schedule.
Duplicates make this harder. Running CRM health checks with DataAgent surfaces outdated and duplicate Salesforce records, so you can fix or purge them on a set cadence.
Temporary handling sets a good pattern. Common Room's website visitor tracking, for example, stores IP addresses temporarily to add contacts and organizations. It doesn't keep them longer term for other purposes.
Step 4: Handle Opt-Outs and Data Requests Fast
Under EU GDPR, an objection to direct marketing is final. Under the GDPR Article 21 right to object, when someone objects, "the personal data shall no longer be processed for such purposes."
Other requests, like access or deletion, need a fast answer too. Under GDPR Article 12 response deadlines, you respond "within one month of receipt of the request." You can extend that by two more months for complex requests, but you have to tell the person within the first month.
California runs on a different clock. According to the state's attorney general, businesses must respond "within 45 calendar days," with one 45-day extension if they notify the person.
Here's the trap when your stack has many tools: Someone opts out in your CRM, and a different enrichment vendor finds them again next week. Sync your suppression lists, meaning your do-not-contact and deleted records, across every tool so no system quietly re-enriches them.
Step 5: Lock Down Access and Plan for Breaches
Not everyone needs to see a direct dial. Use role-based access control (RBAC), which grants permissions by job role, plus single sign-on (SSO). Encrypt data in transit and at rest, so it stays scrambled while it moves and while your systems store it.
Check that every vendor supports these controls. Common Room, for example, supports "single sign-on and role-based access control, as well as SAML and SCIM," according to its security page. The same page lists "fine-grained auth and permission control."
Under EU GDPR, a controller is the company that decides how and why to use personal data. For enriched records, that's usually you. GDPR Article 33 breach notification requires controllers to alert regulators "not later than 72 hours after having become aware of it," where feasible.
Vendors that process data for you owe you notice "without undue delay," so set a specific timeline in each contract. Some low-risk breaches don't need reporting, but let counsel make that call.
Finally, sign a data processing agreement (DPA) with every vendor that touches contact data. A DPA spells out how the vendor handles, protects, and deletes your data. Look for vendors that publish theirs, like Common Room's published data processing addendum.
Questions to Ask a GTM Intelligence Vendor
Security reviews stall when vague questions get vague answers. Paste these questions into your next review of data enrichment software or services.
A SOC 2 Type 2 report is an independent audit of how well a vendor's security controls work over time. SAML and SCIM connect a tool to your identity provider for logins and user setup. Personally identifiable information (PII) is data that identifies a person.
| Question | Why it matters | A good answer looks like |
|---|---|---|
Where does each enriched field come from, and how do you document it? | EU GDPR notices must name the source | A source record for every field, kept current |
Can we review your DPA and subprocessor list? | Each subprocessor handles your contacts' data | A published DPA and a current subprocessor list |
Which security certifications do you hold? | Independent audits beat self-reported claims | A SOC 2 Type 2 report you can request |
Do you encrypt data in transit and at rest? | Encryption limits exposure if systems fail | Yes for both, with details on request |
Do you support SSO, RBAC, SAML, and SCIM? | Access should follow your identity provider | All four, with permissions set by role |
How do you handle deletion and PII removal? | Rights requests need a reliable path | Right-to-be-forgotten support and a programmatic way to remove PII |
Do opt-outs sync across every connected tool? | Unsynced opt-outs lead to re-enrichment | Suppression that syncs with your CRM and other tools |
How long do you keep our data, including IP addresses? | Storage limits apply to vendors too | Clear retention periods for each data type |
How do you stop inaccurate enrichments? | Wrong data about a person is a privacy problem | Automated quality checks and duplicate merging |
For a real example, see Common Room's security and compliance page. It lists a SOC 2 Type 2 report, encryption in transit and at rest, and right-to-be-forgotten support. It also covers SSO, role-based access control, SAML, and SCIM.
According to the page, "We adhere to GDPR and CCPA regulations and provide a programmatic integration to remove all personally identifiable information." Use trust pages like this as a starting point, then verify the details in the DPA and audit report.
For criteria beyond privacy, like match rates and pricing, see our guide on how to choose a data enrichment company.
Common Mistakes With Enriched Contact Data
Most privacy problems in sales come from habits rather than bad intent. Here are six worth fixing first.
- Assuming public or business data is exempt: Work emails, direct dials, and titles can identify someone, so they generally fit Article 4's definition.
- Never telling people where their data came from: EU GDPR Article 14 requires that notice, so build it into your first outreach.
- Keeping records forever: Stale records add risk without adding pipeline, so refresh or purge them on a schedule.
- Opt-outs that don't sync: An opt-out in one tool falls apart if another vendor re-enriches the contact next week.
- Vendors without DPAs: Every vendor handling contact data needs a signed DPA, or you can't show how it protects that data.
- Treating fines as theoretical: EU GDPR sets maximum penalties that scale with company size.
GDPR Article 83 fines for the most serious violations go "up to 20 000 000 EUR." For a company, they can reach "up to 4 % of the total worldwide annual turnover [...], whichever is higher." Those are EU GDPR ceilings, not typical amounts, and California sets its own penalties.
FAQ: Enriched B2B Contact Data Privacy
Here are quick answers for RevOps and security reviewers. Each one maps to a step above.
How Should a GTM Intelligence Platform Handle Enriched Contact Privacy?
A GTM intelligence platform should treat every enriched record as personal data and collect only what a defined purpose needs. It should also document each source and lawful basis, honor opt-outs fast, limit access, and purge stale records on a schedule.
Does GDPR Apply to B2B Contact Data?
Yes, in most cases. A work email, direct dial, or job title can identify a person, so it generally fits EU GDPR's Article 4 definition of personal data.
Can You Enrich B2B Contact Data Without Consent?
Legitimate interests, the EU GDPR lawful basis in Article 6(1)(f), may let you skip consent, and the UK ICO assesses it with a three-part test. Separate rules may apply to email and phone outreach, so check those with counsel.
How Long Can You Keep B2B Prospect Data?
Under EU GDPR Article 5, you keep identifiable personal data "for no longer than is necessary for the purposes," with no fixed period. Write a retention rule for inactive prospects and enforce it on a schedule.
Do US Companies Need to Follow GDPR When Enriching Data?
EU GDPR can apply without a European office if you offer goods or services to people in the EU or monitor their behavior there. California contacts also have CCPA rights, since the state's B2B exemption expired on December 31, 2022.
Is LinkedIn Data Enrichment Allowed Under GDPR?
There's no blanket yes. It depends on your lawful basis, whether you tell people where you got their data, and whether your method follows LinkedIn's terms of service.
Turn Enriched Records Into Trusted Buyer Intelligence
Your team doesn't need more contact data. It needs data it can trust, explain, and defend when a buyer or a security reviewer asks where it came from.
When every enriched record has a known source, a clear purpose, and a retention rule, reps trust it and security reviews get easier. At Common Room, we help RevOps teams build that kind of complete, trusted buyer intelligence with identity resolution, quality-controlled enrichment, and governed access.