[GTM glossary](/glossary.txt) GDPR compliance Data & Enrichment # GDPR compliance In short GDPR compliance is the state of following the EU General Data Protection Regulation when you process personal data of individuals in the EU or UK-aligned equivalents, including B2B contact data such as names, work emails, and job titles. This page is general information, not legal advice. Ask qualified counsel how the rules apply to your situation. ## Why GTM teams need to care Prospecting lists, enrichment, cold email, and tracking all involve personal data. A work email address that identifies a person counts as personal data even though it is a business address. --- ## Core principles * **Lawful basis:** You need a valid reason to process data, such as consent or legitimate interests. * **Purpose limitation:** Use data only for the purposes you told people about. * **Data minimization:** Collect only what you need. * **Accuracy and storage limits:** Keep data correct and delete it when no longer needed. * **Transparency:** Tell people who you are, what you hold, and why. --- ## Individual rights People can ask to access, correct, delete, restrict, or move their data, and can object to certain processing such as direct marketing. You need a process to answer these requests within the required timeframe. --- ## A practical checklist for sales and marketing ### Know your data Keep a record of what personal data sits in the CRM, where it came from, and which tools receive it. ### Document your basis Many B2B teams rely on legitimate interests for outreach to relevant business contacts, which generally calls for a written balancing assessment. Others use consent. Choose with legal advice. ### Make opting out easy Include a clear opt-out in every message and sync suppression lists across tools, so a person who objects is not contacted again. ### Vet vendors Check where data providers sourced their data, and sign data processing agreements with tools that handle personal data for you. --- ## Common mistakes * **Assuming business emails are exempt:** They are not when they identify a person. * **No deletion process:** Records linger in spreadsheets and sequencing tools. * **Unvetted data sources:** Buying lists without knowing how they were collected shifts risk onto you. --- ## GDPR compliance FAQs **What is GDPR compliance?** GDPR compliance means following the EU General Data Protection Regulation when you handle personal data of people in the EU. It covers lawful basis, transparency, security, and individual rights such as access and deletion. This is general information, not legal advice. **Does GDPR apply to B2B sales and marketing?** Yes. A work email, name, or job title that identifies a person is personal data, even in a business context. B2B outreach and enrichment therefore need a lawful basis and respect for opt-out and deletion rights. Consult counsel for specifics. **Can you do cold outreach and stay GDPR compliant?** It can be possible with a documented lawful basis, relevant targeting, clear notice, and an easy opt-out, but rules also depend on national email marketing laws. This is general information, not legal advice, so check with a lawyer. **What are the main GDPR rights people have over their data?** People can generally ask to access their data, correct it, delete it, restrict processing, move it elsewhere, and object to direct marketing. Organizations need a process to respond within the legal deadline. Share term --- ## More related phrases * [CAN-SPAM](/glossary/can-spam.txt) * [CASL](/glossary/casl.txt) * [Double opt-in](/glossary/double-opt-in.txt) ## Similar phrases * [Data privacy](/glossary/data-privacy.txt) Data privacy is the set of rules and practices that govern how personal information is collected, used, stored, and shared, so people keep control over their data. * [Data security](/glossary/data-security.txt) Data security is the set of technical and organizational controls that protect data from unauthorized access, loss, or alteration, including encryption, access control, and monitoring. * [Do not contact list](/glossary/do-not-contact-list.txt) A do not contact list records the people, domains, and companies your team must not message or call, so outreach respects opt-outs, legal limits, and business rules. * [CCPA (CCPA)](/glossary/ccpa.txt) The CCPA, or California Consumer Privacy Act, is a California privacy law that gives residents rights over their personal information and sets duties for the businesses that handle it. * [First-party data](/glossary/first-party-data.txt) First-party data is information a company collects directly from its own customers, prospects, and channels, such as CRM records, product usage, and website behavior.