GDPR and B2B Leads: A Compliance Guide for UK Businesses

The rules for business data are not the consumer rules

A lot of GDPR fear comes from conflating consumer and business marketing. Cold marketing to consumers needs consent; contacting a company about a relevant business service uses a different basis - legitimate interest - with conditions attached. Understand which rules apply to which contact and most of the anxiety disappears.

This guide covers buying and using B2B leads. If you market to consumers, seek consent and take specialist advice.

See how compliant B2B lead feeds work - start your free 7-day trial.

The lawful basis: legitimate interest

For corporate prospects, legitimate interest is usually the right basis for a relevant first contact. It requires three things: a genuine purpose (offering a relevant service), the necessity of the processing (you cannot market without it), and a balance of interests (your purpose outweighs the individual's expectations, or the contact is so relevant that it does not intrude).

Document it with a quick legitimate interest assessment so you can demonstrate your reasoning if challenged.

• State your purpose clearly
• Confirm the processing is necessary for it
• Weigh the individual's interests and privacy expectations
• Balance in favour of your purpose, or adjust the approach

Where your data comes from matters

The data source determines how you may use it. Public registers like Companies House, official probate and planning data, and records the prospect gave you directly are different from third-party lists. Make sure any lead supplier has the right to provide the data and that the data was collected lawfully.

Keep a record of the source for every lead. If you can show where the data came from and that it was lawfully obtained, you are in a far stronger position than a business that cannot explain its list.

PECR and the cold-email rules

Alongside GDPR, PECR governs electronic marketing. Cold email to a corporate address is permitted if: it is genuinely relevant to the recipient's business role, your sender identity is real and accurate, and every message carries a clear, working opt-out. Do not send cold email to individual consumers, and do not hide behind a no-reply address.

Always provide a suppression route and honour it immediately. A clean, up-to-date suppression list is your best defence.

Build a compliant outreach routine - start your free trial.

Practical habits that keep you safe

Compliance is a set of habits, not a one-off document:

• Buy from reputable sources with clear data rights
• Record the lawful basis and source for each lead
• Identify yourself honestly in every message
• Give a clear opt-out and process it without delay
• Maintain a suppression list and check it before sending
• Re-train your team so everyone follows the same rules

Done consistently, these habits make a complaint the rare exception - and give you the records to handle it confidently if one comes.