B2B lead lists and the GDPR: a practical guide for sales teams

Yes, you can use B2B lead lists under the GDPR, but buying or downloading a list does not give you permission to use it. You need your own legal basis, usually legitimate interest backed by a documented balancing test. You must tell people where you got their data, within a month or at your first contact. You must honour every objection, keep the data accurate and delete it when you no longer need it. On top of that, telecom rules decide who you may call or email.

This guide is general information, not legal advice. It reflects the sources as we found them on 20 October 2026. The GDPR has applied since 25 May 2018; national rules in Belgium and the Netherlands add to it.

When B2B data is personal data

Company data, such as a company name, VAT number or head office address, is not personal data. Data about a person is, even at work. The Dutch chamber of commerce KVK gives a clear example: many freelancers run their business from home, so the business address is also a personal address.

The Belgian Data Protection Authority adds two points in its recommendation 01/2026 on direct marketing. Whether you reach someone on a private or a work address does not change whether it is direct marketing. And even a functional address such as info@ can be personal data when one person uses and signs it.

So a typical lead list, with names, job titles, direct numbers and email addresses, falls under the GDPR.

Where B2B lead lists come from

"Public" does not mean "free to use". The Dutch Data Protection Authority says you need a valid legal basis for data from public sources too, because publication does not mean people agree to marketing.

Public registers: KBO and KVK

Belgium. The FPS Economy says that reuse of data from CBE Public Search is prohibited and that systematic downloading is not allowed. The Royal Decree of 18 July 2008 on commercial reuse of KBO data adds that third parties may not use or redistribute personal data from it for direct marketing, as quoted by the Belgian authority in decision 72/2025.

Netherlands. KVK explains that you may use its data for direct marketing only if you follow the rules. Businesses can tell KVK that they want no unsolicited post or door-to-door sales, and KVK files can exclude them. A phone number in the register is not consent for telemarketing, according to the Dutch authority's page on telemarketing.

Buying lead lists: questions to ask your data provider

Buying data does not move your responsibility to the seller. The Belgian authority says a contract clause in which the provider promises GDPR compliance is not enough. It recommends three steps before you use bought data:

1. Ask in writing how the data was collected, how people were informed, which legal basis applies to collecting and passing it on, and how people can object. If the provider relies on legitimate interest, ask for a dated copy of its assessment.
2. Ask for evidence for a sample of records you choose, such as the source, the date of collection and the privacy notice in force at the time.
3. Test it. Use your own email address or phone number to check that objecting actually works.

The risk is real. In decision 72/2025 of 22 April 2025, the Belgian authority's Litigation Chamber found that a B2B data broker's balancing test did not weigh the interests of the people in its database at all. It also held that the general possibility to reuse KBO data does not mean people expect a broker to sell their data. On 17 December 2025 the Market Court partly annulled the decision on a point about informing people, and reduced the other fines.

Legitimate interest for B2B marketing: the three-step test

Recital 47 of the GDPR says direct marketing may be regarded as a legitimate interest. On 4 October 2024 the Court of Justice confirmed that a commercial interest can qualify, on condition that the processing is strictly necessary and the person's interests do not override it.

The EDPB guidelines (version for public consultation) set out three cumulative steps: a lawful, clear and present interest; necessity, meaning no less intrusive way that works just as well; and a balancing test. Do it before you start, and write it down. The EDPB also names reasonable expectations as a key factor, and describes data about someone's professional role as being of a more public nature than, say, financial or location data.

A one-page assessment is enough for most sales teams. Here is a template. The example column is fictional.

Legitimate interest never replaces consent where telecom law demands it. In the Netherlands, for example, sole traders need to have agreed before a sales call. See our guide to cold calling rules in Belgium and the Netherlands.

Informing contacts: Article 14 of the GDPR

When you did not collect the data from the person, Article 14 tells you what to say and when. You share who you are, the purpose, your legal basis and legitimate interest, the categories of data, how long you keep it, their rights including the right to object, their right to complain, and the source of the data.

Timing: within a reasonable period and at the latest within one month, or at your first contact if that comes sooner. Article 21 adds that you must point out the right to object explicitly, at the latest at that first contact.

The exception for "disproportionate effort" is narrow. The Belgian authority found that a data broker could not use it, because it had contact details and could simply have informed people.

On a cold call, the Belgian authority accepts a layered approach. Say the essentials at the start, then offer the full notice, for example by text message with a link. A short notice for that link could read:

"[Company, address] uses your name and business contact details to offer you [service], based on our legitimate interest in finding new customers. We got your details from [source]. We keep them for [period] unless you become a customer. You can ask for access, correction or deletion, and you can object at any time via [email or phone]. You can also complain to the data protection authority."

Retention: how long can you keep a lead?

The GDPR sets no number of years. Article 5 says you keep data no longer than necessary for the purpose, so you set a period you can explain. The Belgian authority says data on prospects should be kept for a shorter time than data on customers. In a consumer case it found eight years disproportionate and pointed to at most three years after the last activity.

Once someone objects, you may no longer keep their data for marketing. Many teams keep a minimal suppression entry so the person is not imported again from a new list. Agree this with your privacy adviser.

Objections and opt-outs

Under Article 21 a person can object to direct marketing at any time, and you must then stop. The EDPB calls this unconditional: no reason needed and no balancing. The Belgian authority recommends letting people object per channel and to all channels at once. For phone calls in Belgium, also check the Bel-me-niet-meer list before every campaign.

Data quality: accurate and minimal

Article 5 also requires accurate data and no more than you need. The EDPB notes that the right to rectification matters most when you did not get the data from the person, because errors are more likely. In practice:

• Import only the columns you will use.
• Remove duplicates and generic records without a clear contact.
• Keep the source and import date on every lead.
• Remove wrong numbers as soon as you find them. In Ringlane, for example, marking a number as invalid takes one key.

Clean data also improves your connect rate, one of the cold calling KPIs worth tracking.

Checklist before importing a list into any tool

1. Write down the source, the purchase or download date and the provider's answers to your questions.
2. Check the reuse terms of the source, especially for KBO data.
3. Complete your legitimate interest assessment and date it.
4. Delete columns you do not need.
5. Split by country and legal form. Netherlands: remove sole traders and partnerships unless they gave consent to be called.
6. Belgium: check the numbers against the Bel-me-niet-meer list and keep dated proof.
7. Remove everyone on your own objection list.
8. Decide how and when you give the Article 14 information.
9. Set a retention period and a date to review the list.
10. Check where the tool stores the data, and sign a processing agreement with the vendor, as Article 28 requires.
11. Keep email separate: most cold emails need prior consent.

Ringlane imports Excel, CSV and Bizzy exports and is hosted in the EU, in Frankfurt. Whichever tool you use, run this checklist first. For where the list fits in your wider pipeline, read our guide to building an outbound sales process.

Frequently asked questions

Sources

1. General Data Protection Regulation (EU) 2016/679 (EUR-Lex)
2. Court of Justice of the EU: judgment of 4 October 2024, C-621/22, KNLTB (EUR-Lex)
3. EDPB: Guidelines 1/2024 on processing based on Article 6(1)(f) GDPR (version for public consultation)
4. Belgian Data Protection Authority: Recommendation 01/2026 on direct marketing (in French)
5. Belgian Data Protection Authority, Litigation Chamber: decision 72/2025 of 22 April 2025 (in Dutch)
6. FPS Economy: CBE Public Search
7. KVK: Direct marketing en regelgeving
8. Autoriteit Persoonsgegevens: Adressenhandel
9. Autoriteit Persoonsgegevens: Telemarketing