Definition
GDPR and B2B prospecting
Under the GDPR, prospecting professionals does not always require prior consent. France's data protection authority, the CNIL, says B2B prospecting can rely on legitimate interest when the message relates to the person's job, provided they are informed and can object simply and free of charge, at collection and in every message.
By Mo Alani, founder of MimikFlow
What does the GDPR say about B2B prospecting?
The GDPR, the EU General Data Protection Regulation, applies as soon as you process data about individuals. A named address like firstname.lastname@company.com, a work mobile number or a LinkedIn profile are personal data, even in a professional context.
B2B prospecting is not banned for all that. The CNIL separates private individuals, who in principle must consent before receiving prospecting by email, text message or automated call, from professionals, who must be able to object. For professionals, it states that prospecting can rest on the organization's legitimate interest.
This page summarizes the rules the CNIL publishes on its commercial prospecting pages. National rules on electronic marketing vary between countries, so check the guidance of the regulator where your prospects are. This is not legal advice: for a specific case, consult a lawyer or your data protection officer.
Which conditions apply when prospecting a professional?
The first condition concerns the topic. The CNIL states that the subject of the message must relate to the recipient's profession, and gives an example: presenting the merits of a piece of software to a company's IT director. Offering that same director a holiday package at their work address does not meet the condition.
The second concerns information. The person must have been informed that their contact details could be used for prospecting. When the data comes from a third party, for instance a purchased list, the CNIL asks you to make sure they were informed and are able to object: check this with the provider.
The third concerns objection. The person must be able to refuse, simply and at no cost, when their data is collected and in every message. Every message must also identify the organization sending it.
How do you respect the right to object?
The CNIL points out that the right to object to prospecting is absolute: the person does not have to give a reason. A 'do not contact me again' must be applied immediately and permanently, on all your channels.
To avoid contacting someone who objected by mistake, the CNIL describes a suppression list: a file of people who must no longer be contacted, used only to manage those objections. It recommends keeping this information for at least three years and, where possible, in a form that limits the data kept, such as a hash of the address rather than the address itself.
Think about your other tools as well. A prospect who objected by email should not receive a LinkedIn message from another tool of the same company the following week.
How long can you keep prospect data?
In its reference framework on managing commercial activities, the CNIL states that prospect data can be kept for three years from collection or from the last contact initiated by the prospect, such as a reply or a click on a link.
At the end of that period, the organization may contact the person again to ask whether they want to keep receiving messages. Without a positive and explicit answer, the data should be deleted or archived under the applicable rules.
The CNIL specifies that its reference frameworks are not binding: an organization may choose other durations if it can justify the choice, for which it remains responsible.
Which mistakes create risk in B2B prospecting?
Buying a list without knowing where it came from. If the people were never told their details could be used for prospecting, you carry the problem.
Sending offers unrelated to the recipient's job. The link with their profession is precisely what allows you to do without prior consent.
Ignoring an objection, or handling it on only one channel. And keeping data on prospects who never replied indefinitely.
Worth knowing: the CNIL states that generic company addresses such as contact@ or info@ concern legal entities and are not subject to these principles. That is not an open door: a message to a generic address is still a communication from your company and will be judged as such.
How do you prospect on LinkedIn within these rules?
The CNIL's prospecting pages set no rule specific to LinkedIn messages, but the principles stay the same: write to a professional, about a topic related to their job, with your identity visible, and respect their refusal. LinkedIn adds its own terms of use, which your prospecting must also follow.
In MimikFlow, a clear refusal stops the sequence for that prospect: no more follow-ups or automated messages, on any channel. Do-not-contact lists by company, name or profile block any automated contact with the people concerned, including mid-conversation. Messages rely on verifiable professional information and never invent contact details.
What does it look like in practice?
Example
Example: a respectful sequence, step by step
An illustration. An agency contacts marketing directors at small companies to offer an audit of their acquisition: the topic relates directly to their job. Every message comes from an identifiable account and points back to the agency. On the second message, a prospect replies: 'Thanks, not interested, please do not contact me again.' Their name goes onto the list of people not to contact, their sequence stops on every channel, and no colleague at the agency writes to them the following month. Data on prospects who never engaged is deleted after three years.
Still have a question about GDPR and B2B prospecting?
- Do you need a professional's consent to prospect them?
- According to the CNIL, not for prospecting professionals by email, text message or automated call: it can rest on legitimate interest if the message relates to their job. The person must, however, have been informed and be able to object simply and free of charge.
- Is a named work email personal data?
- Yes. An address like firstname.lastname@company.com identifies a person. The CNIL states that only generic addresses, such as contact@ or info@, fall outside the principles it sets out for prospecting.
- How long can you keep a prospect who never replies?
- The CNIL gives three years from collection or from the last contact initiated by the prospect, in a framework it describes as non-binding. Beyond that, without explicit agreement, the data should be deleted or archived.
- Does this page replace legal advice?
- No. It summarizes the rules the CNIL publishes on commercial prospecting in France. For your situation, especially if you prospect in other countries, consult a legal professional.
Which terms should you read next?
- Data enrichmentData enrichment means completing a prospect record with the information it lacks: work email, phone number, company size, industry, exact role, recent news.
- Cold emailA cold email is a prospecting email sent to someone who has never been in touch with you and never asked to hear from you.
- Outbound prospectingOutbound prospecting means going after customers instead of waiting for them to come: you choose the companies and people to contact, then approach them by phone, email or LinkedIn message.
- Sales automationSales automation means handing the repetitive tasks of selling to software: finding prospects, sending messages and follow-ups, updating the CRM, scheduling meetings, sending reminders.
- CRMA CRM, short for customer relationship management, is software that centralizes information about your prospects and customers: contact details, conversations, open deals, next actions.
- B2B prospectingB2B prospecting covers everything you do to find companies likely to buy your offer, reach the right person and get a first sales conversation.
Where can you go further?
Want MimikFlow to handle it?
MimikFlow finds your prospects, writes the first message, follows up and replies until the meeting is booked, within your LinkedIn account's limits.