GDPR and CCPA Compliance Rules for B2B Contact Data Storage

B2B contact data storage falls within GDPR and CCPA, and compliance depends on how records are handled. Both sets of rules have requirements for lawful processing, retention, opt-outs and individual rights. A defensible operation turns those obligations into documented decisions and working processes that follow each contact record across its entire lifecycle.

Why B2B contact data is fully inside GDPR and CCPA scope

GDPR’s Article 4 definition of personal data covers information about an identifiable natural person. A name-format email address at a company domain identifies someone even when it is used only for work.

The B2B label provides no general exemption under CCPA either. An independent contractor or sole proprietor can still count as a consumer, and inferences drawn from personal information can themselves constitute personal information, even when the underlying information is public. GDPR requires a documented lawful basis before processing, while CCPA uses an opt-out model, creating parallel obligations that global teams cannot treat as interchangeable.

How GDPR's legitimate interest basis actually works for B2B storage

Legitimate interest can support B2B contact storage, and direct marketing can qualify as a legitimate purpose in principle. That basis requires a three-part test, and a broad claim that prospecting helps the business is not enough to pass it. The purpose test identifies a real, articulable business interest. The necessity test asks whether processing the chosen data is a reasonable way to pursue that interest or whether less data would suffice. The balancing test considers the person’s reasonable expectations, their professional role and the relevance of the offer.

A Legitimate Interest Assessment, or LIA, records that reasoning and gives the controller evidence for its decision. The assessment protects the business by making its justification available for scrutiny. A workable LIA records the purpose, data categories, source and its lawful basis, necessity argument, balancing analysis, safeguards and review date. Typically, two pages per campaign type can capture the analysis more usefully than one boilerplate document for the company.

Purpose limitation restricts use to the specific purpose stated at collection, while data minimization rules out retaining phone numbers or personal details when only a work email is needed. Retention must also depend on whether the purpose still holds, so an unused contact cannot be kept forever just because it might be an asset. Several months without engagement can provide a practical purge point for cold contacts, but that practice is not a universal statutory deadline.

The safeguards that make a legitimate interest argument defensible in practice

The balancing argument must be reflected in the way outreach actually runs. Contacting people at corporate domains, in their professional capacity and about their responsibilities connects the offer to a reasonable expectation. The first message should clearly identify the sender and company. A genuine, one-click opt-out must then provide an effective exit and be honoured within days. Outreach frequency also needs a cap, because persistence that becomes harassment undermines the original balancing argument.

Recording the source at collection allows the team to explain where the data came from if asked. Transparently collected public professional data presents lower sourcing risk, while first-party data offers a strong position when the consent record is held directly. For licensed or partner data, the business needs proof of lawful basis and pass-through rights, while scraped social profiles pose high risk and bought lists from unknown sources have no provenance it can defend.

Public availability can reduce a person’s expectation of privacy, while rights to collect, store or reuse their details remain limited. GDPR obligations still attach to scraped public data. A source that can be named and examined therefore supports the assessment, but the assessment must still justify the buyer’s particular use.

What CCPA and CPRA now require for B2B prospect databases

CCPA requires controls that make its opt-out model work, though it does not require a GDPR-style lawful basis before contact. Businesses fall within scope when they meet any one of the applicable thresholds concerning annual gross revenue, the annual volume of consumers’ or households’ personal information bought or sold, or the share of revenue derived from selling or sharing personal information. Once those conditions apply, prospect records cannot be treated as outside the privacy operation simply because their subjects have not become customers.

Notice at collection applies to prospect data, with disclosure at first contact typically serving that role for purchased records. Prospects also have rights to know, delete and correct their information. The right to opt out of sale or sharing reaches beyond transactions that look like conventional list sales, because passing records to an ad platform or sharing leads with a partner can qualify. Service provider contracts are also required with every vendor that touches the data.

CPRA adds data minimization and retention proportionality, requiring the minimum data for the minimum necessary time. This is not a fixed maximum retention period, but a requirement to disclose the retention logic, justify it and apply it consistently. One retention period for the whole business is hard to defend when different categories of data serve different purposes. Publicly available information is excluded from CCPA’s definition of personal information, but that exclusion must not be carried across to GDPR or assumed to cover inferences drawn from it.

How California's DROP platform changes the operational picture for data vendors and their buyers

California’s Delete Request and Opt-Out Platform, or DROP, requires those in the data supply chain to keep acting on deletion requests. The platform opened to consumers on January 1, 2026, so one request can reach every registered data broker at the same time. From August 1, 2026, brokers must retrieve and process requests. Brokers must check DROP on a rolling 45-day retrieval cycle and have 90 days to act on each request. That cadence makes a one-time database cleanup insufficient.

Buyers need a way for a vendor’s deletion request to reach records they have already received. Affected records need to be suppressed across the CRM, sequencing tools, data warehouse and exported spreadsheets as well as the primary database. Vendor due diligence therefore needs to establish whether the supplier is a registered California data broker and how DROP-propagated requests reach the buyer’s systems. The quality of that handoff becomes part of both compliance and CRM data hygiene.

What the GDPR's record-keeping and rights-request obligations look like in a working B2B operation

GDPR requires an organizational record of processing as well as a reason for processing. Records of Processing Activities, or ROPA, document what data is held, why it is held, how long it is retained and the legal basis used. Data Protection Officers are required for organizations meeting the relevant processing thresholds, and Data Protection Impact Assessments are required for high-risk activities. These obligations provide the formal structure, but the daily work lies in explaining processing and responding to people.

Privacy notices need to explain why prospect data is kept and how it is used. Even a cold contact who has never replied has rights of access, erasure, portability and objection. Access and erasure requests must be addressed within one month, which requires a response process rather than an improvised search when a request arrives. Suppression records are kept separately from active prospect records so a later purchase cannot cause a contact who has opted out to be re-imported.

Lawful storage does not, by itself, settle whether an email can be sent. Germany’s UWG, Austria’s TKG and the UK’s PECR can add prior-consent requirements to the GDPR analysis. Under PECR, the distinction between individual and corporate subscribers matters, because sole traders and some partnerships receive protections that do not apply in the same way to limited companies. PECR does not require consent for B2B email to corporate subscribers, so the recipient’s country and subscriber status must inform the outreach decision.

Where enforcement has landed and what the cases reveal about regulator priorities

The California Attorney General announced a substantial settlement with Disney in February 2026 over allegations that it failed to fully honour opt-out requests across devices and streaming services. An opt-out on one service did not suppress sharing from connected services. The case makes the operational standard visible. A control that works only at the surface where the request was received does not address the full processing environment.

California announced a significant settlement with General Motors in May 2026 over allegations that it sold driving and location data to brokers without adequate notice or consent. The California Attorney General described it as the first action enforcing the CCPA data minimization principle. The case placed purpose limitation and the amount of data processed within active enforcement, rather than treating them as general policy aspirations.

The Swedish IMY found in April 2025 that a company violated Article 6(1)(f) without demonstrating a legitimate interest or showing that an LIA had been carried out. The company had referred to recommendations from its Consent Management Platform provider, but IMY held that accountability remained with the controller and could not be delegated. Together, these cases point toward three practical priorities, namely connected opt-out controls, justified processing limits and evidence owned by the responsible business.

The compliance gaps that most B2B teams still carry into 2026

A useful diagnostic begins by comparing a policy promise with the path a record actually takes. If deletion stops at the CRM while copies remain in sequencing tools, warehouses or spreadsheets, the path is incomplete. If deletion also removes the only suppression record, the next vendor import can recreate the problem. These are distinct failures, because one leaves existing copies active while the other permits a contact to return.

The same diagnostic applies to procurement and retention. A vendor that cannot explain a record’s source leaves the buyer without a clear account of the exposure it has accepted. Using one retention period for all categories likewise leaves the business without a reason for how long it keeps data for each processing purpose. Neither gap is closed by a general privacy policy. The CPPA’s Automated Decision-Making Technology regulations took effect January 1, 2026, with ADMT-specific compliance required by January 1, 2027 for businesses already using ADMT for significant decisions, making AI-scored leads and intent-signal inference engines an additional area to assess for disclosure and opt-out requirements.

A practical compliance workflow that satisfies both regimes without paralysing outbound

The operational workflow is the same under both regimes, even though its legal foundations and response windows differ. Start before sending by auditing the data supply chain. Ask each vendor for GDPR lawful basis documentation, a Data Processing Agreement, evidence of how DROP and deletion requests propagate, and its data re-verification frequency.

Next, document the campaign-specific LIA so the intended use has a defined purpose, scope and review point. Then map every place a contact can exist, including the CRM, sequencing tools, warehouse, ad platform audiences and exported files. Establish a verified deletion workflow across that map before a request arrives. Keep suppression records separate so a contact removed from active use cannot be re-imported later.

Once those paths are in place, set retention periods for each category, write down the reasons for them and follow them each time. Make clear who is responsible for rights requests, regardless of which team receives the message. Honour opt-outs immediately, while distinguishing them from CCPA requests to know, correct and delete, which have a 45-day window. GDPR access and erasure requests must be addressed within one month.

Data tooling can reduce the effort needed to run this workflow, but it does not transfer the controller’s accountability. Platforms such as LeadsApp that publish their sourcing approach and provide DPAs make important due-diligence material easier to obtain. Compliance posture belongs in the vendor evaluation itself.