Start with the data path before you write a cold message. Record what you hold, where it came from, why you use it, and who can answer for the processing. When you use publicly available information, tell the person that you have it and what you intend to do with it. Keep the activity fair and lawful.1 Put the notice close to the first outreach so the prospect can understand the context without reconstructing it.
Before you write
Gather the facts your notice will need from your own records. You should be able to answer these questions without asking a prospect to fill in the gaps:
- What personal data do we hold about this prospect?
- Where did each category come from?
- Why are we using it for this outreach?
- Which lawful basis are we relying on?
- Which organization is responsible, and how can the prospect reach it?
- Has the data come through a list, a reseller, or another organization?
- Does the activity include profiling, lead generation, resale, or an international transfer?
If you obtained the information indirectly, identify the categories you hold, such as contact details or interests.2 The first communication should state the source of the personal data and whether it came from a publicly accessible source.3
When you acquire a list, check what the people on it were already told and prepare your own notice for anything missing.4 Reconcile that information with your actual use, since a supplier may describe collection in general terms while your team uses the data for a specific outreach purpose.
Choose the purpose and basis
Decide why you are using the data and which basis supports that use. Write both decisions down before anyone turns them into copy.
For cold B2B outreach, consent and legitimate interest are the two relevant lawful bases.5 Legitimate interest applies when the interests being pursued are not overridden by the prospect's interests or fundamental rights and freedoms.6
State the purpose in ordinary language. Explain why you want to use the information, such as for marketing or to profile buying habits.7 Do not use a purpose line that says only "business communications" when the activity is prospecting.
If legitimate interest is your basis and the processing includes an international transfer, tell the prospect about both the legitimate interest and the transfer.8 For several uses, record each purpose before drafting the notice so it matches what the outreach team will do.
Write the notice
Show the notice during the first interaction. A short explanation in the message can cover the essential facts, with the full notice available through the contact route you provide.
The notice should:
- Name the organization responsible for the processing and give the prospect a working way to contact it.
- Say that you process the prospect's personal data.9
- Explain why you process it.10
- State where the data came from, including whether the source was publicly accessible.3
- Describe the categories of data held, such as contact details or interests.2
- Explain how the data will be used, retained, and destroyed.11
- Disclose data sale practices through a privacy notice when they form part of the activity.12 Update privacy notices so they describe lead generation and data sale practices clearly.13
- State the legitimate interest and international transfer when both apply.8
When a form or message asks for consent, include a privacy statement with the consent request.14 The statement should give the reason the information is being collected.15 Keep this separate from the decision to use legitimate interest. The notice should describe the basis you chose, while the consent request should describe the collection reason.
Make the data path clear. "We received your details from a business database" leaves important questions open. State the category you hold, where it came from, why you are using it, and how the prospect can contact the responsible organization.
Keep delivery consistent
Use the same explanation throughout the outreach process. Make the notice part of the sequence, check it when the data source or purpose changes, and give the team a fixed place to find the current wording.
Each follow-up message should clearly specify what personal information is being used, why it is being used, and how it is being stored.16 If a prospect asks where the data came from, be ready to identify the source. Publicly available information may be used for an invitation, but the organization still needs a legal processing ground and must tell participants where it found their data if they ask.17
Recheck the notice when you add a new list, change the outreach purpose, introduce profiling, or begin sharing data with another party. These changes alter the data path the prospect needs to understand. Keep the contact route live so questions reach the organization responsible instead of disappearing into the sales queue.
What not to do
These shortcuts can leave the notice incomplete or make the use of the prospect's data unclear.
- Do not collect information from another source or profile interests and habits without checking that the activity is fair and telling people about it.18
- Be open and honest about collection and lead generation.19
- Do not treat a list supplier's explanation as a substitute for your own privacy information after you obtain the list.4
- Do not make a consent request without the privacy statement and collection reason that go with it.14
- Do not leave a prospect to guess which entities hold their information after personal data has been resold or transferred to third parties.20
Before the next sequence starts, run one record through the checklist from source to purpose, basis, notice, and contact route. Compare the wording in the first message and every follow-up with that record, and fix any gap before outreach continues.