Prospecting transparency notices

A prospecting transparency notice should let a person trace their data to your message. Provenance is often difficult because people may not know when or how their data was collected.¹ Public availability still calls for fair and lawful use, along with a clear statement of what you intend to do with the information.² Build the notice in the order a rep can answer a direct question: source, data, purpose, basis, retention, responsible organization and contact. Keep those answers aligned across the notice, first message and follow-ups. The notice earns trust when the trail is inspectable and the wording stays usable.

Before writing

Use a source record when drafting, not a memory of how the list was built. Prepare a short answer for each field before deciding how much belongs in the notice.

Record who supplied the data, whether the person could reasonably see that source, what you plan to do with it and who handles questions. Keep the record near the notice so a rep can answer without making a new claim.

Use plain terms. Organizations must be open and honest about collection and lead generation.³

Build the notice in work order

Use this sequence so each sentence answers a question the recipient can reasonably ask. Keep the wording specific enough for a person to understand their position without an internal explanation.

1. Source. State where the personal data originated in the first communication, including whether it came from publicly accessible sources when applicable.⁴

2. Data. Name the categories you hold. Contact details and interests are examples of categories that should be clear.⁵ Avoid a broad label that leaves the recipient guessing which fields you use.

3. Purpose. Explain why you want to use the information, such as for marketing or profiling buying habits.⁶ Use the language of the outreach so the recipient can connect the notice to the message they received.

4. Basis. GDPR requires a lawful basis to process personal data, and an email address is personal data.⁷ For cold B2B outreach, assess consent and legitimate interest as the two relevant bases.⁸ State the basis plainly and keep it consistent with the purpose you described.

5. Handling. Explain how the data will be used, retained and destroyed.⁹ Give the recipient a clear retention statement that matches what the team does in practice.

6. Responsible organization and contact. Name the organization responsible for processing and give a monitored route for privacy questions. Information needs to be available for a controller to comply with GDPR.¹⁰ Keep the contact route beside the notice, where a rep can find it during a conversation.

Use this drafting order: "Your personal data came from [source]. We hold [categories]. We use it for [purpose]. Our basis is [basis]. We retain it according to [retention statement]. [Organization] handles privacy questions at [contact route]." Replace each bracket with the actual answer before the message goes out.

Put it in the outreach

Make the notice reachable from the first message and easy to read while the prospect decides whether to continue. The first contact should answer the immediate privacy question without sending the person through an internal handoff.

Your disclaimer should tell the prospect that you process their personal data.¹¹ It should also explain why you process it.¹² Keep those lines close to the message that prompted the question, with the fuller notice available from the same place.

Apply the same discipline to follow-ups. Each follow-up should specify what personal information you use, why you use it and how you store it.¹³ If the purpose or data changes, revise the wording before sending the next message.

A compact first-message structure can read: "I am contacting you because [purpose]. I process [categories] from [source] under [basis]. The retention approach is [retention statement]. Privacy questions go to [contact route]." It is short enough for a rep to use and complete enough to expose the decisions behind the outreach.

Keep the notice current

Treat the notice as part of the operating process. Review it when the source, purpose, recipients, retention approach or contact route changes.

Update privacy notices so they clearly describe lead generation and data sale practices when those activities apply.¹⁴ If you rely on legitimate interests and make an international transfer, inform the data subject about both the legitimate interest and the transfer.¹⁵ Keep those details in the same notice instead of leaving the rep to explain them from memory.

What not to do

These failures often enter through handoffs and vague wording. Put them on the review checklist before a new list or use case reaches a rep.

• Do not hide profiling of interests or habits. Obtaining information from other sources or profiling must be fair and disclosed.¹⁶
• Do not treat a list received from another organization as a complete notice. Provide your own privacy information for anything people were not already told.¹⁷
• Do not let a resale or transfer disappear from the notice. People often do not know which entities hold their information after those events.¹⁸
• Do not omit data sale practices from the privacy notice when they apply.¹⁹