A few clicks can turn a name and company into a detailed sales contact, complete with job title, email address, and telephone number. Enrichment tools make this easy, but companies still need to check whether they may lawfully collect and use the information.
Getting this wrong can mean reputational damage, fines and the loss of valuable databases. For example, contact data provider KASPR received a €240,000 fine in 2024. In March 2026, the French data protection authority, the CNIL, confirmed that the company had taken corrective measures, including deleting its database and stopping data collection from LinkedIn. The closure ended the compliance order. The CNIL also decided not to collect the daily penalty.
What should companies check before connecting an enrichment tool?
Public Information Still Needs a Legal Basis
Professional contact details remain personal data, even when published online. Collecting and adding them to a CRM therefore requires a legal basis.
Legitimate interests under Article 6 para. 1 lit. f GDPR may be available. In Koninklijke Nederlandse Lawn Tennisbond, Case C-621/22, the Court of Justice confirmed that commercial interests can qualify. Companies must still demonstrate that the interest is lawful, that the processing is strictly necessary, and that individuals’ interests and fundamental rights do not override it.
For enrichment, the practical questions are straightforward: Why do you need these particular details? Could you achieve the objective with less data? Would the person reasonably expect this use? A business email published for professional inquiries presents a different situation from a private number shared only with selected connections. Document this assessment before activating the tool.
Check Where the Information Comes From
Before accepting a supplier’s claim that information is “publicly available,” check the sources, whether access restrictions were respected, and what supports its lawful collection and disclosure.
The KASPR case illustrates why this matters. KASPR supplied professional contact details for sales prospecting using information collected from LinkedIn. The CNIL found that the company had collected contact details despite users having restricted their visibility, retained data for excessive periods, and failed to provide adequate information to individuals.
Contact details were retained for five years from each update, while people asking where their data came from received only a generic reference to publicly accessible sources. The case highlights the need to examine how a supplier collects and manages information throughout its lifecycle.
Buying Data Does Not Transfer Responsibility
A company deciding to enrich its CRM for its own sales purposes will generally be a controller for that processing. The provider’s role depends on its actual activities.
A provider building and commercializing its own database may be an independent controller. A service processing information solely on the customer’s documented instructions may be a processor. Different operations within one service can involve different roles. An Article 28 data processing agreement should therefore follow the role assessment.
SOLOCAL MARKETING SERVICES provides a related lesson about supplier verification. The company obtained prospect data from brokers and used it to conduct marketing campaigns for its customers. In May 2025, the CNIL fined it €900,000 for infringements involving prospecting and consent. The collection forms examined did not obtain valid consent, and the company’s contractual requirements and checks were insufficient. The case shows why companies must verify that consent obtained by a supplier actually covers the marketing activities they intend to carry out.
In September 2026, the CNIL accepted corrective measures introduced by SOLOCAL, including automated checks of collection forms supplemented by human assessment. The authority also stressed that SOLOCAL remained responsible for the validity of consent collected on its behalf, and that it could still be held liable for defective forms that escaped its controls.
Tell People How Their Data Reached Your CRM
Where personal data comes from a provider or online source, Article 14 GDPR generally requires the company receiving it to provide information about its processing. This includes the purposes, legal basis, categories of data, source, recipients, retention arrangements, and individual rights.
The information must be provided within a reasonable period, normally no later than one month after obtaining the data. Earlier communication with the person or disclosure to another recipient can bring the deadline forward. A company should not postpone transparency indefinitely because a contact has not yet entered a campaign.
Article 14 contains exceptions, but relying on them requires a specific justification. A large database does not automatically establish disproportionate effort. Placing a notice on a website does not ordinarily replace providing the required information to the individuals concerned.
Source information also matters when someone exercises their access rights under Article 15. Keeping a record of where information originated helps the company answer those requests and investigate incorrect matches.
Make Minimization, Deletion, and Objections Work in Practice
Enrichment should be limited to information needed for the defined purpose. An available field is not inevitably a necessary field. Private contact details and unrelated personal information require particular scrutiny.
Companies also need processes to correct inaccurate matches, identify outdated records, and delete information when it is no longer needed. These controls give practical effect to the GDPR’s data minimization, accuracy, and storage limitation principles.
Under Article 21 para. 2 and 3, a person can object to processing for direct marketing, including related profiling. That processing must then stop. Suppression controls should prevent the next enrichment cycle from adding the same person back into the marketing database.
Finally, lawful enrichment does not automatically authorize outreach. National rules implementing the ePrivacy framework impose additional requirements for particular marketing channels. Legitimate interests for collecting contact data cannot replace consent where the applicable outreach rules require it.
Before connecting an enrichment tool, companies should be able to explain which data they need, where it comes from, why they may process it, and how individuals can exercise their rights. Those answers should be reflected in the supplier arrangements and the CRM workflow.
If your organization is considering a data enrichment service, FIRST PRIVACY can help assess the proposed processing and translate these requirements into practical controls.
No comments