GDPR Compliance for Data Enrichment: A Practical Guide

GDPR does not make one legal basis automatic for every enrichment workflow. For each use, document the purpose, data categories, source, recipients, retention, and applicable Article 6 basis. If the controller relies on legitimate interests, retain the balancing assessment and separately evaluate direct-marketing and ePrivacy rules. Special-category data requires an additional Article 9 condition.

This guide covers the whole decision: which legal basis fits which situation, how a consent-based enrichment workflow works when you do need one, what to demand from vendors, and the data subject rights that come with enriched records.

Our data

This guide supplies a six-field provenance example and an eight-record suppression test with explicit expected results. Both use fictional inputs. They are operational test cases, not evidence that a specific enrichment activity is lawful. These examples were prepared with AI assistance and checked against the cited primary legal text and regulator guidance.

Understanding the GDPR Framework

Article 5 sets out six processing principles and a separate accountability duty for the controller. GDPR Article 5 (adopted EU text).

1. Lawfulness, fairness, and transparency: processing must meet all three requirements. Article 5.
2. Purpose limitation: collect data for specified, explicit, legitimate purposes and assess later uses against the rule on incompatible processing. Article 5.
3. Data minimization: limit personal data to what is necessary for the purpose. Article 5.
4. Accuracy: take reasonable steps to correct or erase inaccurate personal data without delay, having regard to the purpose. Article 5.
5. Storage limitation: keep identifiable data no longer than necessary, subject to the specified exceptions and safeguards. Article 5.
6. Integrity and confidentiality: apply appropriate measures against unlawful processing and accidental loss or damage. Article 5.

For an enrichment job, translate those principles into a written purpose, an allowed-field list, a source record, a correction path, and a retention decision. Compare the proposed output with the original record before accepting it. Appending an incorrect employer or person match can make the dataset worse.

Legal Bases for Data Enrichment

Article 6 provides six lawful bases; a commercial label such as B2B does not itself appear among them. GDPR Article 6 (adopted EU text).

Legitimate interests requires necessary processing for the controller’s or a third party’s interests, except where the individual’s interests or fundamental rights and freedoms override them. Article 6(1)(f).

Consent must be freely given, specific, informed, and unambiguous, and the controller must be able to demonstrate it. Article 4(11); Article 7(1).

The contract basis concerns processing necessary for a contract with the person, or steps requested by that person before entering the contract. Article 6(1)(b).

Special-category processing also needs an applicable Article 9 condition; explicit consent is one listed condition, not the only one. GDPR Article 9 (adopted EU text).

Write down the specific processing operation before choosing a basis. “Update a customer’s current business role” and “append private contact channels for a new marketing campaign” describe different purposes and effects. Record the proposed basis, supporting analysis, decision owner, and review trigger for each workflow. A vendor’s choice for its own collection does not answer the customer’s separate use question.

The Legitimate Interest Assessment

Use this worksheet when legitimate interests is being considered. It organizes the review; completing boxes does not predetermine its outcome.

1. Purpose. State the concrete interest and who benefits. Replace “improve sales” with the exact intended use of each field.
2. Necessity. Explain why the processing is needed and compare less intrusive alternatives, including using fewer fields or asking the contact directly.
3. Balance. Describe the relationship with the person, reasonable expectations, possible effects, and safeguards. Record why those facts support or defeat the proposed use.
4. Scope. List sources, fields, recipients, retention, objection handling, and excluded records.
5. Decision. Keep the reviewer, date, rationale, and conditions. Revisit the assessment when purpose, source, scale, or recipients change.

The legal test remains the interests, necessity, and overriding-rights rule in Article 6(1)(f); the EDPB lawful-processing guide explains the bases for operational readers.

How Do You Enrich Contact Data With Consent?

Where consent is the basis, the person can withdraw it at any time, and withdrawal must be as easy as giving it. Article 7(3).

Use this four-step implementation plan after the consent approach has been reviewed for the actual workflow:

1. Describe the activity. Put the purpose and field categories in plain language at collection. Show the complete notice and keep the exact version displayed; do not treat a sample sentence from this guide as approved consent wording.
2. Capture proof. Store the internal person ID, timestamp, collection interface, affirmative action, wording version, and covered purpose. Test that the evidence can be retrieved without reconstructing a form from memory.
3. Constrain the job. Match requested output fields to the approved scope. If the configured job requests an additional field, hold that field for review rather than silently appending it.
4. Propagate withdrawal. Update the workflow’s permission state before the next run, cancel queued work for the affected purpose, and test downstream reimports. Keep a restricted record of the decision needed to prevent an accidental restart.

Withdrawal does not invalidate processing performed while the consent was valid. Article 7(3).

B2B and B2C: Review the Actual Record

GDPR defines personal data by its relationship to an identified or identifiable person; a business context does not create a general exclusion. Article 4(1).

These examples are review prompts, not legal classifications. Avoid automatic rules that map “business” to legitimate interests or “consumer” to consent. Keep channel-specific marketing review separate from the decision to collect or enrich the underlying record.

Vendor Due Diligence and the Data Processing Agreement

Whether the supplier acts as controller or processor depends on the facts of the processing, and a controller engaging a processor needs the binding arrangement and terms required by Article 28. DPC controller and processor guidance.

Ask the vendor to explain what it receives, obtains independently, derives, retains, shares, and deletes. Request an example of field-level provenance, a current subprocessor list, processing locations, incident contacts, and the rights-request procedure. Ask for the scope and date of any security assessment instead of treating a certification logo as proof about this service.

For a controller-processor arrangement, the contract must specify the subject matter, duration, nature, purpose, data types, data-subject categories, and controller rights and obligations. Article 28(3).

Article 28 also addresses instructions, confidentiality, security, subprocessors, assistance with rights and security duties, deletion or return, and audit information. GDPR Article 28 (adopted EU text).

Turn that into an evidence checklist: signed terms, completed processing description, authorized subprocessor list, technical controls, deletion or return procedure, and a route for testing responses. For an independently acting controller, obtain a role-specific assessment rather than relabeling it a processor to fit a standard template.

Pause procurement if the vendor cannot identify the source of a field, cannot explain its role, or cannot show how a blocked record avoids reappearing. Public availability, a US office, or a security certification alone does not answer the workflow’s lawful-basis and transfer questions.

Transparency: Information and Timing

When personal data is obtained from another source, Article 14 specifies information about the controller, purposes, basis, data categories, recipients, transfers, retention, rights, and source, with additional items where applicable. Article 14(1)–(2).

Its timing rule is a reasonable period within one month, with information due no later than first communication or first disclosure where those occur sooner. Article 14(3).

Article 14(5) lists exceptions, including where the person already has the information, subject to the conditions of the relevant exception. Article 14(5).

Maintain a notice register with acquisition date, planned first contact, planned disclosure, notice version, delivery method, and any documented exception. Check the earliest applicable event before a job releases records to sales. Do not assume placing a generic privacy-policy link in a footer resolves the information, timing, or delivery question.

Review the notice against the actual workflow. If a new supplier adds a new source category, or a job begins exporting to another recipient, send that change to the notice owner. Keep the version and decision with the run so the operations team can later show what information was in use.

Handling Data Subject Rights

Article 15 provides access to personal data and associated information, including available source information where the data did not come from the person. GDPR Article 15 (adopted EU text).

Article 12 generally requires action on rights requests without undue delay and within one month, with a possible two-month extension where necessary because of complexity or number of requests and notice of the extension within the first month. Article 12(3).

Erasure depends on the Article 17 grounds and exceptions; it is not an unconditional instruction to delete every record or a general permission to retain it for commercial interests. GDPR Article 17 (adopted EU text).

For direct-marketing objections, the data must no longer be processed for that purpose, including related profiling. Article 21(2)–(3).

For certain other objections under Article 21(1), continued processing requires the specified compelling grounds or legal-claims basis. Article 21(1).

A field-level provenance record

In this fictional record, a person’s company role was researched for a defined account-maintenance purpose. The example illustrates traceability only; it supplies no legal approval for the processing.

Use the person and account keys to locate CRM values, enrichment logs, exported files, and vendor jobs. Keep the source of an enriched field distinct from a value supplied directly by the person. Route a correction to the affected fields and systems, and retain the resolution so a stale export cannot overwrite it.

Test suppression before the next import

Recommended fixture: create 8 synthetic records, mark 2 as blocked for the tested purpose, and queue all 8 for enrichment. The expected permitted submission count is 8 − 2 = 6. After a mock result arrives, block one more record before import; the expected import count is 6 − 1 = 5. This checks both the outbound job and the later write-back.

Repeat the test with an alternate email, merged duplicate, retry, and older CSV. Verify that a blocked record stays blocked in the CRM and downstream campaign tool. Have the privacy owner define the minimal suppression data, access, and retention needed for this control. Treat the fixture as a software test, not proof of full legal compliance.

International Data Transfers

Chapter V applies its transfer conditions in addition to the rest of GDPR. GDPR Article 44 (adopted EU text).

The framework includes adequacy decisions under Article 45, appropriate safeguards under Article 46, and limited derogations under Article 49. GDPR Article 45 (adopted EU text); GDPR Article 46 (adopted EU text); GDPR Article 49 (adopted EU text).

Binding corporate rules are subject to supervisory-authority approval under Article 47. GDPR Article 47 (adopted EU text).

Map the contracting entity, hosting, support access, subprocessors, and onward recipients. For each proposed transfer, retain the recipient, countries, data, purpose, mechanism, supporting documents, review date, and next review trigger. Check the exact legal entity and covered activity before relying on a framework listing.

Use the European Commission’s current adequacy decisions and the applicable decision text for scope. If the proposed route uses contractual safeguards, send the completed terms and transfer assessment to the accountable reviewer. “Provider based in the US” and “contract signed” are not sufficient entries in the transfer register.

Practical Implementation and Incident Handling

Before launch, assign an owner to the purpose and field list, basis assessment, notice route, vendor-role decision, retention rule, transfer review, and request-handling process. Use synthetic records to test allowed fields, blocked records, failed matches, notice tracking, and deletion or correction propagation. Save the run ID, input and output counts, exceptions, and release decision.

During operation, compare a reviewed batch with its sources, inspect unresolved matches, and reconcile submitted, returned, rejected, and imported records. Investigate unexpected fields or recipients before the next run. A new source, new purpose, or supplier change should trigger review of the affected decisions.

A processor must notify the controller without undue delay after becoming aware of a personal data breach. Article 33(2).

The controller’s notification to the authority is due without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to risk people’s rights and freedoms. Article 33(1).

For incident preparation, record the discovery time, affected jobs and fields, known recipients, containment actions, responsible contact, and open questions. Route the facts promptly to the incident owner; do not wait for a complete root-cause investigation before assessing notification duties.

Article 30 describes records of processing and a conditional exemption for organizations with fewer than 250 employees. GDPR Article 30 (adopted EU text).

Use the workflow inventory as the operational starting point for that assessment. Keep purposes, fields, recipients, transfers, retention, security controls, and decisions together. End a periodic review with named actions and owners, including unresolved source or recipient questions that prevent another run.