This is an informational piece, not legal advice. It describes how the rules are built and where the mistakes usually happen. Your specific case — your sources, your sector, your method of contact — needs a lawyer. Written against EU law and Polish national rules as of August 2026; national implementations differ, so check your own jurisdiction.
“Am I allowed to collect these numbers?” comes up in every conversation about lead generation. The answer is: it depends on three things, and they have to be settled separately — whether this is personal data at all, what your lawful basis is, and whether you have sent the notice you owe.
The GDPR does not forbid building a list of companies. It requires you to be able to say why you hold it and where it came from — and to say that to the people it concerns, too.
Step 1: is this personal data at all
This is the first question and the one most often skipped. Data about a company as an entity — registered name, tax number, registered address, the main switchboard line — is not personal data, because it does not relate to a natural person. Two situations change that.
- Sole traders. The details of someone trading in their own name are simultaneously the details of a natural person: name, often an address and a personal mobile. The GDPR applies directly.
- People inside a company. An employee’s name, their work address in the form first.last@company.com and their direct line are personal data even though they are work details. “Work” does not mean “outside the GDPR”.
In practice a calling list almost always holds both. The safe working assumption is to treat the database as if it contains personal data, and look for exceptions afterwards.
Step 2: the lawful basis, or what you hold the data for
Processing needs a basis from Article 6(1). In B2B outreach, two are realistically in play.
- Consent, under (a) — freely given, specific and withdrawable. In cold outreach you do not have it by definition, because you never had the chance to ask.
- Legitimate interests of the controller, under (f) — and this is what direct marketing actually stands on. Recital 47 names direct marketing as an example of such an interest.
Article 6(1)(f) is not a door left open, though. It demands a balancing test: your interest has to outweigh the rights and freedoms of the person concerned. The test has to be carried out and documented before processing starts, not after the first complaint arrives.
- Does the offer relate to what this company does? Outreach aimed at a matching sector defends itself far better than a blast to everyone.
- Could the person reasonably have expected this contact? A number a business publishes as its sales line is a different case from a personal mobile dug out of a classified ad.
- Is the data minimal? To make a call you need a company name and a number. You do not need the owner’s date of birth.
Step 3: the Article 14 notice
This is where the gap usually appears — and it is the first thing a supervisory authority asks about once a complaint lands.
Collect data directly from a person and Article 13 applies. Collect it from somewhere else — a register, a map, a website — and Article 14 applies, requiring you to inform that person about the processing. The deadline: at the first contact at the latest, and in any case within a month of obtaining the data.
- Who the controller is and how to reach them.
- The purpose and the lawful basis — under (f) you have to say what the legitimate interest actually is.
- Where the data came from, and whether the source was publicly accessible.
- What rights the person has, including the right to object to direct marketing — unconditional and effective immediately.
- How long you intend to keep the data.
In practice on a phone call this means a short verbal version during the conversation and the full notice by email afterwards. Write that script with a lawyer once, rather than leaving each rep to improvise their own.
A phone call is not only a GDPR question
A common mistake is stopping at the GDPR. Telephone marketing is also governed by electronic communications rules — in Poland, the Electronic Communications Law, which requires the recipient’s consent for direct marketing using terminal equipment. That is a separate layer from the lawful basis for the data and has to be settled on its own.
Put plainly: having a basis to process the number does not yet answer whether you may ring it with an offer. Two different rules, two different answers. This is the point above all others where your own contact model is worth checking with a lawyer, and where national implementations diverge most.
Data from public registers — what being public changes
Business registers are public, and companies publish their own map listings. A public source makes two things easier: showing that the person could have expected commercial contact, and naming the source in your notice.
What being public does not do: it does not remove the notice obligation and it does not substitute for a lawful basis. A public register exists for its own purpose, and supplying leads is not it. Data being reachable does not mean it may be used for any purpose you like.
A checklist before the first call
- You know which source every record came from, and you can point to it.
- You have carried out and recorded the balancing test for legitimate interests.
- You have a privacy notice drafted, and you have decided when and how it reaches the recipient.
- You have a working objection mechanism — and a real procedure that takes the number out of the queue the same day.
- You have set a retention period and a way of deleting records once it expires.
- You have checked your telephone contact model against electronic communications rules with a lawyer.
Six items, five of which are done once rather than per campaign. That is the whole difference between a database you can defend and one nobody dares to use.