GDPR and Buying Signals: How to Brief Your DPO

Most buying-signal projects in Europe don't die in the pilot. They die in the meeting with the data protection officer.

The pattern is always similar. The marketer shows a slide with "buying signals" on it. The DPO hears "tracking people". From there, the conversation is about risk, not about what the setup actually does.

It goes differently when you don't pitch the tool. Bring a list of every data field you'd process, where it comes from, why you need it and when you'll delete it. Then the DPO can assess something concrete.

That's the idea behind this article. Most buying-signal setups are less risky than DPOs fear and more risky than marketers think. The work is in separating the two and documenting it properly.

One more thing up front. Across the EU, GDPR is the shared baseline. The UK, Switzerland and parts of the Middle East and Africa have their own versions that look similar. Where markets really differ is the second question: are you allowed to contact this person, on this channel, without consent? That's decided by national marketing and ePrivacy laws, and they vary a lot. Germany and Austria sit at the strict end of EMEA. If your setup works there, it will work almost anywhere.

Not legal advice. I'm a technical marketer, not a lawyer. Everything below is how I'd prepare a conversation with a DPO, based on the legal texts, regulator guidance and published enforcement. Your setup, your countries and your vendors change the answer. Rules change too, so check the current state before you rely on anything here. Bring your DPO and, for anything person-level at scale or in a new country, a local lawyer.

The one distinction that does most of the work

GDPR protects natural persons. Recital 14 says it plainly: the regulation does not cover data about legal persons, including a company's name, legal form and its contact details [1].

So the first question for every signal is not "is this intent data?". It's "does this record relate to an identifiable human?"

That splits buying signals into two groups:

• Account-level signals. Facts about a company or a domain. "Acme GmbH is hiring three RevOps people." "Acme's domain shows rising research on CRM migration." "Acme raised a Series B."
• Person-level signals. Facts about a named or identifiable person. "Julia Weber, Head of Sales at Acme, changed jobs last month." "Someone at this email address opened the pricing page twice."

The first group mostly sits outside GDPR. The second group sits fully inside it. Most DPO conversations go wrong because both get thrown into one bucket called "signals".

Account-level signals

Most small B2B teams should start here anyway. These signals are cheaper, easier to explain, and they answer the first outbound question: which companies deserve our time.

Typical sources:

• Firmographics (industry, size, location, legal form)
• Technographics (which tools a company runs, detected from public website code)
• Funding rounds, M&A, leadership announcements, company news
• Hiring signals from public job posts
• Third-party topic intent at company level, the co-op model where publisher networks aggregate content consumption per domain (Bombora is the commonly cited example)
• Reverse-IP identification that maps website traffic to a company, not a person (Leadfeeder, formerly Dealfront, sits in this category)
• Category research on review platforms, reported per company (G2-style buyer intent)

As long as the output is "company X shows signal Y", you are processing data about a legal person. That's outside GDPR's scope per Recital 14 [1]. Your DPO will still want to see it documented, but there's usually no legal basis question to answer.

Not every law in EMEA draws the line in the same place. South Africa's POPIA also protects juristic persons, so company data is in scope there [2]. Switzerland went the other way: the revised FADP dropped legal persons in September 2023 [3].

Where account-level quietly becomes personal

This is the part to bring up yourself, before the DPO does. It builds trust fast.

1. Sole traders and very small companies. An Einzelunternehmer, a French auto-entrepreneur or a UK sole trader is a natural person. Data about "Müller Elektrotechnik e.K." is data about Mr. Müller. Same for a two-person consultancy where the domain is basically the founder's name. The Polish regulator UODO fined Bisnode (now Dun & Bradstreet) just over PLN 943,000 for processing register data on sole proprietors without informing them under Art. 14. The Supreme Administrative Court upheld the obligation in September 2023 [4]. If your ICP includes freelancers, tradespeople or tiny agencies, treat those records as personal data.

2. IP addresses. In Breyer (C-582/14, 2016), the CJEU held that a dynamic IP address can be personal data for a website operator that has legal means to identify the person behind it [5]. Reverse-IP tools that resolve traffic to a company still process IP addresses on the way. The output may be company-level. The input often isn't. Ask the vendor what happens to the raw IP, how long it's kept, and what the lookup does with residential or home-office IPs.

3. Cookies, pixels and scripts. This one surprises marketers. The EU ePrivacy Directive requires consent for storing or reading information on a user's device unless it's strictly necessary, and each member state implements it in its own law. In Germany that's §25 TDDDG [6]. It applies whether or not the data is personal. A visitor-identification script that sets a cookie or reads device information needs to sit behind your consent banner. "It's only company-level" doesn't change that.

The same logic now reaches your emails. In April 2026 the French CNIL published a recommendation on tracking pixels in emails. Measuring open rates to optimise campaigns needs consent under that recommendation [7]. If your stack treats "opened the email three times" as a buying signal, check how that works in France before you rely on it.

4. Joining company signals with named contacts. The moment you attach "Acme shows intent for CRM migration" to Julia Weber's CRM record, you are processing personal data about Julia. Her inferred interest is now part of her profile. This is where most stacks cross the line without anyone deciding to.

5. Small-company intent at person-level granularity. Company-level intent for a 20,000-person enterprise says little about any one employee. The same signal for a five-person firm can point at a specific person. Some vendors set minimum thresholds before reporting a company. Ask about it.

Person-level signals

This is where the real GDPR work starts. Typical sources:

• Named contacts with business email and phone from enrichment providers (Cognism, Apollo and similar databases)
• LinkedIn profile data, from manual research or scraped by a tool
• Job change and champion tracking
• Person-level website de-anonymisation (matching a visit to an individual)
• Waterfall enrichment across multiple providers, the Clay-style setup

None of this is forbidden. It needs a legal basis, transparency, minimisation, a retention rule and a working opt-out. Here's the order your DPO will go through them.

Legal basis: legitimate interest plus a documented balancing test

For B2B prospecting without consent, the realistic basis is Art. 6(1)(f), legitimate interest [8]. Recital 47 says direct marketing may be regarded as a legitimate interest [9].

"May be" is doing a lot of work there. Legitimate interest has three parts:

1. A legitimate interest exists. In KNLTB (C-621/22, October 2024), the CJEU confirmed that a purely commercial interest can qualify, as long as it isn't unlawful [10].
2. The processing is necessary. The court read this narrowly: if a less intrusive way would reasonably achieve the same goal, you have to use it [10].
3. Your interest isn't overridden by the person's rights, considering what they could reasonably expect.

The EDPB published draft Guidelines 1/2024 on legitimate interest in October 2024, with direct marketing as one of the covered cases [11]. As far as I can tell, a final version hasn't been published yet. Treat it as the regulators' direction, not settled text.

Write this down as a Legitimate Interest Assessment (LIA). One to two pages is fine. A DPO will trust a short LIA you actually wrote more than a vendor's generic template.

Contact rules feed into the balancing test. The German supervisory authorities' guidance on direct marketing (DSK Orientierungshilfe, February 2022) says it directly: if a contact channel is not allowed under national marketing law, there is no legitimate interest to begin with [12]. The logic travels. That's why the market-by-market section below matters for GDPR, not just for marketing law.

Information duty: Art. 14

If you didn't get the data from the person, Art. 14 says you have to tell them who you are, what you process, why, from which source, and what their rights are [13]. Deadline: within one month of getting the data, or at your first communication with them if that comes earlier.

The DSK guidance adds a practical detail. If the notice goes out with your first outreach, it has to be clearly separated from the sales message, with a visible note on the right to object [12]. The "disproportionate effort" exception is narrow. In Bisnode, the cost of informing everyone by post wasn't accepted as an excuse [4].

The workable pattern: only pull a person's data when you're about to contact them, and put a short privacy notice with an objection option into the first message. In the recipient's language.

Enforcement worth knowing: KASPR

In December 2024 the French CNIL fined KASPR €240,000 [14]. Its browser extension collected contact details of people whose LinkedIn profiles its users viewed. The CNIL found:

• No valid legal basis for collecting details people had restricted to their 1st and 2nd-degree connections.
• Retention too long. Five years from each update, with the clock resetting at every job change.
• Transparency failures. People were informed only from 2022, four years after launch, and only in English.
• Weak access responses. "Publicly accessible sources" when the company knew its actual sources.

Ask your own enrichment vendors every one of those points. The CNIL closed the compliance order in March 2026 [14], so the fixes were possible.

Minimisation, retention and the right to object

• Pull fields, not profiles (Art. 5(1)(c)) [15]. Name, role, company, business email. Not a personal mobile, private address or full career history.
• Set a retention rule for non-responders (Art. 5(1)(e)) [15] and enforce it in your CRM. Don't let data refreshes reset the clock.
• Honour objections without exception. Under Art. 21(2) and (3), once someone objects to direct marketing, it stops [16]. Art. 21(4) requires you to mention that right explicitly [16].

The trap: if you delete an objector completely, the next enrichment run brings them back. The DSK guidance says a minimal suppression list (Werbesperrdatei) to honour objections can be lawful, as long as you tell the person why you keep it [12]. That list needs to sit upstream of every tool that can create or enrich a contact.

Contracts and transfers

Art. 28 requires a data processing agreement (in German: AVV) with any vendor that processes personal data on your behalf [17]. CRM, sequencer and enrichment orchestrator usually fall into this category. A vendor that compiles and sells its own contact database is usually an independent controller for that database. Then a standard DPA isn't the right document, or only covers part of the relationship. Ask how they classify themselves.

For US vendors, the EU-US Data Privacy Framework from July 2023 covers self-certified companies [18]. The EU General Court rejected a challenge to it in September 2025 (Latombe, T-553/23) [19]. An appeal is pending [20], so many DPOs still want Standard Contractual Clauses as a fallback. The UK and Switzerland have their own extensions. Check the official DPF list yourself, not the logo on a vendor's security page.

The separate question: are you allowed to contact them

GDPR covers processing. Contacting people is covered by a second layer: the ePrivacy Directive as implemented nationally, plus national unfair-competition and marketing laws. The Directive only requires consent for electronic marketing to individuals. Each country decides how far it protects businesses [21]. That single choice is why the same cold email can be fine in London and a legal problem in Vienna.

Three questions decide most cases:

• Who is the recipient? A company, an employee at a company, or a sole trader. Many countries treat these three differently.
• Which channel? Email, phone, or a platform message. Rules for each are separate.
• Is there an existing customer relationship? Most countries have a soft opt-in for existing customers and similar products. It almost never covers cold outreach.

LinkedIn messages are a grey zone almost everywhere. No regulator has taken a clear position, and in Germany at least one court has leaned towards treating them like email (OLG Hamm, 18 U 154/22). In practice, personal one-to-one LinkedIn messages are widely used across EMEA. I treat them conservatively: relevant, personal, no automated mass sequences, and stop at the first "no thanks".

Market by market

This is what I could verify from primary sources or reputable legal commentary as of October 2026. Where I couldn't, it says "check locally". Often misunderstood marks the rules I see teams get wrong most. The recommendation per market is in the table that follows.

Germany: the strictest email market

• Email, B2B included. §7(2) No. 2 UWG treats advertising email without prior express consent as unreasonable harassment. No B2B exception. The only carve-out is §7(3) for existing customers and similar own products [22]. Often misunderstood: "B2B email is fine under legitimate interest" doesn't work here. Under the DSK logic, a channel UWG forbids gives you no legitimate interest [12].
• Calls to businesses. §7(2) No. 1 UWG requires at least presumed consent (mutmaßliche Einwilligung) [22]. The DSK guidance, citing the Federal Court of Justice, says a general fit between your offer and their business isn't enough. You need a concrete reason from the recipient's own area of interest [12].
• Why signals matter here: phone needs a documented, specific reason. Email only with consent or for existing customers. "You posted three job ads for RevOps, we help with exactly that" is a concrete reason. A scraped list of everyone with "Head of" in their title isn't.

Austria: strict on email and calls

• Email. §174(3) TKG 2021 requires prior consent for direct marketing email, with no consumer/business split in the text. §174(4) has an existing-customer exception [23].
• Calls. §174(1) TKG 2021 requires prior consent for advertising calls, again without a B2B carve-out [23]. Often misunderstood: copying the German presumed-consent approach for calls into Austria.

Switzerland: different law, different logic

• Data protection. The revised FADP has applied since 1 September 2023 and no longer covers data about legal persons [3]. Contact persons are still protected. Unlike GDPR, the FADP doesn't require a legal basis for every processing. Confirm the details with a Swiss advisor.
• Email. Art. 3(1)(o) of the Swiss UWG requires prior consent for mass advertising by telecommunication, with a customer exception, a clear sender and a free opt-out [24]. Whether a single, individually written B2B email is "mass advertising" isn't settled in what I found. Check locally.
• Calls. Don't call numbers with a "star entry" in the phone directory unless there's a current business relationship (Art. 3(1)(u) UWG) [24].

United Kingdom: corporate versus individual subscribers

• Email. PECR's consent rule doesn't apply to corporate subscribers: limited companies, LLPs, Scottish partnerships, some public bodies. You still identify yourself and offer an opt-out [25].
• Sole traders and partnerships. Often misunderstood: they're individual subscribers with consumer-level protection, so consent or soft opt-in. The ICO says you can't tell the subscriber type from an email address, so treat unclear cases as individuals [25].
• Calls. Allowed, after screening against the Corporate TPS, the TPS and your own do-not-call list [25]. UK GDPR still applies to the person's data [25].
• Fines. The Data (Use and Access) Act 2025 raised maximum PECR fines to £17.5 million or 4% of global turnover [26].

France: opt-out for role-related B2B email

• Email. The CNIL allows emailing professionals without prior consent when the message relates to their job, for example software offered to an IT director. They must be informed and able to object easily. Generic addresses like contact@ are outside these rules [27].
• Tracking pixels. Often misunderstood: under the CNIL's April 2026 recommendation, measuring email opens to optimise campaigns needs consent [7]. Opt-out prospecting doesn't give you opt-out tracking.
• Calls. Consumer phone prospecting moved to prior consent on 11 August 2026 [28]. The official guidance I found is consumer-framed. Check locally for calls to professionals.

Netherlands: consent by default, also for businesses

• Email. Art. 11.7 of the Telecommunications Act requires prior consent. For businesses the only exception is contact details the recipient designated and published for receiving such messages [21]. Often misunderstood: there's no general B2B email exception.
• Calls. The Bel-me-niet register was abolished in July 2021, when calls to consumers moved to opt-in [21]. Calls to companies such as a BV or NV are still possible on an opt-out basis. Sole traders and partnerships are treated like consumers, so they need consent.

Belgium: impersonal addresses only

• Email. Consent is the rule. Legal persons can be emailed without consent only at impersonal addresses like info@ [29].
• Named work addresses. Often misunderstood: the Belgian economy ministry treats firstname.lastname@company as a natural person's address, so consent is required. The offer also has to target the company, not the employee privately [29].

Nordics: three different answers

• Sweden. The consent rule in §19 of the Marketing Act covers natural persons. §20 requires an opt-out address in every message, also to legal persons [30]. How named work addresses are treated I couldn't verify from a regulator. Check locally.
• Finland. The data protection authority treats firstname.lastname@company as a person's address. Marketing can go there based on the person's role ("asemavaltuus"), and the sender must check the role fits first. Otherwise, consent [31].
• Denmark. Often misunderstood: the Consumer Ombudsman says the spam ban applies to all recipients, companies included, whether you write to info@ or to a named employee [32].
• Norway: not verified. Check locally.

Spain and Italy: consent-based email

• Spain. Art. 21 LSSI prohibits commercial email that wasn't requested or expressly authorised, except for existing customers and similar products. The law's recipient definition includes legal persons, and the AEPD applies the consent rule to business addresses [33].
• Italy. Art. 130 of the Privacy Code requires consent for email marketing. In 2018 the Garante banned a company from using around 390,000 certified email (PEC) addresses of professionals taken from public registers. Public availability and an unsubscribe link didn't replace consent [34].
• Calls: registers and rules changed in recent years in both. Check locally.

Poland: consent for B2B email and calls

• Email and calls. Art. 398 of the Electronic Communications Law, in force since 10 November 2024, prohibits direct marketing via terminal equipment and automated calling systems without prior consent [35]. Commentary reads it as covering businesses and both channels [35]. Often misunderstood: a first call to ask for consent. Commentary citing the regulators says that isn't allowed [35].

United Arab Emirates

• The federal PDPL (Federal Decree-Law No. 45 of 2021) has been in force since January 2022. Legal commentary from mid-2026 reports that its executive regulations still haven't been issued [36]. DIFC and ADGM have their own data protection regimes.
• Calls. Telemarketing is regulated by Cabinet Resolution No. 56 of 2024: calls only between 9:00 and 18:00, no calls to numbers on the Do Not Call Register, limits on follow-up calls, and no pressure tactics [39]. Check how it applies to your B2B calls.

Saudi Arabia

• The PDPL took effect on 14 September 2023, with full enforcement from 14 September 2024. Commentary consistently reads it as requiring consent for direct marketing [37].

South Africa

• Email and calls. POPIA section 69 prohibits direct marketing by unsolicited electronic communication without consent, except to existing customers. You may ask a person for consent once [2]. The Information Regulator's late-2024 guidance note treats phone calls as electronic communication [38]. Often misunderstood: treating cold calls as outside the rule.
• Juristic persons. POPIA protects companies too [2].

EMEA at a glance

The ratings are my own summary of the sources above. "Strict" means you should assume consent is needed for cold B2B outreach on that channel.

Why DACH ends up at the strict end: Germany has no B2B exception for email and ties the GDPR balancing test to it. Austria adds consent for calls. Together they leave you almost no cold electronic channel without consent. Switzerland is easier, but still restricts automated volume.

Signal types at a glance

Vendor due diligence checklist

Send this before the demo, not after the contract. The quality of the answers tells you a lot.

Data sources

• Where does each field come from? Registers, websites, partner networks, user contributions, scraping?
• For co-op intent: how is consent obtained on the publisher side, and can you document it?
• Do you collect data people restricted to their network, for example on LinkedIn?

Role, contracts, transfers

• Are you a processor or an independent controller for the data we receive? Is there a DPA?
• Current sub-processor list, and how are we notified of changes?
• Where is data stored? EU hosting available? DPF certification (incl. UK and Swiss extensions) or SCCs?

Rights and countries

• How do you meet Art. 14, in which language, and who sends it?
• Do objections sync to customers so we don't re-import suppressed contacts?
• Can you name the specific source of a person's data on request?
• Can you flag country, legal form, subscriber type (company, sole trader, partnership) and generic versus named addresses?

Retention and track record

• How long do you keep records, and does an update reset the clock?
• For website identification: what happens to IP addresses, and does the script need consent?
• Any regulator inquiries or fines in EMEA, and how were they resolved?

A vendor that answers "we're fully GDPR compliant" without specifics has given you an answer too.

The one-page brief for your DPO

One page. Plain language. Fill in the brackets.

1. Purpose. Identify companies likely in a buying process for [category] and contact relevant people there with a specific offer.
2. Phases. Phase 1: account-level signals only, no personal data in scoring. Phase 2: for prioritised accounts, [number] relevant roles per company, pulled at the point of outreach.
3. Data categories. Account: name, domain, industry, size, tech stack, signal type and date. Person: name, title, company, business email, [business phone], LinkedIn URL. No private contact data, no special categories.
4. Data subjects and countries. [Roles] at [ICP companies] in [countries]. Sole traders flagged and [excluded / handled separately].
5. Legal basis. Account level outside GDPR for legal persons (Rec. 14), with flagged exceptions and non-EU markets noted. Person level Art. 6(1)(f), LIA attached. Website identification and email tracking only after consent under national ePrivacy rules (in Germany §25 TDDDG).
6. LIA summary. Interest: B2B sales of [product]. Necessity: only relevant roles, only at accounts with a documented signal. Balancing: business data, professional context, Art. 14 notice and objection option in the first message, short retention.
7. Channels per country. A small table: country, allowed channels, consent yes or no, source. For example: Germany, phone with documented reason, email only with consent. UK, email to limited companies with opt-out, sole traders excluded.
8. Vendors. Vendor, role, data location, DPA status, DPF or SCCs.
9. Retention. Account data [period]. Prospects without engagement deleted after [period]. Suppression list kept as long as needed to honour objections.
10. Opt-out process. Objections from any channel go to one suppression list within [timeframe], checked before every enrichment and send.
11. Open questions. The two or three points you're genuinely unsure about. It gives the DPO something specific to work on.

A safe default architecture

There's no single right setup. Context matters: your ICP, your countries, your channels, your risk appetite. If a small B2B team selling across EMEA asked me where to start, this is the default I'd suggest.

1. Score accounts, not people. Signal collection and prioritisation at company level. That's where most of the signal value is, and under GDPR it stays outside scope for legal persons.

2. Add people only at the point of outreach. When an account crosses your threshold, pull two or three relevant roles. Every person record then has a purpose and a date, which makes the LIA, Art. 14 and retention much easier.

3. Pick a contact model: strictest market or country-aware.

• Design for the strictest market you sell into. Selling into Germany, Austria or Poland? Apply their rules everywhere. Less volume, one process, little to get wrong.
• Or segment by country. Store country, legal form and subscriber type on every contact. Keep a channel rules table per country in the CRM and route each contact into a sequence that only uses allowed channels. A German contact gets a call task. A UK limited-company contact can get an email. A Danish contact gets neither without consent.
• Small teams often start with the first and move to the second once volume justifies it.

4. One suppression list, upstream of everything. Every enrichment run and sequence checks it first, across all countries.

5. Art. 14 notice in the first touch. Short, in the recipient's language, separate from the pitch, with the data source and a clear way to object.

6. Website identification at company level and behind consent. Same for email open tracking where regulators require consent. If a tool wants to match visitors to individuals, I'd stop and talk to a lawyer first.

7. Review the LIA and the country table twice a year. Several markets in this article changed their rules between 2024 and 2026.

This is slower to scale than buying a big contact database and sequencing everyone in it. It's also the version that survives the DPO meeting, a complaint or a regulator letter in any of these markets. For a small team, that trade-off usually pays off.

References

1. GDPR Recital 14, Not applicable to legal persons. https://gdpr-info.eu/recitals/no-14/
2. South Africa, Protection of Personal Information Act 4 of 2013, sections 1 and 69. https://popia.co.za/section-69-direct-marketing-by-means-of-unsolicited-electronic-communications/
3. KMU-Portal (Swiss Confederation), Neues Datenschutzgesetz (revDSG), in force 1 September 2023. https://www.kmu.admin.ch/de/neues-datenschutzgesetz-revdsg
4. UODO, "The Supreme Administrative Court upheld the decision of the Personal Data Protection Office" (Bisnode, III OSK 2538/21), 20 September 2023. https://bip.uodo.gov.pl/en/553/1572
5. CJEU, Breyer, C-582/14, judgment of 19 October 2016. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0582
6. §25 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz). https://www.gesetze-im-internet.de/ttdsg/__25.html
7. CNIL, Pixels de suivi dans les courriers électroniques: recommendation, 14 April 2026 (deliberation 2026-042). https://www.cnil.fr/fr/recommandation-pixel-suivi-courriels
8. GDPR Art. 6, Lawfulness of processing. https://gdpr-info.eu/art-6-gdpr/
9. GDPR Recital 47, Overriding legitimate interest. https://gdpr-info.eu/recitals/no-47/
10. CJEU, Koninklijke Nederlandse Lawn Tennisbond, C-621/22, judgment of 4 October 2024. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0621
11. EDPB, Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, version for public consultation, 8 October 2024. https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2024/guidelines-12024-processing-personal-data-based_en
12. Datenschutzkonferenz (DSK), Orientierungshilfe der Aufsichtsbehörden zur Verarbeitung von personenbezogenen Daten für Zwecke der Direktwerbung unter Geltung der DS-GVO, February 2022. https://www.datenschutzkonferenz-online.de/media/oh/OH-Werbung_Februar%202022_final.pdf
13. GDPR Art. 14, Information to be provided where personal data have not been obtained from the data subject. https://gdpr-info.eu/art-14-gdpr/
14. CNIL, "Data scraping: KASPR fined €240,000", December 2024, and "Closure of the order issued against KASPR", March 2026. https://www.cnil.fr/en/data-scraping-kaspr-fined-eu240000 and https://www.cnil.fr/en/closure-order-issued-against-kaspr
15. GDPR Art. 5, Principles relating to processing of personal data. https://gdpr-info.eu/art-5-gdpr/
16. GDPR Art. 21, Right to object. https://gdpr-info.eu/art-21-gdpr/
17. GDPR Art. 28, Processor. https://gdpr-info.eu/art-28-gdpr/
18. European Commission, adequacy decision for the EU-US Data Privacy Framework, 10 July 2023. https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en
19. EU General Court, Latombe v Commission, T-553/23, judgment of 3 September 2025. https://curia.europa.eu/juris/liste.jsf?num=T-553/23
20. Appeal Latombe v Commission, C-703/25 P, Official Journal C/2025/6610. https://eur-lex.europa.eu/eli/C/2025/6610/oj/eng
21. Netherlands, Telecommunicatiewet Art. 11.7 (text via PONT Omgeving), and ePrivacy Directive 2002/58/EC Art. 13. https://omgevingsweb.nl/wetgeving/telecommunicatiewet/hoofdstuk-11-bescherming-van-persoonsgegevens-en-de-persoonlijke-levenssfeer/%C2%A7-11-1-algemene-bepalingen/artikel-11-7/ and https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32002L0058
22. §7 UWG (Gesetz gegen den unlauteren Wettbewerb), Unzumutbare Belästigungen. https://www.gesetze-im-internet.de/uwg_2004/__7.html
23. Austria, Telekommunikationsgesetz 2021, §174. https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20011678&Paragraf=174
24. BAKOM (Switzerland), When is mass sending allowed, and Swiss UWG Art. 3. https://www.bakom.admin.ch/en/when-is-mass-sending-allowed and https://www.fedlex.admin.ch/eli/cc/1988/223_223_223/de
25. ICO, Business-to-business marketing (PECR and UK GDPR). https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/
26. ICO, Statement on the commencement of the Data (Use and Access) Act, February 2026. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/statement-on-the-commencement-of-the-data-use-and-access-act-duaa/
27. CNIL, La prospection commerciale par courrier électronique, SMS-MMS et automate d'appel. https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique-sms-mms-et-automate-dappel
28. DGCCRF, Les règles du démarchage téléphonique s'imposant aux entreprises (Law 2025-594, opt-in from 11 August 2026). https://www.economie.gouv.fr/dgccrf/les-fiches-pratiques/les-regles-du-demarchage-telephonique-simposant-aux-entreprises
29. FOD Economie (Belgium), "Spam" in 23 vragen en antwoorden. https://economie.fgov.be/nl/file/134162/download?token=maqS0JmV
30. Sweden, Marknadsföringslag (2008:486), §§19 and 20. https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/marknadsforingslag-2008486_sfs-2008-486/
31. Tietosuojavaltuutetun toimisto (Finland), Usein kysyttyä suoramarkkinoinnista. https://tietosuoja.fi/usein-kysyttya-suoramarkkinointi
32. Forbrugerombudsmanden (Denmark), Vejledning om spamforbuddet, 2021. https://forbrugerombudsmanden.dk/media/bjajzdv1/vejledning-om-spamforbuddet-2021-a.pdf
33. Spain, Ley 34/2002 (LSSI), Art. 21 and Annex, and AEPD Gabinete Jurídico report 2018-0164. https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758 and https://www.aepd.es/es/documento/2018-0164.pdf
34. Garante per la protezione dei dati personali (Italy), Provvedimento n. 52 of 1 February 2018, doc. web 7810723. https://www.garanteprivacy.it/garante/doc.jsp?ID=7810723
35. Poland, Prawo komunikacji elektronicznej (Dz.U. 2024 poz. 1221), Art. 398, and Prawo.pl, "Zgody marketingowe i kontakty handlowe: co mówi prawo komunikacji elektronicznej". https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240001221 and https://www.prawo.pl/biznes/zgody-marketingowe-i-kontakty-handlowe-co-mowi-prawo-komunikacji-elektronicznej,530981.html
36. Morgan Lewis, "UAE Establishes Federal Authority for Artificial Intelligence and Data", June 2026. https://www.morganlewis.com/pubs/2026/06/uae-establishes-federal-authority-for-artificial-intelligence-and-data
37. Latham & Watkins, "Saudi Arabia's Data Protection Law Enters Into Force", December 2023. https://www.lw.com/en/insights/2023/12/Saudi-Arabias-data-protection-law-enters-into-force
38. Cliffe Dekker Hofmeyr, "Navigating the Information Regulator's guidance note on direct marketing", January 2025. https://www.cliffedekkerhofmeyr.com/news/publications/2025/Sectors/Technology-Communications/Technology-and-Communications-Alert-29-january-Navigating-the-Information-Regulators-guidance-note-on-direct-marketing
39. UAE Cabinet Resolution No. (56) of 2024 Concerning the Telemarketing Regulations. https://uaelegislation.gov.ae/en/legislations/2519/download