B2B data compliance means you can show, for every contact in your outbound workflow, why you hold it, where it came from, who processes it and how the person can say stop. Most French and EU teams rely on legitimate interest under GDPR Article 6(1)(f), and that basis only holds if you have written it down. This guide covers what to document and where outbound workflows usually leak. It is not legal advice, so check your final setup with counsel or a DPO.

What an EU sales team must be able to show

Five points come up in almost every review, and each one maps to a specific part of GDPR.

• A lawful basis you can defend. Legitimate interest under Article 6(1)(f) rests on a balancing test: your purpose, why the processing is necessary for it, and why the person's rights do not override it. Write the assessment down before the campaign, not after a complaint.
• Information to the person. When you collect data from a source other than the individual, Article 14 requires you to tell them who you are, why you hold their data and where it came from. For outreach, that means at the latest at the first communication.
• A working opt-out. Article 21 gives people the right to object to processing for direct marketing. When someone objects, you stop, and you remember that they objected.
• Contracts with processors. If a vendor processes contact data on your behalf, Article 28 requires a written data processing agreement (DPA).
• A regulator you can read. In France that is the CNIL, which publishes guidance on prospecting. Read it before you write your own policy.

If you also contact people in California, the CCPA may apply to you. It protects California residents and applies to businesses that meet its criteria, so check whether you do.

The one-page checklist

You do not need a 40-page policy to start. You need five answers, written, with an owner each.

1. Purpose. One paragraph per outbound motion, for example "calling HR directors at mid-market companies about a recruiting tool", with the balancing test attached.
2. Data map. Which fields you store, where each one came from, and which tools touch it: CRM, dialer, sequencer, enrichment, spreadsheets.
3. Retention. How long a contact with no response stays in your systems. Pick a period you can defend, then enforce it automatically instead of by memory.
4. Objections. One suppression list that the dialer, the sequencer and the CRM all read. A "do not contact" flag written in one tool and ignored in another is the most common failure we see.
5. Vendors. A register of every processor with the DPA status, the list of subprocessors and the country where data is stored.

Where outbound workflows leak

The policy is rarely the problem. The leaks sit in the daily workflow.

• A rep exports a list to a spreadsheet, the contact objects a week later, and the spreadsheet is never updated.
• Enrichment pulls personal mobile numbers and private emails when a work number would have done the job.
• Call recordings and notes stay in a tool nobody reviews after a rep leaves.
• A contact is deleted from the CRM but survives in the sequencer and in a backup export.

Run a mock request this week. Pick one real contact, pretend they asked for deletion, and trace every system that holds a copy. The gaps show up in an hour.

Contacts you already know are easier to explain

In our calls data, a cold call to a dormant contact that opens with "How have you been?" reaches about 10% success, against about 1.5% for a standard cold open. Compliance is a separate question from conversion, but the same logic helps in both: a person you have already spoken to has a clearer story in your balancing test than a name from a list you bought last week. That is a documentation point, not a legal guarantee.

What to ask any data or dialer vendor

Ask the same questions of every tool that touches contact data, including ours.

• Will you sign a DPA, and does it describe the actual data flow, including subprocessors?
• In which countries is the data stored and processed, and what mechanism covers transfers outside the EU?
• What happens to our data at the end of the contract, backups and logs included?
• When we record an objection, how does it reach the other tools in our stack?
• What security evidence can you share, such as an independent audit report?

Treat a certificate as one input, not proof. The mock deletion above is a better test of a vendor than a badge on a website.

How Sonik approaches data compliance

Sonik is a dialer that works from contacts and signals already in your CRM, such as website visitors, job changes and dormant leads. In our experience, reps use only about 20% of the signals their CRM already holds, so most of the value sits in data you already have the right to use, not in buying more of it.

We built the product with France and Europe first in mind, and we recommend the same checklist to our own customers: a documented purpose, one suppression list, a retention rule and a vendor register. Ask us, as you would any vendor, for the DPA terms, the subprocessor list and the retention terms before you sign.

Conclusion

Compliance in outbound is mostly discipline: written purpose, one suppression list, enforced retention and signed vendor contracts. Start small and keep it current. This week, run the mock deletion on one real contact and fix the first system where a copy survives.