Compliance Checklist
Privacy Best Practices for Using Email to Search for People
Email-based people search is a normal, legitimate part of sales, recruiting, journalism, partnership development, and BD. Done thoughtfully it's lawful and welcome — recipients often thank you for the relevance. Done sloppily it triggers complaints, blocklisting, and regulator action.
This guide is the practical playbook that keeps teams on the right side of GDPR, CCPA/CPRA, CAN-SPAM, CASL, the Australian Spam Act, India's DPDP, Brazil's LGPD, and the ePrivacy Directive — without slowing your team down.
1. Establish a lawful basis before you collect
For B2B, legitimate interest usually applies. Document a one-page Legitimate Interest Assessment (LIA): who you're contacting, why the message is relevant to their role, how you balance their rights against your interest, and how they can opt out. Store the LIA somewhere you can produce on request — that's the document a regulator asks for first.
2. Minimize what you store
Only keep the fields you actually use: name, work email, role, company, and one personalization hook. Skip phone, home address, personal social profiles, and any sensitive category (health, religion, political affiliation) unless you genuinely need them. Minimum data = minimum liability.
3. Be transparent on first contact
Identify yourself, say briefly where you got the email ("public LinkedIn / company website / business contact database"), and include a one-click unsubscribe. This single line satisfies CAN-SPAM, CASL, the Australian Spam Act, and most GDPR Article 14 transparency duties simultaneously.
4. Honor opt-outs across every channel, forever
Maintain a global suppression list. If someone unsubscribes from one campaign, never email them from another — not next quarter, not from a new domain, not from a different team. This is the single highest-leverage practice for protecting deliverability and avoiding regulator complaints. Most reputational damage in outbound comes from re-emailing people who said no.
5. Set a retention policy
Auto-delete or anonymize records after a defined inactivity window (12–24 months is the B2B standard). Document the policy in your privacy notice. Run a quarterly cron job that purges everything past the threshold. "We didn't know we still had that data" is not a defense — it's an aggravating factor.
6. Vet your data vendors
- Where does the data come from? (Licensed? Scraped? Both?)
- Do they honor takedown and deletion requests across all customers?
- Do they offer a Data Processing Agreement (DPA)?
- Do they disclose sub-processors?
- What's their breach-notification commitment?
- Are they registered as a data broker in California and Vermont if applicable?
Cheap data with no DPA is a liability, not a bargain. The vendor's compliance posture becomes your compliance posture.
7. Respect regional rules
- US: CAN-SPAM + state privacy laws (CCPA/CPRA, VCDPA, CPA, CTDPA, plus newer laws in TX, OR, MT, IA)
- EU/UK: GDPR / UK GDPR — lawful basis + transparency + DSARs + ePrivacy / PECR
- Canada: CASL — implied or express consent
- Australia: Spam Act 2003 — consent + identification + unsubscribe
- Brazil: LGPD — GDPR-aligned, ANPD enforcement
- India: DPDP Act 2023 — consent-led, fiduciary obligations
8. Build an internal escalation path
Someone will reply asking how you got their address. Have a templated, honest, friendly answer ready, and a one-step deletion process the rep can trigger without a ticket. Turning a complaint into a closed loop within an hour is the difference between a happy ex-prospect and a regulator complaint.
9. Maintain a privacy notice that reflects reality
The privacy notice on your website must describe: what data you collect, where you get it, how you use it, who you share it with, how long you keep it, the lawful basis, and how to exercise rights. Update it whenever any of those changes — not annually.
10. Run a quarterly mini-audit
Once a quarter, pull a random sample of 20 contacts from your CRM and verify: (a) you have a documented source for each, (b) none has unsubscribed, (c) none is past retention. Twenty minutes of work that protects the entire program.
11. Train every rep who touches prospect data
The fastest way to break privacy posture is a new rep exporting a CSV to their personal laptop. Make the training a one-page document and a 10-minute Loom. Repeat it every six months.
12. Have an incident-response plan
If a breach occurs — laptop lost, third-party vendor compromised, data exfiltrated — you have 72 hours under GDPR to notify regulators. Write the plan now; do not improvise it during the incident.
Frequently asked questions
Is using email to search for someone a privacy violation?
Not inherently. It becomes a violation when you process personal data without a lawful basis, fail to honor opt-outs, retain data longer than necessary, or use it for purposes the person wouldn't reasonably expect.
How long can I keep prospect data?
Only as long as you have a lawful basis. Common policy: 12–24 months after the last interaction for B2B, then automatic deletion unless the contact re-engages.
Do I need to tell people I have their email?
Under GDPR/UK GDPR you must inform them within 30 days of obtaining personal data from a source other than themselves (Article 14). The first cold email typically includes this disclosure plus an opt-out link.
What's the single biggest mistake teams make?
Bulk-emailing without a documented lawful basis or working opt-out. That's what triggers complaints, blocklisting, and regulatory action — not the lookup itself.
Do I need a DPA with my data vendor?
Yes if you process EU/UK personal data. A Data Processing Agreement defines roles (controller vs. processor), security commitments, sub-processor disclosure, and breach-notification timelines. Any reputable vendor will provide one on request.
What's the right response to a data subject access request?
Acknowledge within 72 hours, confirm identity, deliver the data within 30 days in a portable format, and document the entire exchange. Most platforms (including HuntMeLeads) offer self-serve DSAR endpoints.