GDPR Article 14: The Data Rule That Applies to Web Scraping and B2B Lead Lists

#webscraping #startup #security #gdpr

Most GDPR discussions focus on Article 13 — the notice you give when collecting data directly from users.

Article 14 is different. It applies when you collect personal data indirectly — from public websites, LinkedIn, and data brokers.

If you build lead databases or scrape for B2B contacts, Article 14 probably applies to you.

What Article 14 Requires

When you collect personal data from a source other than the data subject:

Notify them within 1 month of collection
Tell them: your identity, purpose, legal basis, data categories, retention period, their rights
At the latest: when you first contact them

If you scrape LinkedIn for 500 prospects, you technically need to notify all 500 within 1 month. Almost no B2B outreach operation does this.

The Legal Basis That Works

Legitimate Interests (Article 6(1)(f)) works for B2B if you document a balancing test:

Your interest: business development
Their interest: not receiving unwanted contact
Balance: proportionate and professionally relevant?

Required conditions:

B2B context (professional capacity, not consumers)
Outreach relevant to their role
Opt-out in every message
Honor opt-out within 30 days

What Public Data Does NOT Mean

Common misconception: if data is on a public website, GDPR does not apply.

Wrong. GDPR applies to any information about an identifiable person. A LinkedIn profile with name + email is personal data regardless of being publicly accessible. Public access affects the source, not GDPR applicability.

Practical Compliance

1. Document your Legitimate Interests Assessment — a one-pager explaining what data, why, and how you balanced interests.

2. Include Article 14 notice in first outreach:

How I found you: LinkedIn / company website
Why I am reaching out: [specific relevance]
Your rights: Request deletion at privacy@yourcompany.com

3. Maintain a suppression list — do not delete opted-out contacts, add them to suppression so you do not accidentally re-add them.

4. Limit retention — 12-24 months is standard. Delete unenriched contacts that were never engaged.

Enforcement Reality

Article 14 enforcement against small B2B senders is rare — regulators focus on large breaches and sensitive data. But a single complaint can trigger inquiry.

Compliance cost is low: 2 hours of documentation + three sentences in your outreach template. Worth it.