Technographic data enrichment GDPR compliance depends on one test: does the field stay on a company, or does it end up on a record about an identifiable person? A fact such as "this domain runs a given marketing platform" describes a company and sits outside the GDPR on its own. The same fact written onto a contact row with a name and email is part of a record about a person, and the GDPR's rules on lawful basis, notice, objection and accuracy then apply to that record.

Technographic Data Enrichment GDPR Compliance: The Short Answer

  • The technology is rarely the problem. The key is. Recital 14 of the GDPR says the Regulation does not cover processing of personal data that concerns legal persons, including the name, form and contact details of the legal person. Article 4(1) defines personal data as information relating to an identified or identifiable natural person. A technology detected on a company's website is about the company. A person is identified by the row it is written on.
  • Some technographic signals start from people. One vendor documents "people work summaries" and job postings as sources it reads to infer what technologies a company uses. Those sources are written by or about individuals, even when the output is a company-level fact.
  • Writing a technology fact onto a contact record is where the obligations begin. If you are the one who holds that record, you decide why and how it is processed. A vendor's "GDPR compliant" label does not move that responsibility off your record.
  • Four duties follow from the person-linked row. A documented lawful basis, notice to the person when you did not collect the data from them, a working way to stop processing for direct marketing when they object, and accuracy and retention rules that apply per field.
  • This guide's model: the Identity Link Test below sorts each field into Company-only, Role-linked or Person-linked, so you can keep the first two where they are and treat the third as personal data.

Which lawful basis fits a given use, and how a national regulator reads it, is a judgment for your counsel or data protection officer. This guide shows where the questions arise in an enrichment workflow.

The Identity Link Test: the decision framework

The test asks three questions of every enriched field, in order. It is this guide's model, not a legal standard or a regulator's checklist.

  1. What does the field describe? A company, a role, or a person.
  2. What is it stored against? A domain or account ID only, a job title or role mailbox, or a row that also holds a name, a personal-looking email address, a direct phone number or a profile URL.
  3. What will it be used for? Account selection, a message to a named person, or an evaluation of a named person.
Status What it looks like GDPR position What to do
Company-only A technology, spend estimate or renewal date stored against a domain or account ID, with no person key on the row Describes a legal person. Recital 14 puts processing that concerns legal persons outside the Regulation Keep it on the account table. Do not copy it onto contact rows by default
Role-linked A job title from a team page with no name, or a role-based mailbox Not about a named person on its face. Whether it identifies someone depends on how many people hold the role, which is an inference to test, not a given Treat it as Company-only until you attach it to a person. Re-check if the role has one holder
Person-linked Any field, including a Company-only one, written onto a row with a name, email, phone or profile URL The record relates to an identifiable person (Article 4(1)). Treat the whole row as personal data Apply lawful basis, notice, objection, accuracy and retention rules to the row

The third row is a precaution, not a court holding. Whether a fact about an employer "relates to" an employee is a legal question, and this guide takes the conservative view that a row built around a person is a record about that person. At least one page that ranks for this query takes the same view: link technographic insights to a named contact and the profile falls under the GDPR if the person is in scope.

Field ledger: source, freshness, verification, confidence and identity status

A technographic field is only as usable as what travels with it. 6sense, for example, says each data point carries a source, a collection method, a tracking frequency and a confidence score. The last column below is where the GDPR enters.

Field Source types vendors document Freshness evidence Verification Confidence Identity Link status
Technology detected on a company website HTML source, JavaScript, subdomain patterns, name-server and mail-exchange records (6sense, active sources) A last-detected date. BuiltWith's field list defines FirstDetected and LastDetected as the dates it first and last detected the technology Cross-check with a second source type 6sense publishes a 0–100 score from recency, detection volume and a third factor listed on its page Company-only on an account row
Technology inferred from a job posting Job descriptions (6sense, passive source) Posting date Count of independent postings The same score; detection volume strengthens it Company-only on an account row. Do not store the recruiter or poster
Technology inferred from employee profiles "People work summaries" (6sense, passive source) Not described on the page reviewed Human curated research is a separate source Detection volume The input comes from people. Keep only the aggregated company-level result
Title found on a team page Team and executive pages (BuiltWith) Crawl date None described None described Role-linked. BuiltWith's field list says "names not included" and simplifies titles to C-Level, Marketing, Development, Other
Role-based email found on a website Site contact pages (BuiltWith) Crawl date None described None described Role-linked. Treat as Person-linked if the mailbox reaches one named person
Contract renewal date Not described on the page reviewed (ZoomInfo) Not described Not described Not described Company-only on an account row
Any field above written to a contact row Your CRM or enrichment workflow The date you appended it Your own check Your own rule Person-linked

Two cautions. First, "last detected" is a crawl date, not evidence the technology is still in use, and a confidence score from one vendor is not comparable to another's. Second, a field that arrives without a source type, a date and a confidence is one you cannot defend later under the accuracy principle in Article 5(1)(d).

What the pages that rank for this query agree on and miss

The pages ranking for this exact phrase converge on four points: enrichment touches personal data when a named contact is involved, legitimate interest is the usual route, you need a notice and a way to honor objections, and vendors must be vetted. Where they diverge is in how much they separate the technology from the person.

Page What it answers What it leaves open What it cites or proves
Vocal, Technographic Data Enrichment: A Practical GDPR Compliance Guide (Metizsoft Inc, undated) Articles 6, 14 and 21 in an enrichment setting; a legitimate interests assessment; a suppression list after objection Which fields are personal data; the vendor's role Names the articles. Gives retention windows with no source
DemandCurve Marketing, Technographic Data Enrichment & GDPR Compliance Whether GDPR applies to technographic data: not alone, but once linked to a named contact, an email address or a user profile; DPAs; the risk of re-importing a deleted contact Scope stated by residence ("European citizens", people "in the EEA") rather than by the Article 3 tests; no per-field view Regulation named in general terms; fine ceiling stated
DataBees, GDPR-Compliant Data Enrichment (April 2, 2025) First-party versus third-party sources; brokered data; DPAs Technographic fields specifically Vendor guide; no regulator text
Cognism, Technographic Data Providers (April 21, 2026) A vendor view that technographic data "can be compliant" depending on collection, storage and use; Article 14 notices and phone screening against do-not-call lists, as the vendor describes its own practice An independent test; what you must do on your own record Vendor claims about its own product
saber.app, Contact Data Enrichment Legitimate interest as the typical basis for B2B contact enrichment Evidence that it "typically qualifies"; any notice timing No regulator text on the page
ZoomInfo, Data Enrichment Per-field audit trail: which source gave which value, when appended, and whether the person opted out, supporting Article 30 records Which technographic fields are personal data; the controller's own duties beyond records Lists the vendor's own certifications

None of these pages sorts individual technographic fields by whether they describe a company, a role or a person, and none ties the identity decision to where the field is stored. That is the gap the Identity Link Test fills.

What the vendors' own documents say

Vendor documentation tells you who claims which role, which is the starting point for the contract.

Vendor What its documents say Why it matters to you
BuiltWith (privacy policy, last updated March 24, 2026) It describes itself as a provider of publicly sourced business intelligence "rather than as a processor acting on behalf of customers for this dataset". It says limited personal information, generally names, roles and business contact context from team and contact pages, is incidental. Customers are responsible for lawful use of the data. Individuals and organizations can request access, correction, suppression or removal The vendor is not your processor for this dataset, so your use of any person-level output is your own processing
6sense (Technographic Data Overview, updated April 8, 2026) Passive sources read job postings, people work summaries and human curated research; active sources scan HTML, JavaScript, subdomains and name-server and mail-exchange records. Each data point carries a source, a collection method, a tracking frequency and a confidence score Source and score metadata can be copied into your ledger; the passive sources start from people
6sense (TRUSTe findings letter dated December 11, 2025) The letter says practices-level measures in the accompanying validation report had been implemented as of December 10, 2025 It speaks to the vendor's practices, not to how you use the data
Clay (data processing agreement) The customer is the controller and Clay is appointed as processor for the processing set out in its annexes, which include the customer's use of its data enrichment tools. Clay's privacy policy covers the cases where Clay acts as controller Under Clay's agreement you are the controller of the personal data it processes for you. Check each underlying data provider separately
Cognism (blog, April 21, 2026) Says it issues Article 14 notifications to business contacts and screens phone numbers against national do-not-call lists A vendor notice is not documented to cover your own notice duty. Do not rely on it without confirming in writing that it does
ZoomInfo (Data Enrichment guide) Says to keep a record of which source gave each field, when it was appended and whether the person has opted out, supporting Article 30 records; states "compliance depends on the provider" Use the audit trail as your ledger. The responsibility on your record stays with you
Demandbase Publishes a customer Data Processing Addendum and a privacy notice Request both and read the roles

Step 1: split the account table from the contact table

Store technographic fields against the domain or account ID. A contact row should carry only what a message to that person needs. This is the common-sense reading of data minimisation in Article 5(1)(c): personal data must be adequate, relevant and limited to what is necessary for the purposes. One page that ranks for the query gives the same advice with the example "map the tech stack to the company, not to a named person". You can still use the account fact when you write to someone at that account. You do not have to store it on their row to do so.

Step 2: write the field ledger before you switch on enrichment

For each field, write down the source type, the detection date, the vendor's confidence label, how you verify it and its Identity Link status. Keep the vendor's own words for the confidence label, because 6sense's 0–100 score and another vendor's label do not measure the same thing. If a vendor does not describe a source or a date, record "not described" and decide whether you will use the field without it.

Step 3: decide the lawful basis for the person-linked rows

For a person-linked row, Article 6(1)(f) allows processing that is necessary for the legitimate interests of the controller or a third party, unless those interests are overridden by the person's interests or fundamental rights. Recital 47 says processing for direct marketing may be regarded as carried out for a legitimate interest, and that the assessment includes whether the person could reasonably expect the processing at the time and in the context of collection. The European Data Protection Board's Guidelines 1/2024 on Article 6(1)(f) (Version 1.0, adopted October 8, 2024) set out three cumulative conditions: a legitimate interest, necessity of the processing for it, and interests not overridden by the person's rights. Record that assessment for the use you intend, field by field where the use differs.

Two points often missed:

  • Electronic marketing has its own rules. In the United Kingdom, the Information Commissioner's Office explains that the UK GDPR applies to business-to-business marketing whenever personal data is processed, and that the Privacy and Electronic Communications Regulations treat sole traders and some partnerships as individual subscribers, with the protections that implies, while limited companies and similar bodies are corporate subscribers. Outside the UK, the national law that implements the ePrivacy Directive decides who can be emailed or called, so check each country you sell into.
  • Scope follows the Article 3 tests, not nationality. Recital 14 says the protection applies to natural persons whatever their nationality or place of residence, and Article 3 applies the Regulation to controllers established in the Union and to some controllers outside it that offer goods or services to, or monitor, people in the Union.

Step 4: send the notice, on time

Where personal data has not been obtained from the person, Article 14 requires you to give them the controller's identity and contact details, the purposes and legal basis, the categories of data, the source of the data and whether it came from publicly accessible sources, the retention period or criteria, the legitimate interests relied on, and their rights, including the right to object and to complain. The timing rule has three branches: within a reasonable period and at the latest within one month; at the latest at the first communication if the data will be used to communicate with the person; and at the latest when the data is first disclosed to another recipient. Article 14(5) lists limited exceptions, including where the person already has the information or where providing it is impossible or would involve a disproportionate effort. Those exceptions are narrow and you should document the reasoning before relying on one.

A vendor that sends its own notice may help with Article 14(5)(a), but whether its notice covers your processing, your purposes and your identity is a question to confirm in writing, not to assume. That is an inference from the text of the Article, not something any vendor page reviewed states.

Step 5: make objection survive re-enrichment

Article 21(2) gives a person the right to object at any time to processing for direct marketing, including profiling related to it, and Article 21(3) says the data must then no longer be processed for that purpose. Article 21(4) requires the right to be brought explicitly to the person's attention, clearly and separately from other information, at the latest at the first communication.

The enrichment-specific risk is that an automated workflow brings the person back. A suppression record must be kept in a form you can match against future enrichment batches, so a person who objected is not appended again. Two pages that rank for the query raise the same risk. Keep the suppression list outside the records that enrichment overwrites.

The stakes are set by Article 83(5): infringements of the basic principles in Articles 5 and 6 and of the data subjects' rights in Articles 12 to 22 fall in the higher fine tier, up to €20 million or, for an undertaking, up to 4% of total worldwide annual turnover of the preceding financial year, whichever is higher.

Step 6: set freshness and retention per field

Article 5(1)(d) requires personal data to be accurate and kept up to date where necessary, and Article 5(1)(e) limits keeping it in identifiable form to what the purposes require. A technology fact on a person-linked row can be stale without the person's job changing. Give each field an expiry or a re-verification rule tied to its source: a posting-derived signal may age differently from a crawl-derived one. Set each field's re-verification interval from its source's freshness and your own observed outcomes, and document the interval in the ledger.

Article 30 also requires a record of processing activities, with categories of data subjects and personal data, recipients and, where possible, erasure time limits. Your field ledger is a natural input to it.

Step 7: turn the clean row into a sales action

A cleared row is a reason to act, not a stored attribute. Use the account-level technology fact to choose the account and the angle, and put one verified person in front of it.

  1. Select accounts where the technology fact matches your offer, using only the account table.
  2. Pair the fact with a dated signal such as a hire, funding record or expansion. Lead Compass is built for that stage: it reads your website, ICP and intent themes, surfaces opportunity picks, cites public sources where available and generates search prompts. It does not pull contacts until you run a search.
  3. Add one verified person for the role that owns the problem, and write the Article 14 notice into the first message or the process around it.
  4. Say why you are writing in terms of the account ("your team runs X") rather than describing the person's own behavior, and do not use enrichment fields to evaluate the individual.
  5. Record the outcome, including objections, in the suppression record.

For the data side, the best B2B contact database comparison covers where named people come from, and Percepture's guide to using intent data to identify sales qualified leads covers the step from a signal to a qualified conversation. How Lead Seeker works describes how a search returns people with the signal that surfaced them.

A worked example: one account, five rows

Calderwick Systems is invented for this guide, as are the accounts, and no outcome is claimed. It sells endpoint backup software to mid-market manufacturers and has just switched on technographic enrichment.

Record What is stored Identity Link status Decision
Account row for a manufacturer Backup product detected on the domain, last-detected date, vendor confidence, source type Company-only Keep. Use it to choose the account
Same account row Job-posting mention of a competing backup tool, posting date Company-only Keep. Do not store the poster's name
Account row Title and department of a team-page entry, no name Role-linked Keep as context. Do not attach to a person without a basis
Contact row: a named IT director The backup fact copied from the account Person-linked Remove the copy, or treat the whole row under lawful basis, notice and objection rules
Contact row: same person, objected last quarter Reappears in the next enrichment batch Person-linked Suppression record blocks the append before it reaches the CRM

The result is not a larger database. It is a smaller one that keeps the technology fact where it is safe and adds personal data only where a message to a named person needs it.

Where this will not work

  • Fields with no stated source. If a vendor does not describe how a field was derived, you cannot complete the ledger or explain the source in an Article 14 notice.
  • Passive sources with personal inputs. A signal inferred from employee profiles starts from people. Keep the aggregated result and be sure of your vendor's basis for reading the inputs.
  • Small companies and sole traders. A business named after one person, or run by one, may blur the line between company and person. In the UK, PECR already treats sole traders and some partnerships like individuals.
  • Role mailboxes and one-person roles. A title held by one person identifies them in practice, so a role-linked field can become person-linked.
  • Vendor compliance claims. Certifications and "GDPR compliant" labels describe the vendor's own practices. None of the vendor pages reviewed says that using its output makes your outreach lawful.
  • Cross-border sales. This guide uses the Regulation's text and the ICO's UK guidance. National rules on email, phone and notice differ, and the guide does not map each country.

Fact, inference and our view

Statement Type Basis
The GDPR does not cover processing of personal data that concerns legal persons, including their name, form and contact details Fact (regulation) Recital 14
Personal data is information relating to an identified or identifiable natural person Fact (regulation) Article 4(1)
Where data was not obtained from the person, Article 14 sets out the information to give and the timing Fact (regulation) Article 14(1)–(3)
A person can object to direct marketing at any time and the data must then stop being processed for it Fact (regulation) Article 21(2)–(3)
BuiltWith's field list says team-page titles are included without names and emails found on sites are role based Fact (vendor documentation) BuiltWith dataset fields page
6sense reads job postings and people work summaries as passive sources Fact (vendor documentation) 6sense Technographic Data Overview
A company fact stored on a person's row is part of a record about that person Inference Follows from Article 4(1); not a court holding
A vendor's Article 14 notice may not cover your own purposes and identity Inference Follows from the Article text; no vendor page addresses it
Keeping technology facts on the account table reduces the personal data you hold Inference Follows from Article 5(1)(c)
Each field should carry its source, date, verification and confidence Our view This guide's editorial recommendation

Frequently Asked Questions

Is technographic data personal data under GDPR?

On its own, usually not. A technology detected on a company website describes the company, and Recital 14 says the GDPR does not cover processing of personal data that concerns legal persons. It becomes part of a personal-data record when you store it against an identifiable person, such as a row with a name and email. Fields that start from people, like employee profile summaries, need more care.

Do I need consent to enrich contacts with technographic data?

The GDPR does not make consent the only route. Article 6(1)(f) allows legitimate interests where the processing is necessary and the person's rights do not override it, and Recital 47 says direct marketing may be regarded as a legitimate interest. Separate national rules on electronic marketing may require consent for some channels or recipients, such as sole traders in the UK, so check the channel and the country as well as the basis.

Does a vendor's "GDPR compliant" label make my enrichment compliant?

No. The label describes the vendor's own practices. BuiltWith says customers are responsible for lawful use of its data, and a processor agreement such as Clay's names the customer as controller of the personal data processed for it. Ask for the vendor's source description, its role in writing, and its notice and suppression process.

Do I have to tell people their record was enriched?

If you obtained the personal data from somewhere other than the person, Article 14 requires you to give them specified information, including the source, no later than one month after obtaining it, at the first communication if you will contact them, or at first disclosure to another recipient. Article 14(5) lists narrow exceptions, so document your reasoning if you rely on one.

What happens when someone objects and the vendor sends their record again?

For direct marketing, Article 21(3) says the data must no longer be processed for that purpose after an objection. Keep a suppression record you can match against every enrichment batch, so the record is blocked before it reaches your CRM. The vendor's own removal process is separate from your suppression.

How to Read the Tables

The Identity Link Test ranks fields by how closely they attach to a person: Company-only, Role-linked, then Person-linked. "Not described" means the vendor page reviewed does not state that item. "Fact" rows rest on regulation text or vendor documentation, "Inference" rows follow from them, and "Our view" rows are this guide's editorial recommendations. Calderwick Systems and its accounts are invented. Vendor features and dates are an October 2026 snapshot.

Sources

About the Author

Bob Generale is President of Percepture. He works across SEO, AI search, digital PR, sales intelligence and AI-powered revenue systems, with a focus on connecting visibility, buyer intent and sales action.

Next Steps

List the enriched fields your team writes today and mark each Company-only, Role-linked or Person-linked. Move the first two onto the account table, document the lawful basis and notice for the third, and add a suppression check before the next enrichment run. For the wider provider comparison, see the guide to B2B data provider compliance under GDPR and CCPA, the explainer on technographic data for B2B targeting and the comparison of data enrichment platforms for firmographic and technographic detail. If you want verified people added to the accounts you already target, talk to sales or start free with five contacts.