Dievio
Key points
- Assess applicable scope and the specific processing purpose.
- Separate lawful basis, communication rules and security assurance.
- Assign owners for sources, rights requests and connected-system handling.
B2B data privacy requires a documented decision about the people, data, purpose and communications involved. A vendor's access to contact details does not automatically establish your basis to process them or permission for a particular campaign.
Build the review into sourcing, activation and ongoing handling. Keep legal applicability, technical validation and security assurance as separate questions.
Map the processing before choosing a legal label
Record the organisations and people involved, relevant locations, data categories, collection sources, intended use and destinations. Include exports, contractors and connected campaign systems.
Assess territorial and material scope under the applicable law. The European Commission explains GDPR applicability through EU establishment and relevant offering or monitoring activities involving people in the EU; it is not simply “every company anywhere with an EU resident's contact.” See the Commission's applicability guidance.
A person's business contact details can still be personal data. Do not treat a corporate address or professional job title as a universal privacy exemption.
Separate processing basis from channel rules
Where GDPR applies, identify and document an appropriate lawful basis for the particular processing. Consent and legitimate interests are not interchangeable labels or the only possible bases; legitimate interests requires the applicable assessment and is not a blanket permission for cold outreach.
Marketing rules can impose a separate requirement. UK ICO guidance distinguishes electronic-mail rules for corporate and individual subscribers, while personal-data duties still apply where relevant. Sole traders and some partnerships are treated differently from incorporated companies.
Use the current ICO B2B marketing guidance for that UK distinction. Check the relevant jurisdiction's rules rather than applying it worldwide.
Do not rely on the old California B2B exemption
California's Attorney General states that the specified employee and business-to-business personal-information exemptions expired on December 31, 2022. Assess whether the business, data and activity fall within the CCPA and any specific exception.
That is different from saying every business everywhere has identical obligations. Consult the official CCPA guidance for scope, rights and applicable exceptions.
Keep security assurance in its proper role
SOC 2 concerns assurance reporting on controls within an engagement's scope. It is not a privacy statute, a list-level approval or permission to send marketing.
Review the actual report, covered system, period, exceptions and relevant responsibilities where available. The AICPA SOC overview explains the assurance service; a badge alone does not answer your data-use questions.
Build a review record the team can operate
| Decision | Record | Owner |
|---|---|---|
| Purpose and scope | People, data categories, source and intended use | Campaign and data owner |
| Applicability and basis | The relevant assessment and unresolved questions | Responsible privacy or legal reviewer |
| Communication route | Channel, subscriber context and required handling | Campaign owner with the appropriate review |
| Vendor relationship | Actual roles, terms and necessary contractual arrangements | Procurement and data owner |
| Ongoing handling | Access, retention, rights requests and stop decisions | Named operational owners |
Determine controller, processor or other relevant roles from what the parties actually do. Buying data does not automatically make the seller your processor, and a generic DPA does not resolve every use.
Make objections and corrections reach connected systems
- Receive the request through an accountable process.
- Identify the relevant person and records under appropriate procedures.
- Apply the applicable decision and required time limits.
- Propagate relevant stop, correction or deletion instructions to connected systems.
- Keep a proportionate record of the action and unresolved exceptions.
Do not assume one retention period, response deadline or breach-notification clock applies to every jurisdiction and incident. Assign those decisions to the responsible review process.
Keep contact quality separate from permission
A syntax check, available email or successful lookup does not establish consent, a lawful basis or inbox placement. Dievio supplies documented retrieval and lookup operations; campaign approval and governance remain part of your workflow.
Use the contact-evidence guide for technical checks and the broader compliance workflow for the source-to-campaign review.
