Data compliance for outreach: what a data platform and a sender must do

Procurement and legal teams usually ask one question, whether a tool is compliant, when there are two separate ones: what the platform must do, and what the sender must do. Below: them, links each obligation to its primary text, and ends with the questions a buyer should put to a data vendor. It describes the rules; it does not give legal advice or verdicts on individual campaigns.

Who is responsible for what: platform vs sender?

The platform answers for how data is gathered, stored, sold and deleted, and for the security of its connections to mailboxes. The sender answers for the legal basis of each campaign, for whom it targets, and for honouring objections. A compliant platform does not make a campaign compliant, and the reverse is also true.

Cells with a link name the primary text; the UK platform, UK sender and Czechia platform cells summarise the ICO PECR guidance and ÚOOÚ FAQ linked in section 4. Whether a given business is covered depends on thresholds and facts this table does not assess.

The obligations on this page come from these primary texts: the Delete Act bill text and the CPPA data broker pages for DROP, the California Attorney General's CCPA page, GDPR Article 6 with Recital 47, the EDPB Guidelines 1/2024 on legitimate interest, the ÚOOÚ order of 11 January 2024 for Czechia, and for security audits Google's restricted scope verification and the App Defense Alliance CASA framework.

What does the California Delete Act (DROP) require?

The Delete Act, California SB 362, created the Delete Request and Opt-out Platform, DROP: one place where a California resident can ask every registered data broker to delete their personal information. The California Privacy Protection Agency runs it. DROP is live; brokers registered in the January 2026 window, and from 1 August 2026 each broker must access the platform at least every 45 days and process the deletion requests waiting there. Independent audits of broker compliance start in 2028.

For a buyer, DROP registration is a checkable fact: the CPPA publishes its data broker registry. It sits alongside the CCPA, whose temporary exemptions for business-to-business and employee data expired on 31 December 2022, so B2B contact data is covered like any other personal information.

What does an annual CASA Tier 2 audit cover?

CASA, the Cloud Application Security Assessment, is the App Defense Alliance framework for testing applications against the OWASP Application Security Verification Standard. It is tiered: Tier 1 is a self-assessment against the ASVS checklist, Tier 2 is an assessment of the application by an authorised lab against the same checklist, and Tier 3 adds penetration testing by a lab. The App Defense Alliance publishes the tier definitions.

It matters for outreach tools because of mailbox access. Google requires any application using restricted Gmail scopes, the permissions needed to send and read mail through the official API, to pass verification that includes an annual security assessment under CASA. A sending tool that connects through the official Gmail API is therefore audited every year, and the audit is a condition of keeping that access.

What is the legal basis for B2B outreach in the EU, UK and Czechia?

In the EU, processing a prospect's personal data for outreach usually relies on legitimate interest under GDPR Article 6(1)(f). Recital 47 says processing for direct marketing purposes may be regarded as carried out for a legitimate interest. The EDPB Guidelines 1/2024 set three cumulative conditions: the interest must be legitimate, the processing necessary for it, and the interest not overridden by the person's rights after a balancing test. Narrow, role-relevant targeting is part of what that test weighs.

GDPR covers the data; national e-marketing laws cover the sending. In the UK, electronic marketing falls under PECR alongside UK GDPR, with different rules for individual and corporate subscribers. In Czechia, §7(2) of Act No. 480/2004 Coll. requires prior consent for commercial communications sent by email, with an exception in §7(3) for a seller's existing customers, and the act contains no separate business-to-business exception. In an order of 11 January 2024 (ref. UOOU-05121/23-3), the Czech data protection authority, ÚOOÚ, imposed a fine for a commercial offer sent without consent to a publicly listed company email address, applying §7(2). In the US, CAN-SPAM regulates commercial email content and opt-outs rather than requiring prior consent.

Which questions should a buyer ask a data vendor?

Eight questions cover most vendor reviews. Ask for documents, not assurances.

1. Sources. What kinds of sources does the data come from, and under which legal basis is it processed?
2. Registration. Is the vendor registered as a data broker in California, and does it process DROP requests?
3. CCPA. How does it handle access, deletion and opt-out requests under the CCPA?
4. Deletion. When a person asks for deletion, does it reach every copy, including lists already exported?
5. Security audit. Which independent audit covers the platform, and can the report be shared under NDA?
6. Mailbox access. Does it connect to mailboxes through official APIs or custom SMTP?
7. Processing agreement. Is a data processing agreement available, and where is data stored?
8. Objections. How does an opt-out or objection from one recipient propagate across the platform and future campaigns?

Frequently asked questions

Does GDPR allow B2B cold email?

GDPR governs the processing of the data, and outreach usually relies on legitimate interest under Article 6(1)(f), subject to a balancing test. The sending itself is governed by national e-marketing law, which differs by country; in Czechia, §7(2) of Act No. 480/2004 Coll. makes prior consent the condition for sending commercial email, with an exception for existing customers in §7(3).

What is California's DROP?

The Delete Request and Opt-out Platform created by the Delete Act (SB 362). A California resident can submit one deletion request, and every registered data broker must process it; from 1 August 2026 brokers must check the platform at least every 45 days.

Why does an email tool need a CASA audit?

Google requires applications that use restricted Gmail scopes, needed to send and read mail through the official API, to pass an annual security assessment under CASA. The assessment covers the application's handling of the mailbox data it is given access to.