Is it legal to use public business data for prospecting?

In most markets, contacting businesses at their published business contacts is lawful when you follow the local rules: a lawful basis and a notice under the GDPR, an opt-out and a postal address under CAN-SPAM, and consent rules for individuals and sole traders under laws such as the UK PECR. “Public” does not mean “free of rules”. This guide is not legal advice.

How quickly does B2B contact data go stale?

Continuously: businesses move, close, change numbers and rebuild websites, and people change jobs. That is why a list scraped when you need it beats one bought months ago, and why checking the website and verifying the email before sending matters.

What is the difference between a business contact and personal data?

An info@ address on a company website is business contact data, but a named person’s work email is still personal data under the GDPR and the UAE PDPL. Treat named contacts with the same care as any personal data: a lawful basis, a notice, and an easy way to object.

Prospecting with public business data, responsibly

Most small and mid-sized businesses publish everything a salesperson needs: a listing with a phone number, a website with an email, a WhatsApp link. Prospecting from that public footprint is fast and cheap. Done carelessly, it is also how lists go stale and senders get blocked. Here is how to do it well.

Guide · By LeadMind AI (how we source and check data) · Updated 25 September 2026

Start free Watch the demo

What counts as public business data

Business listings: map platforms such as Google Maps, where businesses publish their category, phone, website, address and hours.
Directories: industry and regional directories such as Yellow Pages, trade associations and chambers of commerce.
The company’s own website: contact pages, footers, careers pages, and the tools the site runs on.
Official registers: company and trade-licence registers confirm that a business exists, though they rarely list contacts.
Public profiles: company pages and public professional profiles. Use them to fill gaps, not as your primary source.

Match the source to the market

No single source covers everything. Map listings are strongest for local businesses (clinics, salons, trades, restaurants, agencies) almost everywhere; directories add depth in North America; websites are the only place to learn how a business actually operates. LeadMind scores its sources per request and shows you which one ran; see live lead sourcing.

Freshness beats volume

Scrape when you are ready to reach out, not months before.
Visit the website: a dead site, a changed number or a “we have moved” banner are the cheapest disqualifiers there are.
Verify emails right before a send, and treat catch-all results as uncertain (why).
Deduplicate against what you already contacted so nobody gets the same pitch twice.

Check a list before you trust it

Open 20 random rows. Does each business match the category and location you asked for?
Click five websites. Are they live and the same business?
Look at where each email came from: published on the site, taken from a listing, or guessed from a naming pattern.
Check the bottom of a scored list; if low scores are mostly the wrong category, tighten the prompt.

Compliance basics

EU and UK (GDPR): B2B prospecting usually relies on legitimate interest, which needs a balancing test, a privacy notice (at the latest in your first message) and an unconditional right to object to direct marketing.
UK (PECR): marketing emails to limited companies and LLPs do not need prior consent but must identify you and offer an opt-out; sole traders and some partnerships are treated as individuals.
US (CAN-SPAM): accurate headers and subject lines, your postal address, a working opt-out honoured within 10 business days.
UAE (PDPL): the Personal Data Protection Law applies on the mainland; DIFC and ADGM have their own data-protection laws. See the UAE guide.
Everywhere: respect robots.txt and opt-outs, collect business data only, and keep a suppression list.

This is general information, not legal advice. LeadMind’s own approach, including its crawler rules, retention and opt-out process, is on the data practices page.

Frequently asked questions

Is it legal to use public business data for prospecting?: In most markets, contacting businesses at their published business contacts is lawful when you follow the local rules: a lawful basis and a notice under the GDPR, an opt-out and a postal address under CAN-SPAM, and consent rules for individuals and sole traders under laws such as the UK PECR. “Public” does not mean “free of rules”. This guide is not legal advice.
How quickly does B2B contact data go stale?: Continuously: businesses move, close, change numbers and rebuild websites, and people change jobs. That is why a list scraped when you need it beats one bought months ago, and why checking the website and verifying the email before sending matters.
What is the difference between a business contact and personal data?: An info@ address on a company website is business contact data, but a named person’s work email is still personal data under the GDPR and the UAE PDPL. Treat named contacts with the same care as any personal data: a lawful basis, a notice, and an easy way to object.