Best practices for professional outreach without personal data

Can professional outreach use no personal data?

Not entirely. Under the EU and UK GDPR, personal data is any information about an identifiable person, and a named work address usually qualifies. A one-to-one business email therefore always involves some personal data. The useful goal is data minimisation: Article 5(1)(c) of the GDPR asks that personal data be adequate, relevant and limited to what is necessary for the purpose.

In practice, a good outreach message needs far less than most lead lists contain. If the email only says who you are, why the recipient's role is relevant and what you are asking, you need an address, a name to greet and the company. Everything beyond that should earn its place.

Which contact fields do you actually need?

Followkite stores email, first name, last name, company and title on each contact, plus any custom fields a workspace defines. A placeholder can carry a fallback, such as {{first_name|there}}, so you do not need to collect a name just to avoid an empty greeting. A placeholder without a value or fallback holds that contact back as missing data instead of sending a broken message.

What data should you leave out?

Leave out anything the message does not use, and be strictest with information people would not expect a stranger to hold:

• Special category data. Health, religion, political opinions, sexual orientation, ethnicity and trade-union membership have extra protection under GDPR Article 9. Never infer or store them for outreach.
• Private contact details. Personal addresses and phone numbers are not needed for a work email.
• Personal-life notes. Family, holidays, hobbies or anything taken from a private profile.
• Inferred traits. Guesses about age, income or personality from photos or browsing.
• Fields "for later". If no message or report uses a column, do not import it.

The same principle applies to the copy itself. A sentence such as "I saw your recent post about your move to Lisbon" reveals that you studied someone's personal life. "Your team is hiring two data engineers" refers to a public business fact and gives a real reason to write.

How do you run a data-minimised outreach workflow?

1. Write down the purpose. One sentence: who you are contacting and why it is relevant to their role. This decides which fields are necessary.
2. Choose sources that publish business contact details. Prefer company websites, business directories and contacts who gave you their card. Record the source per list.
3. Strip the export before importing. Delete unused columns in the spreadsheet so they never reach your outreach tool.
4. Verify and deduplicate. Remove invalid domains, typos and disposable addresses before sending. See what email verification checks.
5. Write the message from business facts only. Use the role, company and a public business reason. Keep the request small.
6. Include an easy opt-out. Add a working unsubscribe link and honour plain "please stop" replies too.
7. Delete what you no longer need. Set a review date for each list. Remove contacts who never replied once the campaign is over, keeping only the do-not-contact entry.

How should you explain where you found someone?

When you collect data from somewhere other than the person, GDPR Article 14 requires you to tell them certain things, including who you are and where the data came from. If you use the data to communicate with them, this must happen at the latest at the first communication. A short line in the first email covers the core of it and links to your privacy notice for the rest:

I found your address on [company website / directory]. We only keep your
name, work email and company for this conversation. Our privacy notice:
[link]. If you would rather not hear from us, reply "stop" or use the
unsubscribe link and we will not contact you again.

In the UK, the ICO's direct marketing guidance explains how GDPR and the PECR rules apply to business email, including the different treatment of sole traders. In the United States, commercial email must identify the sender, include a postal address and offer a working opt-out under the FTC's CAN-SPAM guidance.

What should happen when someone objects?

Stop at once and do not ask them to justify it. Under GDPR Article 21(3), when someone objects to direct marketing, their data must no longer be used for it. Keep only the minimum needed to make sure you never contact them again: the address and the reason.

Followkite handles this with a workspace suppression list that is kept apart from contact records. An unsubscribe or a hard bounce adds the address permanently, and teammates can add a manual do-not-contact entry or block a whole domain. Every queued follow-up checks the list before sending. Deleting a custom field removes it from every contact in the workspace, and contacts can be deleted individually or in bulk once a campaign has ended.

Data minimisation also helps the campaign. A short list built for one clear purpose is easier to verify, personalise honestly and keep below sensible daily sending limits.