In short
In Europe, coverage is the easy part — defensibility is the hard part. Work emails and (especially) personal mobiles are personal data under GDPR, so the question isn't just "can this tool find the number?" but "how was it sourced, on what lawful basis, and can the person exercise their rights?"
The cleanest stories are algorithmic, no-database enrichment (Dropcontact) and documented legitimate-interest models that actually send Article 14 notices (Cognism). Scraped or address-book-"contributed" data is the riskiest. Below: the real GDPR challenges, then how each of eight providers handles them.
This is practitioner-level guidance, not legal advice. GDPR turns on your specific facts — your markets, your data, your outreach. Run anything material past your DPO or counsel.
If your buyers are in the UK, France, DACH, the Nordics, or Benelux, US-built databases let you down twice: thinner coverage, and a sourcing story that's harder to defend to a European data protection officer. The second problem is the one that gets companies into trouble. A tool that returns a mobile number is useless to you if you can't explain, when challenged, where that number came from and why you're allowed to process it.
So this guide is organised around compliance. First, the GDPR challenges that every B2B enrichment buyer in Europe runs into. Then a provider-by-provider read on how eight tools handle those challenges — sourcing, lawful basis, transparency, certifications — alongside the practical email and mobile coverage you're buying.
Why GDPR is the hard part of European enrichment
None of the following is exotic. It's the baseline that any team buying contact data into the EU/UK has to reckon with — and most of it is invisible until a regulator, a prospect, or an enterprise procurement team asks.
- Work contacts are personal data. A name tied to a work email, a job title, and above all a personal mobile number are all personal data under the GDPR. "It's just business information" is not a defence — the regulation applies the moment data relates to an identifiable person.
- You need a lawful basis — in practice, legitimate interest. Cold outreach can't realistically run on consent, so almost everyone relies on legitimate interests (Article 6(1)(f), with Recital 47 acknowledging direct marketing can qualify). That basis is only valid if you've actually done — and can show — a balancing test (a Legitimate Interest Assessment). The vendor's basis and yours are separate; both have to hold.
- Article 14 is the obligation everyone forgets. When you obtain someone's data from a source other than the person — which is exactly what enrichment is — you generally must tell them within about a month: who you are, what you hold, and how to object. Almost nobody does this; the serious vendors (Cognism) actually send Article 14 notifications on your behalf or their own.
- The right to object is absolute for marketing. Anyone can tell you to stop processing their data for direct marketing and you must comply immediately (Article 21(2)), plus honour access and erasure requests (Articles 15 and 17). Your provider needs working opt-out and suppression mechanics — and so do you.
- Sourcing decides your exposure. Data scraped from public profiles or "contributed" by users who shared their address books carries consent risk for the third parties who never agreed to anything. Licensed data, public-register data, and algorithmically generated data are far easier to stand behind.
- ePrivacy / PECR sits on top of GDPR. Electronic marketing has its own rules. Cold email treatment differs for corporate addresses versus individuals and sole traders, and live cold calls must be screened against national do-not-call registries — the UK's TPS/CTPS, France's Bloctel, and equivalents — unless you have consent.
- Where the data is processed matters. Post-Schrems II, EU/UK data residency, a proper Data Processing Agreement, and a published sub-processor list are table stakes for enterprise buyers. Ask where records are stored and transferred.
- A waterfall multiplies the chain. An aggregator is only as defensible as its weakest sub-processor — when you enrich through a 20-or-40-provider cascade, you inherit the provenance of every source that supplies a field. Demand the source list.
- Minimise and expire. Enrich only the fields you'll use, purge on objection, and don't hoard data "just in case." Data minimisation and retention limits are obligations, not nice-to-haves.
How the eight providers compare on compliance
| Provider | Data sourcing | Lawful basis / role | DNC screening | Audit / certs | Mobiles |
|---|---|---|---|---|---|
| Targetwise | Licensed + public business signals | Processor on your data + LI | Per your process | UK ICO-registered | Yes |
| Cognism | Fused public + licensed sources | Legitimate interest, Art. 14 | 13+ territories | ISO 27001/27701, SOC 2 | Phone-verified |
| Lusha | Community-contributed + public | Legitimate interest | Limited | ISO 27701, SOC 2 | Strong dials |
| Dropcontact | No database (algorithmic) | Processor, EU servers | n/a (email-led) | CNIL-audited | Landline only |
| Kaspr | Public + 150+ partner sources | GDPR/CCPA aligned | Limited | GDPR/CCPA aligned | EU strong |
| FullEnrich | Aggregator, 20+ vendors | Aligned; no data stored | Via sources | SOC 2 Type II | Yes |
| Prospeo | Proprietary database | States GDPR compliance | Limited | GDPR stated | Yes |
| Zeliq | Aggregator, 40+ providers | GDPR compliant | Via sources | GDPR stated | Credit-heavy |
The pattern: the providers with the strongest, most documented compliance posture (Dropcontact, Cognism) are also the most specific about how they source and how you exercise rights. Aggregators (FullEnrich, Zeliq) and database tools (Prospeo) require you to verify the chain yourself. Now the detail.
Targetwise
pay-per-match · API-nativeLicensed, business-only sourcing with a validation layer — a defensible data feed you pay for by result.
Targetwise appends and validates business emails and mobiles against records you already hold, running a waterfall across 20+ vendors behind one endpoint and charging only on a verified match. On the compliance side, the relevant points are that it sources from licensed third-party providers and public business signals rather than scraping, returns business contacts only (no personal webmail), and is registered with the UK ICO. Because you bring the list, it largely operates as a processor enriching your data — which keeps your own lawful basis and outreach rules firmly in the picture.
- SourcingLicensed third-party data plus public business signals; no scraping; business contacts only.
- Transparency & rightsYou remain controller of your list and own the Article 14 / objection duties to your prospects; confirm the vendor DPA and sub-processor list for your records.
- CertificationsUK ICO-registered. Verify current DPA terms and data residency directly before regulated use.
- PracticalBusiness email + mobile via the waterfall; pay-per-match, no seats, no contract, credits never expire.
For how multi-vendor cascades work under the hood, see our explainer on enrichment for AI agents; for phone-data accuracy specifically, this breakdown goes deeper.
Cognism
GDPR-first · EMEA benchmarkThe most thoroughly documented GDPR posture in the category, paired with human-verified mobiles.
Cognism treats GDPR as a product feature rather than a policy page, and it shows. It uses legitimate interest as its lawful basis, backed by documented Privacy and Legitimate Interest Assessments; it sends Article 14 notifications to data subjects and supports access/opt-out requests; and it screens contacts against do-not-call lists across 13+ territories — the cold-calling control most rivals lack. The certification stack (ISO 27001, ISO 27701, SOC 2 Type II, UK ICO registration) is what enterprise procurement wants to see. On top of that sits Diamond Data, its human phone-verified mobiles.
- SourcingA data-fusion engine stitches public sources, registries and validated third-party vendors into verified records.
- Transparency & rightsArticle 14 notices, DSAR/opt-out handling, consent and opt-out metadata it can push to your CRM.
- CertificationsISO 27001 + 27701, SOC 2 Type II, UK ICO; DNC screening across 13+ jurisdictions.
- PracticalPhone-verified mobiles (~3× connect), strong UK/DACH/Nordics email; quote-based annual contracts (buyers cite from ~$15k/yr).
Lusha
certified · community-sourcedStrong certifications on every tier — but the sourcing model is the kind GDPR-focused buyers scrutinise.
Lusha is the fast SMB lookup tool, and on paper its compliance credentials are good: GDPR, CCPA, SOC 2 Type II and ISO 27701 across all plans, including free, plus opt-out support. The tension is the sourcing. A meaningful share of its data comes from a community-contributed model — users sharing contacts — alongside public data, and that's precisely the approach that draws the most GDPR scrutiny, because the people in those shared contact lists never consented. The certifications are real; the question a careful DPO asks is about provenance, not paperwork.
- SourcingCommunity-contributed contacts plus public sources — the most-questioned model of the eight.
- Transparency & rightsOpt-out and data-subject request handling; standard privacy notices.
- CertificationsGDPR/CCPA, SOC 2 Type II, ISO 27701 on every tier — a genuine procurement strength.
- PracticalStrong direct dials, patchier email coverage; per-seat + credits, 25-contact bulk cap on lower tiers.
Dropcontact
CNIL-audited · zero-databaseThe cleanest GDPR story in the market: no stored database at all, independently audited by France's CNIL.
Dropcontact's entire architecture is a GDPR answer. It stores no contact database — proprietary algorithms generate and verify a professional email in real time from a name and company, and nothing is retained after processing. It runs on EU servers, acts as a data processor on your behalf, handles B2B data only, and is the only enrichment vendor independently audited by the CNIL, France's notably strict regulator, with access to its servers and source code. For a DPO, this is about as low-friction as enrichment gets. The catch is scope.
- SourcingAlgorithmic generation, no stored or resold data; results computed on demand and returned.
- Transparency & rightsMinimisation by design — nothing is kept, so there's no database to subject to access or erasure; it processes only what you send.
- CertificationsCNIL audit (servers + source code), EU data residency, privacy-by-design.
- Practical~98% email validity on standard domains, ~55–70% overall match; rich French legal data (SIREN/NAF/VAT); €79–120/mo, pay-on-success, API + MCP.
A defensible data layer for EU email + mobile
Targetwise sources from licensed providers (no scraping), returns business contacts only, waterfalls 20+ vendors, and charges only on a verified match. UK ICO-registered, no contract, credits don't expire.
Kaspr
LinkedIn · GDPR-alignedLinkedIn-based reveals with European data partnerships and an aligned (not audited) posture.
Kaspr reveals emails and phone numbers directly on LinkedIn profiles, drawing real-time data from 150+ partner sources with strong European coverage. It positions itself as GDPR and CCPA aligned and sources what it describes as public and compliant B2B data. That's a reasonable posture for a self-serve tool, but "aligned" is a lighter claim than Cognism's documented Article 14 program or Dropcontact's CNIL audit — and a LinkedIn-centric reveal model raises the usual questions about profile data.
- SourcingPublic profile data plus 150+ partner networks; real-time lookup rather than a static export.
- Transparency & rightsGDPR/CCPA-aligned handling and opt-out; less public detail on lawful-basis documentation.
- CertificationsStates GDPR/CCPA alignment; confirm DPA and sub-processor specifics for regulated use.
- Practical200M+ EU profiles, strong EU phone, unlimited B2B emails on paid plans; €45–79/mo, three credit pools.
FullEnrich
aggregator · SOC 2A waterfall that took compliance seriously enough to drop its own LinkedIn extension — but you inherit the chain.
FullEnrich cascades email and mobile lookups across 20+ premium vendors. On compliance, two things stand out: it's GDPR/CCPA-aligned and SOC 2 Type II, it doesn't store contact information, and it deliberately removed its LinkedIn extension to stay on the right side of compliance — a signal it takes the question seriously. The structural caveat is inherent to aggregation: your defensibility is the sum of its sub-processors, so the source list is the document that matters.
- SourcingWaterfall across 20+ third-party vendors; doesn't retain contact data itself.
- Transparency & rightsAligned handling; because it aggregates, your rights story depends on each underlying provider — request the list.
- CertificationsSOC 2 Type II, GDPR/CCPA-aligned; removed LinkedIn extension for compliance.
- Practical80%+ find rate, triple email verification, only charges for mobiles (landlines free); from ~$29/mo, pay-on-success, credits roll over.
Prospeo
email finder · self-serveAccurate, developer-friendly email finding — with the lightest documented compliance story of the group.
Prospeo is a French email finder and enrichment API built around accuracy and a fast 7-day refresh. It states GDPR compliance and runs a multi-step email verification process, which is good for deliverability. But its public compliance documentation is lighter than the leaders' — there's less detail on lawful basis, Article 14, and sub-processors — so for regulated EU use you'll want to do more of the diligence yourself.
- SourcingProprietary contact database (vendor cites 300M+ profiles) with a 5-step verification layer.
- Transparency & rightsStates GDPR compliance; confirm DPA, lawful-basis documentation and opt-out mechanics directly.
- CertificationsGDPR stated; lighter public certification footprint than Cognism/Dropcontact.
- PracticalMarkets 98% email accuracy (independent tests land nearer ~68%, lower in bulk), mobiles available; ~$0.01/email, free tier.
Zeliq
all-in-one · aggregatorAll-in-one prospecting with a 40+ provider waterfall — same inherited-chain caveat, bigger surface area.
Zeliq bundles a 450M+ contact database, waterfall enrichment across 40+ providers, and multichannel outreach in one workspace. It's GDPR-compliant by design and draws from verified providers, consuming credits only on a verified match. As with any aggregator, the breadth of sources is both the coverage advantage and the compliance homework — 40+ providers is a longer chain to stand behind than a single licensed source.
- SourcingAggregates 40+ data providers plus its own database; pays only for verified data.
- Transparency & rightsStates GDPR compliance and verified-provider sourcing; request the provider list and DPA.
- CertificationsGDPR stated; confirm specifics for regulated markets.
- PracticalUp to ~80% email / ~60% phone reach; from ~$59/user/mo, but mobile lookups burn credits ~10× faster than email.
Choosing, compliance-first
- Can you defend the sourcing to a DPO? Algorithmic (Dropcontact) and documented legitimate-interest (Cognism) models are easiest to stand behind. If a vendor is vague on "how did you collect this?", treat that as the answer.
- Email-led or phone-led? Phone-led into the EU means weighting verified mobiles and DNC screening (Cognism), or a waterfall that cross-checks numbers. Email-only? A single audited source can be both cleaner and cheaper.
- Data layer or platform? If you already run a CRM and sequencer, a processor-style data layer (Targetwise, Dropcontact, FullEnrich) keeps your compliance surface smaller than an all-in-one.
- Get the sub-processor list — especially for aggregators. With FullEnrich or Zeliq, the source list is the compliance document. No list, no deal.
- Match pricing to volume. Pay-per-match / pay-on-success suits spiky or list-based work and aligns cost with usable data; per-seat suits steady per-rep lookups. Mind the per-mobile credit multiplier.
A European compliance toolkit
Two things you can use immediately: a country-by-country read on telephone do-not-call regimes for B2B calling, and a plain-language Article 14 notice you can adapt for first contact.
Do-not-call regimes for B2B calling, by country
Cold-calling rules differ sharply across Europe, and several markets are shifting from opt-out registries toward opt-in consent. The most consequential change: from 11 August 2026, France abolishes Bloctel and moves consumer prospecting to explicit opt-in consent. The table below reflects the position for business calling.
| Country | Telephone DNC regime | What it means for B2B calls |
|---|---|---|
| United Kingdom | TPS (individuals/sole traders) + CTPS (businesses) — opt-out | You must screen business numbers against CTPS; live B2B calls are otherwise permitted under legitimate interest if the number isn't registered and the person hasn't objected. |
| Ireland | National Directory Database (NDD) — opt-out | Screen against the NDD opt-out register; rely on legitimate interest with a clear opt-out. |
| France | Bloctel (opt-out) until 10 Aug 2026 → opt-in consent for consumers from 11 Aug 2026 | B2B prospecting can still rest on legitimate interest, but consumer (B2C) calling needs prior explicit consent once Bloctel closes — and 06/07 mobile prospecting is restricted. |
| Germany | No national registry | B2C needs express prior consent; B2B requires documented "presumed consent" (UWG §7) aligned to the recipient's role. Keep your own suppression list — public listing isn't consent. |
| Spain | Lista Robinson — opt-out | Screen against Robinson; calls to individuals generally need consent or a documented legitimate-interest basis under the 2022 telecoms law. |
| Italy | Registro Pubblico delle Opposizioni (RPO) — opt-out, incl. mobiles | Screen against the RPO; one of the stricter regimes, with mobile numbers covered. |
| Netherlands | Consumer opt-in (since 2021); B2B opt-out | Consumer calls require consent; B2B calling is permitted with a respected opt-out. |
Directional summary of ePrivacy/telemarketing rules, not GDPR itself, and not legal advice — regimes change (France is the live example). Confirm the current position for each market you dial. A provider that screens DNC across territories (Cognism covers 13+) reduces this burden, but the obligation ultimately sits with you.
An Article 14 notice you can adapt
Because enrichment is indirect collection, you generally owe contacts an Article 14 notice — usually within a month, and at the latest on first contact. Here's a compact version you can drop into a first-touch email or privacy page and tailor with your DPO:
Article 14 notice — template
[Company] is contacting you because we believe is relevant to your professional role. We obtained your business contact details from [a licensed B2B data provider / public business sources], and we process them on the basis of our legitimate interest in B2B marketing (Article 6(1)(f) GDPR).
You have the right to access, correct or erase your data, to restrict or object to this processing, and to complain to your data protection authority. We keep this data only as long as needed for this purpose.
To stop hearing from us, reply "unsubscribe" or email [privacy@company.com] and we'll remove you immediately. Full details: [privacy notice link].
That covers the Article 14 essentials — who you are, why you're processing, your lawful basis, the source of the data, the recipient's rights, and a working opt-out. For a full privacy notice, add your data protection officer's contact (if you have one), specific retention periods, and any international-transfer detail. This is a starting point, not legal advice.
Get verified EU email + mobile — your way
Enrich a list in bulk, wire up the REST API or MCP server, or run lookups from your dashboard. Licensed sourcing, multi-vendor waterfall, pay only on a match.
Frequently asked questions
Is buying B2B contact data even legal under GDPR?
Yes, processing B2B contact data can be lawful — but only if you have a valid lawful basis and meet your transparency duties. Most teams rely on legitimate interest (Article 6(1)(f), with Recital 47 recognising direct marketing as a possible legitimate interest), supported by a documented balancing test. You also have to handle Article 14 notifications and honour objections. The data being "business" data doesn't exempt it; the obligations still apply. This is general information, not legal advice — confirm your position with your DPO.
What lawful basis do enrichment providers use?
Almost universally, legitimate interest. Cognism, for example, documents this explicitly with Privacy and Legitimate Interest Assessments. Dropcontact sidesteps much of the question by storing no database and acting as a processor on your data. Whatever the vendor's basis, you as the controller need your own basis for your outreach — the two are separate, and both must hold up.
What is the Article 14 obligation and who handles it?
Article 14 requires that, when you obtain someone's personal data from a source other than the individual, you inform them — typically within a month — about who you are, what data you hold, and their rights. Enrichment is exactly this kind of indirect collection, so the obligation is triggered. Most senders ignore it; the more rigorous vendors (Cognism) send Article 14 notifications. Even so, the controller obligation is ultimately yours, so build it into your process.
Which provider has the most defensible GDPR sourcing?
Two stand out. Dropcontact stores no contact database at all — it generates and verifies emails algorithmically and is independently audited by France's CNIL, which makes it the easiest to defend. Cognism is the strongest among database providers: documented legitimate interest, Article 14 notices, DSAR handling, DNC screening across 13+ territories, and ISO 27001/27701 plus SOC 2 Type II. Community-sourced models (Lusha) attract the most scrutiny.
Can someone ask to be deleted from this data, and what then?
Yes. Individuals can object to direct-marketing processing (an absolute right under Article 21(2)) and can request access or erasure. Your provider needs working opt-out and suppression mechanics, and so do you. Tools that store no database (Dropcontact) have less to erase by design; database and aggregator providers should be able to suppress a record across their sources. Confirm how each vendor processes objections before you rely on it.
Is scraping LinkedIn or contributing contacts compliant?
These are the higher-risk models. Scraping public profiles is legally contested, and "community-contributed" data — where users share their address books — raises consent questions for the third parties who never agreed. They can still come with certifications, but provenance is what a careful DPO probes. Licensed, public-register, and algorithmically generated data are easier to stand behind. If a vendor won't explain exactly how a record was sourced, treat that as a red flag.
What are the rules for cold calling and emailing in the EU?
ePrivacy rules (and the UK's PECR) sit on top of GDPR. For cold email, treatment differs between corporate addresses and individuals or sole traders, and recipients always retain the right to opt out. For live cold calls, you generally must screen against national do-not-call registries — the UK's TPS/CTPS, France's Bloctel, German equivalents — unless you have consent. A provider that offers DNC screening across your dial markets (Cognism screens 13+ territories) reduces that burden.
Does it matter where the provider stores or processes data?
Yes. Post-Schrems II, EU/UK data residency, a proper Data Processing Agreement, and a published sub-processor list matter — particularly for enterprise buyers and regulated sectors. Dropcontact processes on EU servers and stores nothing; others vary. Ask where records are held and transferred, and get the DPA in writing before integrating.
How do waterfall / aggregator tools affect compliance?
A waterfall queries many providers in sequence, which lifts coverage but lengthens your compliance chain — you inherit the provenance of every source that supplies a field, so your defensibility is set by the weakest link. FullEnrich (20+ vendors) and Zeliq (40+) are powerful for coverage but make the sub-processor list essential reading. Targetwise runs a waterfall over licensed sources and bills only on a match; the architecture is covered in our enrichment-for-AI-agents guide.
What should I ask a vendor before signing for European use?
Five things: (1) your lawful basis and whether they document a Legitimate Interest Assessment; (2) exactly how each record is sourced; (3) whether they send Article 14 notices and how they handle objections and DSARs; (4) DNC screening for the countries you dial, plus EU data residency; and (5) the DPA and full sub-processor list. Specific answers to all five mean you can proceed; vagueness on any is your signal to walk. For what providers charge, see our pricing breakdown.
