Compliance Documentation Standard: Defining the LIA and B2B Email Compliance Record Requirements
Compliance documentation is the difference between a defensible position and an enforceable violation when a data protection authority investigates a complaint. This standard defines the minimum documentation requirements for B2B cold email campaigns under GDPR legitimate interest and equivalent frameworks in 44 countries.
A valid Legitimate Interest Assessment must document all three parts: Purpose Test (legitimate interest identified), Necessity Test (minimum processing confirmed), and Balancing Test (controller and data subject interests weighed). Partial LIAs are not compliant.
The source from which contact data was acquired must be documented: provider name, collection methodology, date of acquisition, and the legal basis under which the provider processed and transferred the data.
The opt-out mechanism must be functional, real-time (not batch-processed), and tested before campaign launch. Opt-out links that generate errors, fail to unsubscribe, or delay unsubscribe by more than 24 hours are non-compliant.
All contact lists must be screened against the active suppression list before importing to any sending platform. The screening must occur within 48 hours of sending, not months earlier when the list was originally cleaned.
Every cold email must include either a link to a privacy notice or the privacy notice content directly. The privacy notice must explain the legal basis for processing (legitimate interest), the categories of data processed, the data subjects rights, and how to exercise them.
The Minimum Compliant LIA Structure
A compliant Legitimate Interest Assessment (LIA) for B2B cold email must be a written document (not a mental exercise) containing the following elements. Section 1 — Processing Activity Description: describe in plain language what data is processed, by whom, for what purpose, and using which systems. Example: B2B Data Index processes professional email addresses, job titles, and company names of business professionals employed at companies matching our target ICP, using Instantly (sending platform) to send commercial outreach emails on behalf of [Company Name]. Section 2 — Purpose Test: identify the legitimate interest pursued. Example: Direct marketing of [describe your product/service] to business professionals who have a plausible professional interest in the category based on their professional role and employer type. Section 3 — Necessity Test: confirm that only minimum required data is processed. Example: We process email address and job title only — not personal identifiers, health data, or financial information. The email address is necessary to deliver the commercial communication. The job title is necessary to confirm role relevance. Company name is necessary to confirm employer relevance. Section 4 — Balancing Test: analyse the data subject interests against controller interests. Section 5 — Decision: conclude that legitimate interest is (or is not) applicable with rationale. Section 6 — Review Date: record when the LIA will be reviewed for continued appropriateness.
What Regulatory Authorities Actually Check
ICO (UK) and EDPB (EU) investigations of B2B marketing compliance typically focus on four evidence requirements. First: does the LIA exist and is it specific to the processing activity? Generic template LIAs not customised to the actual processing are treated skeptically. Second: were opt-outs honoured promptly and did the suppression list prevent further contact? Most enforcement actions arise from complaints where opt-outs were not honoured or were delayed. Third: is there evidence that the data was sourced from legitimate professional sources (not personal data purchased from data brokers without clear provenance)? Reputable database providers (including LeadsBlue, which powers B2B Data Index) provide sourcing documentation specifically to support buyer compliance. Fourth: were emails sent to personal email addresses (Gmail, Yahoo, personal domains) rather than corporate addresses? Sending to personal addresses requires a different lawful basis (typically consent) than corporate addresses. Maintaining documentation that demonstrates these four elements provides a defensible position under regulatory scrutiny in all 27 EU member states and the UK.
Record Retention and Maintenance
Compliance records should be retained for a minimum of 3 years from the date of the campaign to which they relate. This covers the typical statute of limitations for GDPR complaints and investigations. Records to retain: the original LIA document with date and signatory; the data source documentation (purchase receipt or contract with the database provider, including their data sourcing description); the list of campaigns run against the dataset with send dates and volumes; suppression list extracts showing opt-outs recorded; and any data subject access requests received and how they were handled. Maintain these records in a compliance folder with version control so that if an investigation occurs, you can demonstrate the state of compliance documentation at the time of each campaign rather than reconstructing records after the fact. The 44-country compliance matrix at B2B Data Index provides jurisdiction-specific requirements for structuring your compliance records.
Apply These Standards
Browse verified B2B databases that meet the B2B Data Index data quality standard. 95%+ deliverability, quarterly verification, full compliance documentation.
Browse Databases → Research Reports →