When a healthcare vendor asks whether a contact list is “GDPR compliant,” they are usually asking a shorter question than the law supports. Compliance is not a property a file can carry on its own. It is the result of what the provider did to collect and maintain the data, and what you do with it once it reaches your systems. A provider can get its half right and you can still get yours wrong.
This guide sets out what buyers of healthcare business contact data should understand before running campaigns into the EU, the UK, North America and other regions: which rules apply to professional contact information, how privacy law differs from electronic marketing law, and what to ask a provider before you sign. It is general information for marketers, not legal advice — for a binding view on your specific campaigns, speak to a qualified data protection adviser.
What GDPR Compliant Email Lists Actually Means
No list is self-certifying. The General Data Protection Regulation (Regulation (EU) 2016/679) regulates the processing of personal data, which means the obligations attach to organizations and activities rather than to files. When a vendor describes a list as GDPR compliant, the claim worth testing is narrower and more concrete:
- The provider can describe where each category of data came from.
- The provider has identified a lawful basis for its own processing and can explain it.
- Individuals have been given the information the regulation requires, in a way that can be evidenced.
- Objection and erasure requests are handled, and suppression carries forward into future deliveries.
- The contract between you and the provider sets out each side’s role and responsibilities.
Everything after delivery — the lawful basis for your campaign, your privacy notice, your retention schedule, your opt-out handling — is yours. No supplier can transfer that to you along with a spreadsheet.
Professional Business Data Is Not Patient Data
This distinction decides which rules you are even in. B2B healthcare contact data describes a person in their professional capacity: name, work email, job title, department, employer, business address. Patient records and consumer health information describe someone’s health, and under GDPR health data is a special category with much stricter conditions for processing.
A legitimate healthcare B2B database contains the first and never the second. If a provider cannot clearly draw that line, or offers anything that looks like patient-derived targeting, that is a reason to walk away rather than a feature. It is also worth noting that work contact details for a named individual are still personal data under GDPR — “it is only a business email” is not an exemption, even though it changes the risk calculus.
The GDPR Concepts That Apply to B2B Prospecting
Lawful Basis
Every processing activity needs a lawful basis. For B2B marketing the realistic candidates are consent and legitimate interests. Legitimate interests is commonly relied on for business-to-business prospecting, but it is conditional rather than automatic: it requires you to identify the interest, show the processing is necessary for it, and balance it against the rights and reasonable expectations of the individual. That balancing test should be written down before the campaign, not reconstructed afterwards if a regulator asks. Note also that your lawful basis and your provider’s lawful basis are separate questions.
Transparency
People are entitled to know that their data is being processed and by whom. Where data was not collected directly from the individual, the regulation requires that information to be provided within a reasonable period. In practice this means your privacy notice must cover prospecting data obtained from third parties, and your first contact should make it easy to find out who you are and how you got in touch.
Purpose Limitation and Data Minimisation
Buy the fields you need for the campaign you are running, not every field on the order form. A list that carries direct dials, revenue bands and bed counts for an email-only campaign is extra personal data you now have to justify, secure and eventually delete. Minimisation is both a legal principle and a practical way to reduce how much of your exposure sits in a CRM nobody audits.
Retention
Prospecting data should not sit in a CRM indefinitely on the theory that it might become useful. Set a retention period tied to the purpose — for example, review and delete non-engaged prospect records after a defined window — and make sure that schedule is actually enforced in the system rather than written in a policy document.
Data Subject Rights
Individuals can ask what you hold, ask for corrections, and object. The right to object to direct marketing is the sharpest of these: the UK regulator states it is “an absolute right and there are no exemptions or grounds for you to refuse,” that you must comply without undue delay and within one month, and that in most cases suppression is preferable to erasure so the preference is honoured in future (ICO). Build the suppression list before the first send, not after the first complaint.
Privacy Law and Electronic Marketing Law Are Different Rules
GDPR dictates if you are allowed to process the data. The other set of rules regarding electronic marketing governs if you have permission to send the message. You need to fulfil both criteria.
Unites Kingdom (PECR)
- You can send emails to corporate entities (companies, LLPs, government entities) without obtaining their consent first.
- Individuals (including sole traders) must get consent or soft opt-in from the person.
- Soft opt-in only applies to the customers who have bought or negotiated the same product, and it cannot be used for the address from the lists or prospective customers.
- Even so, the sender needs to identify himself and provide a valid opt-out option.
United States (CAN-SPAM)
- The sender’s obligation is based on the “opt-out” rule rather than prior consent.
- The sender needs to be truthful in the header and subject lines.
- The email should also state that this is an advert, contain the physical address and an opt-out option.
- An option to opt-out must be honored within 10 days.
- The penalty can be up to $53,088 for each email.
Canada (CASL)
- Generally requires express or implied consent before sending commercial emails.
- Sender identification and an unsubscribe mechanism are mandatory.
- Treat Canada as a consent jurisdiction for multi-region campaigns.
| Region | Primary marketing rule | Consent model for B2B email |
|---|---|---|
|
European Union |
GDPR plus national ePrivacy rules |
Varies by member state; lawful basis required under GDPR in every case |
|
United Kingdom |
UK GDPR plus PECR |
No PECR consent needed for corporate subscribers; consent or soft opt-in for individual subscribers |
|
United States |
CAN-SPAM Act |
Opt-out model; no prior consent required, but identification, postal address and opt-out are mandatory |
|
Canada |
CASL |
Express or implied consent generally required before sending |
Two practical consequences follow. First, a single global sending template is rarely compliant everywhere, because the mandatory elements differ. Second, your segmentation needs to carry country so that sending rules can be applied per region rather than per campaign.
How to Assess a Healthcare Data Provider
Focus on four areas:
- Provenance : Ask for source categories in writing (public registries, business directories, opt-in channels, partner data). Be sceptical of claims that publicly available information can always be used for marketing.
- Verification : Ask what is checked, how often, and what proportion of records changed in the last cycle. Per-record verification dates are more useful than a headline accuracy figure.
- Suppression : Confirm that objections and opt-outs are recorded and that any suppression file you supply is applied to future deliveries.
- Documentation : Look for a published privacy notice, named data protection contact, data processing agreement, and clarity on storage and international transfers.
How MedicoLeads Supports International Healthcare B2B Targeting
MedicoLeads supplies professional contact data for healthcare B2B audiences across multiple regions, with lists built around business attributes such as specialty, job title and function, organization type, facility type and geography. Because sending rules differ by jurisdiction, country-level segmentation is a practical requirement rather than a nice-to-have, and it is worth confirming coverage for your target regions before you buy.
MedicoLeads states on its product pages that its data practices are aligned with GDPR, CCPA, CAN-SPAM and CASL. As with any provider, treat that as a company statement to verify in your own due diligence — ask for the supporting documentation, review the contract, and satisfy yourself that your own campaign-side obligations are covered. You can browse the available healthcare database segments or request a sample drawn from the exact audience you plan to contact.
Conclusion
“GDPR compliant” is a shorthand that hides where the work actually sits. Your provider is responsible for how the data was collected, maintained and documented. You are responsible for the lawful basis of your campaign, your transparency, your retention, your suppression handling, and for meeting the electronic marketing rules of each country you send into. Ask for the provider’s half in writing, build your half before the first send, and keep country in your segmentation so regional rules can be applied properly. For related reading, see our overview of data compliance in B2B marketing.
FAQs
Can a purchased email list ever be GDPR compliant?
A list is not compliant or non-compliant in itself — the processing is. Purchased B2B data can be used lawfully where the provider can evidence its sources and lawful basis, individuals have received the required information, and you establish your own lawful basis and meet the electronic marketing rules for each country. Where the law requires consent for a given recipient type, a bought-in list will not supply it; the UK regulator states explicitly that soft opt-in does not cover bought-in lists.
Does GDPR apply to business email addresses?
Yes, where the address identifies an individual. A named work address such as first.last@hospital.org is personal data and the regulation applies, even though the context is professional. A genuinely generic address such as info@ or procurement@ that identifies no individual generally falls outside it. The professional context affects the balancing test for legitimate interests, but it does not remove the obligations.
Is legitimate interest enough for B2B healthcare prospecting?
It can be the lawful basis for processing, but it is conditional. You must identify the interest, show the processing is necessary, and balance it against the individual’s rights and reasonable expectations, documenting the assessment before you send. It also does not override separate electronic marketing rules — in a jurisdiction that requires consent to send the message, a legitimate interests assessment does not substitute for it.
What is the difference between GDPR and PECR?
GDPR governs whether you may process personal data at all and on what basis. PECR governs electronic marketing messages specifically in the UK, including when consent is needed to send. They operate together: you can have a valid lawful basis under GDPR and still breach PECR by sending to an individual subscriber without consent. Both must be satisfied.
Do US and Canadian rules change how I should run an EU campaign?
They change how you should run the US and Canadian portions of it. CAN-SPAM is opt-out based and requires identification, a valid postal address and a working opt-out honoured within 10 business days. CASL generally requires express or implied consent before sending. Because the mandatory elements differ, segment by country and apply each region’s rules rather than using one global template.
How should suppression and opt-outs be handled across providers?
Maintain one authoritative global suppression list on your side and run every new file against it before import, regardless of which provider supplied it. Ask each provider to apply that file to future deliveries and to tell you how it handles objections received directly. Suppress rather than delete, so the preference survives the next list you buy.
What documentation should I keep for a prospecting campaign?
Keep your lawful basis and legitimate interests assessment, the version of the privacy notice in force at the time, the provider contract and its description of sources and verification, the suppression file applied, the sending list by country, and a record of any data subject requests and how they were handled. If a regulator asks, these are what turn a reasonable approach into an evidenced one.
Can publicly available business contact information be used freely for marketing?
No. Public availability is not permission. Information scraped or collected from a public source is still personal data where it identifies an individual, so a lawful basis, transparency obligations and data subject rights all still apply, and the relevant electronic marketing rules still govern whether you may send. Treat “it was public” as a sourcing note, not a legal justification.