The Privacy Rules That Apply To Your Leads

Most privacy work gets done at the top of the website and stops at the cookie banner. The regulated asset sits further down the funnel: the names, numbers and email addresses your marketing collects, and the handful of suppliers quietly holding a copy of them. Growth Bully, a Malta performance marketing agency, runs lead generation across several EU markets, and this is the gap that shows up almost every time.

What follows is a planning checklist for the marketing side of data protection, not legal advice. The measurement half of the subject, consent mode and what the banner did to your reporting, is handled separately in tracking after the consent banner.

What counts as personal data in your marketing?

Anything that identifies a person, on its own or in combination with something else you hold. A name and an email, obviously. Also a phone number on a call log, an address in a quote request, a recorded sales call, a chat thread, and the free text note a salesperson typed about someone after meeting them.

That last category is the one businesses forget. Opinion written about a named person is their data too, and they are entitled to see it. A CRM note that reads badly out of context is a risk you created for yourself, and the cure costs nothing: write notes you would be comfortable reading aloud to the person described.

What does a lead form have to tell someone?

Who is collecting the data, what it will be used for, how long it will be kept, who else will see it, and how to get it removed. A short paragraph under the submit button, linking to a fuller policy, does this better than a tick box nobody reads. The point is informed submission, not a trap.

• Name the business, not the website. If a lead reaches a group company or an agency inbox, say so plainly rather than leaving the reader to guess who now holds their number.
• State the actual purpose. A quote request means you will call about a quote. If you also intend to add the address to a monthly newsletter, that is a second purpose and it needs its own, unticked choice.
• Separate the enquiry from the marketing consent. Bundling them means neither is reliable, and the first complaint unpicks both.
• Give a retention period in words. Even a rough one. A reader can accept two years far more easily than silence.
• Offer one route out. One address or one link that reaches a person who can actually delete the record.

None of this reduces lead volume in our experience. Vague forms do not win trust, they just defer the objection to the first phone call, which is the most expensive place to answer it.

Which suppliers actually hold your lead data?

More than most owners expect. Write the list down once, because you cannot protect, audit or exit a data trail you have never mapped. The exercise usually takes an afternoon and finds at least one copy nobody remembered creating, which is exactly the one that leaks.

• The website host and whatever handles the form submission.
• The CRM, and any spreadsheet export sitting in someone's downloads folder.
• The email platform, including suppression and bounce lists.
• Ad platforms, when you run native lead forms or upload a customer list for targeting.
• Call tracking, chat widgets and business messaging apps, which keep message history by default.
• Any agency, freelancer or contact centre with a login to the above.

Each of those needs a written processing agreement, and the ones that matter most are the ones holding the whole database rather than a fragment. Keeping the system of record under your own control, then letting tools connect to it, is the structural fix: a properly built CRM turns six half copies into one authoritative record you can actually answer for.

How long should you keep a lead?

Only as long as the original purpose survives. An enquiry that never converted is a sales record for a year or two, not a permanent asset. Pick a window per record type, write it into the policy, and apply it on a schedule. An indefinite database is both a liability and, in practice, a dirty list.

The commercial argument points the same way. Old records drag deliverability down, inflate your reporting and bury the names worth calling. A disciplined window is what makes a database reactivation work later, because what remains is a list of people who recognise you.

What happens when someone asks to be deleted?

You have about a month, and the request is valid however it arrives: a reply to a campaign, a comment on an advert, a message to the business account. Most businesses fail here not from refusal but from routing. The request lands with whoever runs social media and never reaches the database.

1. Give requests one destination. One inbox, monitored, with a named owner and a deputy.
2. Search every system on your supplier list. Partial deletion is worse than none, because the record returns at the next sync and the person complains twice.
3. Keep the suppression entry. You need to remember not to contact them, which means retaining the minimum needed to honour the request.
4. Confirm in writing. A two line reply closes almost every case before it escalates.
5. Log it. Date in, date done, systems checked. The log is the only proof you acted.

Run that process once and it costs minutes. Run it badly and it becomes a complaint to a regulator about a company that ignored someone twice.

Who is liable when a supplier loses your data?

You are, to your customer, in almost every case. You decided what to collect and who to hand it to, which makes you the controller. The supplier carries its own duties and whatever the contract puts on it, but the apology, the notification and the reputational cost land on your brand first.

So allocate it in writing before anything goes wrong. The contract should say who notifies whom and how fast, who pays for the response, whether the supplier can use subprocessors and where they sit, and what happens to your data at the end of the relationship. Negotiate it during the sale, while you still have leverage. The regulation expects a notifiable breach to be reported without undue delay and generally within three days of you becoming aware, which is not enough time to be discovering who was supposed to tell you.

The same ownership logic applies to the accounts themselves. If an agency holds your ad accounts, your pixels and your lead forms in its own business manager, it also holds your data trail, which is one more reason to settle who owns your ad accounts while the relationship is healthy.

What should you fix first?

Map the suppliers, rewrite the form notice, then split the enquiry from the marketing consent. Those three take an afternoon between them and they cover the surfaces a visitor and a regulator look at first. Retention, agreements and request routing follow, in that order, because doing all of it at once is how it never starts.

1. Map the suppliers. One page, every system holding a lead, who has a login.
2. Rewrite the form notice. Thirty minutes, and it covers the surface a visitor actually sees.
3. Split enquiry from marketing consent. One form change, and it makes your email list defensible.
4. Set retention windows and a deletion date each quarter.
5. Get processing agreements signed by the suppliers holding the full database.
6. Route deletion requests to one inbox and tell the team it exists.

That is a week of unglamorous work that removes most of the realistic downside. If you would rather see where your lead handling leaks before you touch the policy, the lead generation side of our work starts with exactly that audit. Tell us what is happening to your enquiries and we will show you where they are being lost.