What the GDPR actually asks of you when you capture a lead

A stranger types their email into your form. From that second you are the controller of that record, which is a legal role and not a figure of speech. It is also lighter than most people fear, provided the right things happen at the right moment.

The lawful basis is decided on the form, not afterwards

For a contact you have just met, consent is the honest basis, and it belongs on the form itself: a checkbox the person ticks before anything is written. That places the basis where the data is, rather than in a policy nobody opens.

Legitimate interest is sometimes argued instead. It holds up poorly for a stranger's personal details collected at a stand, because the balancing test asks whether the person would reasonably expect the processing, and someone who handed you nothing did not expect anything.

The practical consequence is small. One checkbox, ticked at capture, and the question never comes back.

What the notice has to say

Who you are, why you are collecting, how long you will keep it, and how to reach you. Four facts, in plain words, next to the field they concern. A link to a full policy covers the rest.

Something worth noticing: a paper business card handed to you does not trigger any of this on its own, because the person chose to give it. The obligations start when you type it into a system, which is the moment it becomes a processing operation. Digital capture does not add duties, it just makes visible the ones that already applied to the shoebox.

Article 14, and the trap in enrichment

If you obtain personal data from anywhere other than the person themselves, article 14 requires telling them within a month: what you now hold, where it came from, why, and for how long.

That is what makes enrichment awkward. A tool that completes a contact from bought databases hands you data the person never gave, on a basis they were never asked about, and the notification duty lands on you rather than on the vendor. Most enrichment workflows never send that notice, which leaves the buyer running an undisclosed processing operation they did not know they had started.

How long to keep an unconverted lead

The regulation sets no number. It requires a duration you can justify against your purpose, which means deciding one and applying it rather than keeping everything forever by default.

For a lead captured at an event, a common and defensible answer is one to three years from the last contact: long enough for a sales cycle, short enough to argue. Write it down, and delete on schedule. A register that only ever grows is one you cannot defend.

Who answers when the person writes

You do. They dealt with you, the record is yours, and the processor holding it acts on your instructions. In practice the interface does the work: search the register, correct the row, or delete it, and answer within the month the regulation allows.

B2B does not exempt you

The most persistent misconception in this field is that professional contacts fall outside the regulation. They do not. firstname.lastname@company.com identifies a person, which makes it personal data whatever the domain. A generic info@company.com is a different case, because it identifies an organisation rather than someone, but that is not what people leave on a capture form.

The B2B context does change the balance in a legitimate interest assessment, and it changes what a person reasonably expects. It does not remove the duty to say who you are, why you are collecting, and how to be forgotten.

The register of processing activities

Article 30 asks organisations to keep a record of what they process and why. The exemption for organisations under 250 employees is narrower than it is usually assumed to be: it falls away when processing is regular, and capturing leads at every event you attend is regular.

For a small company the record is not a project. One table, one row per processing operation, with the purpose, the categories of people and data, who it is shared with, and the retention period. The row covering event capture writes itself once and then only changes when you change tools.

The value is not the document. It is that filling in the retention column forces you to decide a number, which is the obligation most often skipped.

Where the data physically sits matters for a different question, the transfer rules, and it is covered on the GDPR page.