The Law of 6 January 1978, known as the Data Protection Act, is based on overseas data a distinction according to the purpose of the files and the nature of the data. In addition, the law differentiates the authorisation regime for the processing of sensitive data from the declaration regime for the implementation of data processing.
Both individuals and professionals must comply with it. Lead generation, as a collection of personal data, does not escape this reporting obligation. Indeed, by generating leads, you simply obtain a contact (email or IP address, a telephone number, etc.). The very fact of collecting data corresponds to the processing of personal data.
Regarding the legal qualification of the lead, we invite you to consult the relevant article .
However, over the years, the CNIL has implemented specific standards. This simplifies the reporting obligations for the most frequent categories of processing. This is only possible for processing whose implementation does not infringe on freedoms or privacy. There are currently 55 standards of this type, including standard NS-048 relating to customer-prospect files and online sales.
This simplified standard concerns the processing of personal data. In particular, that which has as its purposes customer management, prospecting, exchange of customer and prospect files, development of commercial statistics, transfer, rental or even loyalty operations.