GDPR & CCPA: 6 contact finding checks for freelance prospecting

Q: Is a professional email address personal data under the GDPR?

It can be. An address such as firstname.lastname@company.com identifies a person, so collecting, storing, and using it is processing personal data. A generic address such as info@company.com is usually less likely to identify an individual, but you should still check the context.

GDPR & CCPA: 6 contact finding checks for freelance prospecting

Updated October 19, 2026

Edited and fact-checked by: the Jobbers.io editorial team | Figures checked against official sources on: October 19, 2026

Contact finding under GDPR & CCPA calls for checking the rules that apply to your work, documenting your purpose, and handling records carefully. Freelancers also need a clear process for corrections and contact requests. The six checks below help organize that review before a prospect list becomes an outreach campaign.

A professional email address can identify a person. A public profile or a paid database does not remove the need to assess how you collect and use that information. This article provides a practical review list for freelancers. A qualified adviser should assess legal questions involving your particular clients, locations, and communication channels.

1. Check the provider’s claim and your own responsibilities

A label such as Signalhire’s GDPR-compliant data describes the provider’s position about its service. Review the provider’s current privacy terms, data sources, and rights-request process. Then assess your own proposed use. A provider’s practices cannot establish that every customer’s campaign meets all applicable requirements.

The same distinction applies to a claimed mid-90% contact precision range. A matching or accuracy figure needs a definition, date, sample, and testing method. Accuracy concerns whether the details are correct. Permission to collect, retain, or contact someone requires a separate review. Do not present a percentage as evidence of legal compliance.

2. Establish which rules apply before building the list

The General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) have different scopes. The official GDPR text (Regulation (EU) 2016/679) can apply to organizations outside the EU when they offer services to, or monitor the behavior of, people in the EU. California’s Attorney General explains that CCPA obligations apply to businesses meeting the law’s criteria. Small size alone should not replace an applicability review. Check your location, target audience, business activities, and contractual role with an adviser.

For a client project, document who determines the purpose and means of processing personal data. A freelancer following instructions may have different duties from someone building their own prospect database. Put the agreed responsibilities in the contract. Record which party handles notices, corrections, access requests, and deletion decisions.

Key figures at a glance (verify before relying on them)

Rule	Figure	Official source
GDPR – maximum fine (higher tier)	Up to €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(5))	EUR-Lex
GDPR – response to a rights request	Within one month; extendable by two further months for complex requests if the person is told within the first month	EDPB
CCPA – who it applies to	For-profit businesses doing business in California that meet any one of: annual gross revenue above the threshold (originally $25 million, adjusted to $26,625,000 from January 1, 2025); buying, selling or sharing personal information of 100,000 or more California residents or households; or deriving 50% or more of annual revenue from selling California residents’ personal information	California AG, CPPA
CCPA – response to requests to know, delete or correct	45 calendar days, extendable by 45 more days (90 in total) with notice; opt-out requests within 15 business days at most	California AG
CCPA – administrative fines and civil penalties	Up to $2,663 per violation, or $7,988 per intentional violation or violation involving consumers under 16 (amounts in force since January 1, 2025)	CPPA
CAN-SPAM (US commercial email)	Honor opt-out requests within 10 business days; penalties of up to $53,088 per violating email	FTC

3. Separate address checking from communication approval

Technical email verification can help identify address problems before a message is sent. It cannot establish the recipient’s consent, your lawful basis, or the rules governing the message. Check the provider’s status definitions, and keep the lookup date. A valid address may still belong to someone who has objected to marketing.

Keep research and sending as separate stages. For example, a freelance designer might identify a relevant business and confirm its operations manager. Before sending a proposal, the designer should check the applicable outreach rules and any recorded preferences. In the UK, for instance, the ICO’s direct marketing guidance explains that electronic marketing rules can differ depending on whether the recipient is a company or an individual such as a sole trader. A tool returning an address should never trigger a campaign automatically.

4. Record purpose, source, and only the needed fields

Create a record explaining why the business fits your service and which professional role is relevant. Save the source and review date. Limit the fields to those required for that purpose. A service proposal rarely requires unrelated personal details copied from social profiles.

For a website redesign project, the useful record may contain a company website, the relevant manager’s name, a professional channel, and a short research note. Keep uncertain conclusions separate from confirmed facts. An outdated job title should be marked for review before it appears in a message.

State the purpose for keeping the record.
Keep a source and date for professional details.
Assign responsibility for checking disputed information.
Set a review or deletion date for unused research.

5. Prepare notices and rights-request handling

The European Data Protection Board explains that people have information, access, correction, and other rights, depending on the circumstances. Information duties can also apply when data comes from another source. Check the required content and timing of your notice before using collected details. Avoid assuming that a vendor’s notice covers your business.

California’s Attorney General describes rights including correction, deletion, and opting out of sale or sharing, where applicable. Give requests a named owner and a tracked response process. If several tools contain the same record, map those copies so a correction is not limited to the first spreadsheet you open.

6. Keep payment arrangements separate from data handling

Jobbers.io describes its freelance platform as commission-free and allows users to discuss payments directly. That can help freelancers agree on scope and billing, but payment arrangements do not settle privacy duties. A client hiring you through a marketplace still needs clear instructions for handling prospect information.

Because Jobbers takes no commission on the projects agreed between freelancers and clients, both sides can negotiate rates, milestones, and payment methods directly. Freelancers looking for freelance jobs in lead research, data cleaning, or outreach can use that conversation to also confirm, in writing, who supplies the prospect data and how it may be used.

Agree how files are shared, who has access, and when project copies are removed. Keep payment details outside prospect exports. If a client supplies a list, ask about its source and the approved use before adding records or starting outreach.

Pre-outreach review checklist

Document the research purpose and the parties’ responsibilities.
Check applicable data and communication rules.
Review the provider, source, and intended fields.
Test notices, corrections, and contact exclusions.
Approve a small batch before starting further research.

Record	Keep	Check
Research	Purpose and source	Current business role
Communication	Preference and approval	Applicable sending rules
Request	Owner and response log	Every copy of the record

Questions freelancers ask before a contact finding project

Does using a compliant provider make my campaign compliant?

No. Your purpose, notices, communication channel, and handling of requests still need their own assessment. Review those steps before using the provider’s results.

Can I reuse a client’s prospect list for another project?

No, a client’s list should not be treated as available for unrelated work. Obtain written instructions and assess the proposed reuse before copying or contacting anyone.

Does every freelancer fall under the CCPA?

No. Applicability depends on the law’s scope and business criteria, such as an annual gross revenue threshold (adjusted to $26,625,000 from January 1, 2025), handling the personal information of 100,000 or more California residents or households, or earning 50% or more of revenue from selling California residents’ personal information. Check current official guidance and your contractual role rather than making assumptions from your job title.

Should I delete every record after an opt-out?

This is a handling decision that needs care. A limited suppression record may be needed to prevent renewed contact. Check the relevant request and retention duties before removing all traces of it.

Is a professional email address personal data under the GDPR?

It can be. An address such as [email protected] identifies a person, so collecting, storing, and using it is processing personal data. A generic address such as [email protected] is usually less likely to identify an individual, but you should still check the context.

Does the GDPR apply to a freelancer based outside the EU?

It can. The GDPR may apply when you offer services to people in the EU or monitor their behavior, even if your business is located elsewhere. Review your target audience and activities with a qualified adviser.

How quickly must I answer a data request?

Under the GDPR, generally within one month, extendable by two further months for complex requests if you inform the person within the first month. Under the CCPA, requests to know, delete, or correct generally receive a response within 45 calendar days, extendable once by 45 days, and opt-out requests within 15 business days at most.

What does CAN-SPAM require for commercial emails sent to US recipients?

The FTC’s guide lists requirements including accurate header information, non-deceptive subject lines, a valid physical postal address, and a clear way to opt out. Opt-out requests must be honored within 10 business days, and each violating email can lead to penalties of up to $53,088.

Does Jobbers take a commission on freelance projects?

No. Jobbers.io is a commission-free freelance marketplace: freelancers and clients discuss and agree on payment terms directly. Submitting proposals uses the platform’s credits system, so check the current terms on the site before you apply.

Who is responsible for a prospect list supplied by a client?

It depends on who decides the purpose and means of processing. Put the roles in the contract, ask the client where the list came from and what use is approved, and record who handles notices, corrections, and deletion requests.

Verification disclaimer

Important: Independently verify all numbers, pricing, product data, and legal requirements before relying on them. Thresholds, penalty amounts, and response deadlines quoted in this article were checked against the official sources linked below on October 19, 2026, but provider terms and laws can change and some amounts are adjusted periodically. This article is general information, not legal advice or a certification of any vendor. Use qualified advice for your particular circumstances.

Before accepting a contact research assignment, agree with the client on a written handling plan and test how a request would be resolved.