Is contact enrichment legal under the GDPR?

It can be, but the bar is high and often missed. The controller needs a lawful basis (usually a documented legitimate-interest assessment), must inform the enriched person under Article 14 within a month, and must honour objection and deletion rights. The 2019 Bisnode fine in Poland showed that scraping public registers without individually notifying people fails that test. "The data was public" is not, on its own, a justification.

How accurate is enriched contact data?

Mixed, and it decays fast. Email validity checks are reliable, but role and employer fields go stale every time someone changes jobs — and a meaningful share of professionals move annually. Inferred attributes like seniority, department, or intent signals are model guesses with no ground truth. Treat enriched fields as hypotheses to verify in conversation, not facts; a confidently wrong title in an opening line does more damage than asking.

Do I need enrichment in a personal CRM?

No — it solves a sales problem you don't have. Enrichment exists so strangers can be qualified at scale. In a personal network you already know who people are; what you lack is memory of conversations, dates, and promises, which no broker database contains. The valuable fields in a personal CRM are exactly the ones enrichment can never supply, and adding scraped dossiers about friends costs trust for no benefit.

Practice

Contact enrichment

Contact enrichment automatically appends third-party data — job titles, employers, social profiles — to a contact record, typically from broker databases.

Part of the Endearist relationship glossary →

Contact enrichment takes a sparse record — often just an email address — and fills in the rest from external databases: current employer, role, seniority, company size, LinkedIn URL, sometimes a photo. Sales teams use it to score leads without research; enrichment vendors maintain hundreds of millions of profiles compiled from web scraping, public registers, and purchased datasets, matched against your contact by email or name plus company.

The mechanics are a lookup, but the supply chain is the controversial part. The person being enriched never handed their data to the vendor, rarely knows the profile exists, and the data ages badly — people change jobs, and a stale title in your CRM is worse than a blank field because it looks authoritative.

In the EU, that supply chain collides with the GDPR. Compiling profiles of people from "publicly available" sources still triggers the duty to inform them (Article 14), and regulators have enforced it: Poland's data protection authority fined the data broker Bisnode roughly €220,000 in 2019 for silently building profiles of millions of sole traders from public registers.

Where enrichment data actually comes from

Vendors rarely advertise their sources, but the pipeline is consistent across the industry: scraped public web pages and social profiles, commercial registers and company filings, conference attendee lists, app permission harvesting (some free tools have historically uploaded users' entire address books), and data purchased from other brokers. Each hop strips context and consent further away from the person described. Accuracy follows the same gradient — emails verify well, job titles drift within months, and inferred fields like seniority or "buying intent" are statistical guesses dressed as facts.

Enrichment vendors and the GDPR: the Bisnode lesson

Article 14 GDPR says: when you obtain personal data from somewhere other than the person, you must tell them — who you are, what you hold, why, and their rights. Bisnode had compiled records on millions of Polish entrepreneurs from public registers and argued that posting a privacy notice on its website was enough. The Polish regulator UODO disagreed, fined the company about €220,000, and ordered it to notify everyone individually — a remediation Bisnode priced at several million euros in postage. The Warsaw administrative court upheld the core finding. The takeaway for anyone using enrichment: "it was public" is not a lawful basis, and the information duty doesn't vanish because compliance is expensive.

Why Endearist deliberately does not enrich

Endearist contains no enrichment pipeline, by design rather than by omission. A personal CRM holds the people closest to you, and silently pulling broker-compiled dossiers about your friends into that space would betray both them and the product's premise. Endearist is local-first: your contacts live on your device, are never sent to a lookup API, never matched against a broker database, and never used to train anything. Everything in a record is zero-party data — what the person told you, or what you observed and chose to write down. That's not just a privacy posture; for close relationships it's also the higher-quality data. No vendor knows your friend's new job before your friend tells you.

Frequently asked questions

Is contact enrichment legal under the GDPR?: It can be, but the bar is high and often missed. The controller needs a lawful basis (usually a documented legitimate-interest assessment), must inform the enriched person under Article 14 within a month, and must honour objection and deletion rights. The 2019 Bisnode fine in Poland showed that scraping public registers without individually notifying people fails that test. "The data was public" is not, on its own, a justification.
How accurate is enriched contact data?: Mixed, and it decays fast. Email validity checks are reliable, but role and employer fields go stale every time someone changes jobs — and a meaningful share of professionals move annually. Inferred attributes like seniority, department, or intent signals are model guesses with no ground truth. Treat enriched fields as hypotheses to verify in conversation, not facts; a confidently wrong title in an opening line does more damage than asking.
Do I need enrichment in a personal CRM?: No — it solves a sales problem you don't have. Enrichment exists so strangers can be qualified at scale. In a personal network you already know who people are; what you lack is memory of conversations, dates, and promises, which no broker database contains. The valuable fields in a personal CRM are exactly the ones enrichment can never supply, and adding scraped dossiers about friends costs trust for no benefit.

Sources

Last updated: 2026-06-10

Tend relationships, not records.

Endearist is a local-first personal CRM. Free up to 25 contacts.

Start free