Guide · Data, consent and contact rules
B2B lead generation compliance: collecting, contacting and sharing lead data
Compliance follows a lead through four moments: when you collect it, when sales contacts it, when you send its outcome back to Google, Meta or LinkedIn, and when you keep or delete it. Most teams check the first two. This guide maps all four for India, the UAE, the US and exporters selling into Europe.
This guide summarises official sources as they read on 15 September 2026. Laws, rules and platform terms change, and how they apply depends on your business, your leads and where they are. Confirm your obligations with qualified counsel in each market before acting on anything here.
Does B2B lead generation need consent?
Short answer
Often, yes. B2B isn’t a general exemption. India’s DPDP Act, the UAE PDPL, GDPR and California’s CCPA protect personal data about people at work, and US CAN-SPAM covers B2B email. What changes is the lawful basis and the channel rules: calls, texts, WhatsApp and email each carry separate requirements. Confirm specifics with counsel.
The “it’s B2B, so it’s fine” assumption fails for a simple reason: a lead is a person. A procurement manager’s name, work email and mobile number identify her, whichever company she works for. A few rules do treat business contacts differently, such as the UK’s email marketing rule for limited companies, but those are exceptions within specific laws, not a blanket pass.
The second assumption to drop is that one checkbox covers everything. Consent to be contacted about an RFQ is not consent to a newsletter, and neither is consent to WhatsApp messages.
Original framework
The four moments where lead data creates legal risk
The Lead Data Compliance Matrix: what to check at each moment, by market. Each cell is a summary; the sections below give the source.
| Moment | India | UAE | US | EU and UK (exports) |
|---|---|---|---|---|
| 1. Collect (form, lead form, event) | Notice and consent under the DPDP Act; itemised notice rules from 13 May 2027 | PDPL consent for onshore processing; DIFC law in the DIFC | Privacy notice; CCPA duties if you meet its thresholds | Lawful basis under GDPR; transparent notice |
| 2. Contact (call, SMS, WhatsApp, email) | TRAI rules for commercial calls and SMS; WhatsApp opt-in | Resolution 56 of 2024: approval, hours, DNCR, recording | TCPA for autodialled or prerecorded calls and texts to mobiles; CAN-SPAM for email | National email marketing rules; UK PECR |
| 3. Share with ad platforms | Purpose disclosed in the notice; platform terms | Consent or another PDPL basis; platform terms | Privacy notice disclosure; platform terms | Google’s EU user consent policy; platform terms |
| 4. Retain and delete | Erasure and response duties; 90-day response to requests | PDPL rights; keep only what the purpose needs | CCPA deletion requests where it applies | Storage limitation; erasure rights |
India: DPDP Act and Rules, and TRAI calling rules
Short answer
The DPDP Act 2023 governs lead data; the DPDP Rules 2025, published on 13 November 2025, phase in over 18 months. Consent-manager rules apply from 13 November 2026, and most business obligations, including detailed notices, security and breach reporting, from 13 May 2027. Commercial calls and SMS separately follow TRAI’s regulations, amended in February 2025.
What applies when
The Rules (G.S.R. 846(E), dated 13 November 2025) set three commencement dates. Rules 1, 2 and 17 to 21 came into force on publication. Rule 4, on consent managers, comes into force one year after publication. Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication (MeitY; PIB).
| From | What starts | Lead generation impact |
|---|---|---|
| 13 November 2025 | Rules 1, 2 and 17–21 (definitions and the Data Protection Board) | The Board is set up; the Act’s duties are not yet fully in force |
| 13 November 2026 | Rule 4: consent managers | Registered consent managers can operate |
| 13 May 2027 | Rules 3, 5–16, 22 and 23: notice, security safeguards, breach intimation, erasure and more | Lead forms, CRMs and spreadsheets holding Indian leads should be ready |
Notice and consent on lead forms
Under section 5 of the Act, a request for consent must come with a notice describing the personal data and the purpose. Rule 3 adds that the notice must give an itemised description of the data and let people withdraw consent with ease comparable to giving it (MeitY data protection framework). In practice, a B2B enquiry form should say what you collect, why, which channels you will use, and how to withdraw.
Section 7(a) allows processing, without separate consent, for the specified purpose for which a person voluntarily provided their data, unless they indicate they don’t consent. The Act’s own illustration is close to lead generation: someone asks a real estate broker to find a rental and shares their details; the broker may use them for that, and must stop when told the help is no longer needed. How far this stretches for B2B follow-up, and whether it covers uploading outcomes to ad platforms, is a question for counsel.
The stakes are high. The Act’s Schedule allows penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a personal data breach, and up to ₹50 crore for other breaches of the Act or Rules. Individuals can ask to access, correct or erase their data, and the PIB summary of the Rules says Data Fiduciaries must respond within 90 days.
Calls and SMS: the TRAI regulations
TRAI amended the Telecom Commercial Communications Customer Preference Regulations, 2018 on 12 February 2025 (PIB; TRAI regulation). Points that matter to sales teams following up leads:
- Number series. Promotional calls continue from the 140 series; the 1600 series is designated for transactional and service calls. Senders are restricted from using ordinary 10-digit numbers for telemarketing.
- Consent limits. After someone opts out, a sender can’t ask for their consent again for 90 days. Consent given to complete an ongoing transaction is valid for 7 days, and implicit consent for service communications lasts only for the contract.
- Complaints and action. People can complain within 7 days of receiving spam, up from 3. Action is triggered by 5 complaints against a sender in 10 days.
- Consequences for senders. A first breach of the threshold bars all the sender’s outgoing services for 15 days; later breaches disconnect all its telecom resources for a year and blacklist it.
Which of your follow-up calls count as promotional, service or transactional is exactly the kind of question to settle with counsel and your telecom provider before scaling a calling team.
WhatsApp follow-up
WhatsApp’s Business Messaging Policy requires opt-in permission from the recipient “confirming that they wish to receive subsequent messages”, and outside the 24-hour customer service window only approved message templates can be sent (WhatsApp Business Messaging Policy). That platform rule sits on top of Indian law, not in place of it. Ask for WhatsApp contact on the form, as its own choice.
UAE: PDPL, DIFC and the 2024 telemarketing rules
Short answer
Onshore lead data falls under Federal Decree-Law No. 45 of 2021 (the PDPL), which prohibits processing without consent except in defined cases. The DIFC has its own Data Protection Law. Marketing calls follow Cabinet Resolution No. 56 of 2024: prior approval, local licensed numbers, the Do Not Call Registry, and calls only between 9am and 6pm.
Which data protection regime applies
The UAE government describes the PDPL as prohibiting “the processing of personal data without the consent of its owner”, except where processing is necessary for a public interest or legal procedures, and applying to processing inside or outside the country (u.ae; UAE Legislation). Companies in the Dubai International Financial Centre follow DIFC Law No. 5 of 2020 instead. Other financial free zones may have their own regimes, so confirm which law applies to each entity that collects leads. Check the UAE Legislation portal for implementing regulations under the PDPL before finalising notices.
Telemarketing: Resolutions 56 and 57 of 2024
Cabinet Resolution No. 56 of 2024 on the Telemarketing Regulations was issued on 10 June 2024 and takes effect 60 days after publication in the Official Gazette; the Ministry of Economy and TDRA announced it as effective from mid-August 2024. It applies to companies licensed in the UAE, including in free zones, that market products or services by phone (Resolution 56 of 2024). Companies must:
- obtain prior approval from the competent authority to carry out phone marketing;
- use local numbers from licensed telecom companies, registered under the company’s commercial licence;
- create a channel for consumers who want marketing information, and market only to them;
- not call numbers listed on the Do Not Call Registry (DNCR);
- record marketing calls and tell the consumer at the start, and keep a register of calls;
- identify the company and the purpose at the start of the call, and ask whether the consumer wants to continue;
- call only between 9:00am and 6:00pm; not call back someone who rejected the offer; and not call back an unanswered number more than once a day or twice a week.
Cabinet Resolution No. 57 of 2024 sets the fines (Resolution 57 of 2024). Calling outside 9am–6pm costs a company AED 10,000 for a first violation, AED 25,000 for a second and AED 50,000 for a third. Telemarketing without prior approval costs AED 75,000, AED 100,000 and AED 150,000.
The resolution speaks of “consumers”. Whether a call to a purchasing manager at a trading company counts is a point for UAE counsel; the safe default is to apply the hours, identification and DNCR rules to every follow-up call. For how GCC campaigns differ in other ways, see GCC B2B paid ads.
US: TCPA, CAN-SPAM and state privacy laws
Short answer
Calls and texts that include advertising or telemarketing, made to mobile numbers with an autodialer or an artificial or prerecorded voice, need prior express written consent under the TCPA rules, including to a business owner’s mobile. CAN-SPAM covers B2B email with no exception. California’s CCPA has covered business contact data since its B2B exemption expired at the end of 2022.
Calls and texts: the TCPA
The FCC’s rule at 47 CFR 64.1200(a)(2) requires prior express written consent for telemarketing or advertising calls made with an automatic telephone dialing system or an artificial or prerecorded voice to the protected lines it lists, including mobile numbers. That consent is a signed written agreement that clearly authorises the seller to send such messages (47 CFR 64.1200). The rule follows the number called, not whether the lead is a business.
In 2023 the FCC added a “one-to-one” restriction: consent to one seller at a time, for calls logically and topically related to the interaction. On 24 January 2025 the Eleventh Circuit vacated that part of the order (Insurance Marketing Coalition v. FCC), and the current rule text no longer contains it. The underlying written-consent requirement still applies.
Email: CAN-SPAM
The FTC is plain: “The law makes no exception for business-to-business email.” Commercial emails need accurate headers, a valid physical postal address and a working opt-out; opt-outs must be honoured within 10 business days; and each separate email in violation can bring penalties of up to $53,088 (FTC CAN-SPAM guide).
State privacy laws
The California Privacy Protection Agency confirms that the CCPA’s exemptions for employee and business-to-business personal information expired on 31 December 2022. The CCPA applies to businesses with gross annual revenue of $26,625,000 or more (from 1 January 2025), or that buy, sell or share the personal information of 100,000 or more California residents or households, or that earn half or more of their revenue from selling or sharing it (CPPA FAQ). Other states have their own privacy and telemarketing laws; check the states your leads are in.
Selling to Europe or the UK: GDPR and email basics for exporters
Short answer
If you target leads in the EU or UK, GDPR or UK GDPR applies to their data, so you need a lawful basis such as consent or legitimate interests and a clear notice. Email marketing rules vary by country. In the UK, PECR lets you email limited companies without consent, but sole traders and partnerships need consent or a soft opt-in.
Indian manufacturers and Gulf consultancies often run LinkedIn campaigns into Europe without noticing that the rules change with the lead’s location. Under GDPR, each use of lead data needs a lawful basis; consent and legitimate interests are the two most used for B2B marketing, and the choice affects what you must tell people and how they can object.
The UK regulator explains that PECR’s electronic mail marketing rule doesn’t apply to corporate subscribers such as limited companies and LLPs, while sole traders and ordinary partnerships are treated like individuals (ICO, business-to-business marketing). EU countries apply their own email rules, and several are stricter. Take local advice before emailing EU leads who didn’t ask to hear from you.
Is it legal to send lead data back to Google, Meta and LinkedIn?
Short answer
It can be, if your privacy notice discloses that you share data for advertising measurement, you have a lawful basis in each market, and you follow each platform’s terms. Hashing helps, but hashed emails and phone numbers are still personal data. Send the minimum: identifiers or click ID, the stage and the time.
When you send CRM stages to ad platforms, such as enhanced conversions for leads on Google, the Conversions API on Meta or the Conversions API on LinkedIn, you share information about identifiable people. The platforms put conditions on it:
| Platform | What its terms require |
|---|---|
| Disclose to customers that you share their information with third parties to perform ad measurement on your behalf, obtain consent where legally required, follow applicable law and the EU user consent policy, and upload only through Google’s interfaces (customer data policies). For end users in the EEA, the UK and Switzerland, obtain consent for the collection, sharing and use of personal data for ads personalisation (EU user consent policy). | |
| Meta | Hash contact information in the way Meta specifies before sending it, give clear notice, and hold all necessary rights, permissions and legal bases for the data you share (Meta Business Tools Terms). |
| Review LinkedIn’s advertising terms for its Conversions API before connecting; the setup is covered in the LinkedIn Conversions API guide. |
Four habits keep this defensible: say in the privacy notice that lead data is shared with advertising platforms to measure and improve campaigns; send only the fields a platform needs; don’t send special categories of data; and keep a record of which markets’ leads are uploaded and on what basis. The stage design and identifiers are in CRM lead stages for ad platforms.
Where Zephra fits, honestly: Zephra sends CRM lead stages to Google (Data Manager API), Meta (Conversions API) and LinkedIn (Conversions API) where configured. It doesn’t collect consent from your leads or manage consent records; those stay with your forms, CRM and legal advisers. How Zephra handles access to your ad accounts is on the security page and in the privacy policy. What ads themselves may say on Meta is a separate topic, covered in Meta ads policy compliance.
Which lead sources carry the most compliance risk?
Short answer
Your own inbound forms carry the least risk, because you control the notice and the choices. Platform lead forms are close behind if your privacy policy and questions are right. Event scans and distributor-shared leads need a documented source and basis. Purchased lists carry the most risk, because the people on them never dealt with you.
| Source | Risk | What to have in place |
|---|---|---|
| Your website enquiry or RFQ form | Lower | Notice at the point of collection; channels listed; optional marketing choice unticked |
| Google, Meta or LinkedIn lead forms | Lower to medium | Your privacy policy link on the form; consent questions that match how you will follow up. See form and capture optimisation |
| Trade show badge scans | Medium | What visitors were told at the stand; a follow-up that matches it. See trade show paid ads |
| Distributor or partner-shared leads | Medium to high | A written record of where the lead came from and the basis for sharing |
| Referrals | Medium | Treat the person as a new contact until they agree to hear from you |
| Purchased or scraped lists | Highest | Legal advice before any use; many teams simply don’t |
Consent wording patterns for B2B lead forms
Three starting patterns. Adapt them with counsel for each market; they are not approved legal text.
Pattern A · Request only
“We’ll use these details to respond to this request by phone, email or WhatsApp, as you choose below. See our privacy policy for how we handle your data and how to ask us to stop.” List only the channels you really use.
Pattern B · Request plus marketing
Pattern A, then a separate, unticked box: “Send me occasional product updates by email. I can unsubscribe at any time.” The request goes through whether or not the box is ticked.
Pattern C · India, detailed notice
For Indian leads ahead of 13 May 2027: an itemised list of the data collected, each purpose (responding, follow-up, measuring advertising), and a withdrawal method as easy as the form itself, such as a link or reply keyword.
For every pattern
If lead outcomes are uploaded to ad platforms, say so in the privacy policy. Record which version of the wording each lead saw, with the date.
In practice
One company, three markets, four moments
A valve maker in Pune has a Dubai branch and sells to US distributors. It runs Google Search with an RFQ form, LinkedIn Lead Gen Forms and Meta retargeting. Walking each moment:
- Collect. One form, with market-specific notice text: the Indian version prepared for the Rule 3 notice requirements; the UAE version reflecting PDPL consent; the US version with a link to the privacy policy. WhatsApp is a separate choice.
- Contact. Indian follow-up calls go through registered channels under TRAI’s regulations. Dubai sales calls happen between 9am and 6pm, from the branch’s licensed numbers, after a DNCR check, with the company and purpose stated. US distributors get calls dialled by hand and no automated texts without written consent. Every marketing email has an unsubscribe link and a postal address.
- Share. Hashed email and phone number, or the click ID, plus the stage and time go to Google, Meta and LinkedIn. The privacy policy says lead data is shared with advertising platforms for measurement. No EU leads are uploaded until the consent position is settled.
- Retain. Closed-lost leads without a live purpose are reviewed each quarter and erased, and erasure requests are answered well inside 90 days.
None of this is a legal conclusion for that company. It shows where the questions sit.
Lead generation compliance checklist by company size
| SMB | Mid-market | Enterprise | |
|---|---|---|---|
| Notice | One notice per market on every form | Versioned notices, dated | Notices approved by legal per market and product |
| Consent record | A column in the lead sheet: channel choices and wording version | Consent fields in the CRM | Consent records linked to each upload and campaign |
| Contact rules | Written calling hours and opt-out handling | DNCR and opt-out checks built into the calling process | Telephony controls, call recording and audit by region |
| Platform uploads | Owner approves what is sent | A named owner for data sharing; minimum fields | Records of processing; vendor agreements; legal sign-off |
| Retention | Quarterly clean-up | Retention rules per lead status | Automated retention and erasure workflows |
Last verified 15 September 2026
Law tracker
The instruments referenced above, their status and the official source. Check each source before relying on it.
| Law or instrument | Market | Status and key dates | Official source |
|---|---|---|---|
| Digital Personal Data Protection Act, 2023 | India | Assented 11 August 2023; Schedule penalties up to ₹250 crore | MeitY |
| DPDP Rules, 2025 | India | Published 13 November 2025; Rule 4 from 13 November 2026; Rules 3, 5–16, 22 and 23 from 13 May 2027 | MeitY |
| TCCCPR 2018, amended 12 February 2025 | India | In force; 140 and 1600 series; stricter consent and sender action | TRAI |
| Federal Decree-Law No. 45 of 2021 (PDPL) | UAE onshore | Issued 2021; check the portal for implementing regulations | UAE Legislation |
| DIFC Law No. 5 of 2020 | DIFC | Applies within the DIFC | u.ae |
| Cabinet Resolutions No. 56 and 57 of 2024 | UAE | Issued 10 June 2024; in effect 60 days after Gazette publication | UAE Legislation |
| TCPA rules, 47 CFR 64.1200 | US | In force; one-to-one consent restriction vacated 24 January 2025 | 47 CFR 64.1200 |
| CAN-SPAM Act | US | In force; penalties up to $53,088 per email | FTC |
| CCPA as amended | US (California) | B2B exemption expired 31 December 2022 | CPPA |
| GDPR; UK GDPR and PECR | EU, UK | In force | EUR-Lex; ICO |
| Platform terms | All | Change without notice; recheck before new uploads | Google; Meta; WhatsApp |
Questions, answered
Lead generation compliance FAQ
01Can sales WhatsApp a lead who filled in an RFQ form?
Only with opt-in. WhatsApp’s policy requires permission from the recipient confirming they want to receive messages, and local law still applies. Offer WhatsApp as a separate choice on the form and record it with the lead.
02Are LinkedIn Lead Gen Form leads already consented?
Only to what the form told them. The form links to your privacy policy, and any consent checkboxes you add set the scope. A lead who asked for a report hasn’t agreed to sales calls unless the form said so.
03Can we buy B2B lead lists?
It is the highest-risk source. The people on the list never dealt with you, so notice, lawful basis and contact rules are hard to satisfy. Take legal advice in each market before using one.
04Can we use leads a distributor shares with us?
Only with a documented basis. Record where each lead came from, what the person was told and on what basis the distributor shared it, and give your own notice when you first make contact.
05How long can we keep lead data?
Only as long as the purpose needs, in general. Set a rule per lead status, such as reviewing closed-lost leads each quarter, and answer erasure requests promptly; the PIB summary of India’s DPDP Rules sets a 90-day maximum for responding to such requests.
06Does a DIFC company follow the UAE PDPL?
Companies in the DIFC follow the DIFC Data Protection Law (DIFC Law No. 5 of 2020) for data protection. The federal telemarketing resolution applies to licensed companies including those in free zones, so check both.
07Is this guide legal advice?
No. It summarises official sources as of 15 September 2026 to help you ask the right questions. Confirm your obligations with qualified counsel in each market where you collect or contact leads.
Your accounts
Before you connect lead outcomes to your ad accounts, see what they track today.
The free ad account assessment reviews wasted spend, campaign structure, performance constraints and measurement gaps across Google, Meta and LinkedIn. It takes 10–15 minutes, needs no CRM and makes no campaign changes.