Winning time on lead generation without a GDPR problem

Sales teams reach for AI here first, and it is a genuinely good use case — the work is repetitive, high-volume, and has a clear judgement step. It is also where companies create data-protection problems fastest, usually without noticing.

The useful split: the time is in preparation. The risk is in collection. Automate the first aggressively; be deliberate about the second.

Where the hours actually are

Ask a salesperson where the week goes and it is rarely the conversation. It is:

• researching a company before a call
• working out who the right person is and what they care about
• writing the first version of an email that will be edited anyway
• writing the follow-up nobody feels like writing
• updating the CRM afterwards

Every one of those is preparation, and none of them requires collecting anything new about a person. That is where to start, because the return is immediate and the exposure is close to zero.

The highest-value one is usually call preparation. A structured brief — what this company does, what changed recently, what they likely care about, three questions worth asking — from public company information. It saves twenty minutes per call and improves the call, which is a rare combination.

The line that matters

Personal data is anything about an identifiable person. info@company.be is generally not; a named person's work email, role and LinkedIn profile is, even though it is professional and even though it is public.

"Publicly available" is the misconception that causes the most trouble. Public does not mean unregulated. Scraping profiles into a database is collection, and it starts a set of obligations whether or not the source was open.

The obligation people miss

When you obtain personal data from somewhere other than the person themselves — scraped, enriched, bought, inferred — you generally have to tell them, and at the latest when you first contact them. Not in a portal they will never visit: in the first message, briefly, with where you got it.

Most automated prospecting stacks simply do not do this, and it is the single most common gap we see.

Alongside it: an objection to direct marketing is absolute. There is no balancing test and no "but they are a good fit". Someone says stop, you stop, and your systems have to be able to actually do that — which means a suppression list that every tool respects, not a flag in one CRM.

Design rules that keep you out of trouble

Prepare on public company information; do not build a private dossier. A brief assembled for one call, used, and not retained is a very different thing from a database of profiles.

Collect only what the next conversation needs. Enrichment tools offer twenty fields because they can. Every field you keep is one you must justify, secure, correct on request, and delete on time.

Set a retention period before you start, and enforce it in the tool. "We'll clean it up later" means never. A prospect who never replied does not need to be in your system in three years.

Know where the model runs. Pasting a prospect list into a general assistant is a transfer. Check what the provider does with it, whether it trains on it, and where it is processed. For a Belgian company, an EU-hosted option with a proper processing agreement removes an argument you would otherwise have to make.

Keep the person in the loop before send, not after. Automating the draft is a productivity gain. Automating the send is how a mistake reaches two thousand people simultaneously — and the volume itself changes how a regulator reads it.

What good looks like

A realistic target for a Belgian B2B team of any size:

That is most of the time back, with none of the interesting risk.

With a larger sales team, one thing changes and it is not the volume. Keep a single named owner of the approval gate. When approval is spread across a team of representatives, message quality drifts within a fortnight — everyone assumes someone stricter than themselves is also looking, and nobody is. One owner, with a deputy for holidays.

Two rules worth writing down before you scale

Name a person against every gate — no name, no gate. Decide who approves a new data source, who approves a claim or a proof point, and who approves the message itself. A gate owned by "the team" is not a gate. This matters more as volume rises, because that is exactly when "someone will have checked it" starts being false.

Cap the list at what one person can actually review. The bottleneck in an AI-assisted sales process is not sourcing capacity — a tool will happily produce four hundred prospects. It is approval time. If you can properly review twenty-five a week, the list is twenty-five, and the rest is theatre that degrades your domain reputation and your brand.

That second rule is the honest test of any "AI does your prospecting at scale" promise. Ask what the human review step is and how long it takes. If the answer is that review is optional, you are being sold a spam operation with better vocabulary.

Before you scale it

Two questions worth answering in writing, once:

1. If a prospect asked "where did you get my details and what do you hold", could you answer in a day?
2. If someone objects today, is there a path that stops every future contact — or only the one tool they replied to?

If either answer is uncomfortable, fix that before increasing volume. Doing it at ten contacts a week is an afternoon; doing it at a thousand is a project.