Skip to content
PrivacyBuilt

Regulatory Pulse

CNIL clarifies inferred work-email rules: public data is not unrestricted prospecting data

New guidance connects work-email reconstruction with lawful-basis assessment, transparency, retention and effective objection handling.

France / GDPR and applicable electronic-marketing rules
Contact enrichment, marketing operations, vendor risk and data provenance
Guidance
Official source reviewed

PrivacyBuilt Editorial · Source published Regulator guidance · Reviewed 17 October 2026 · 6 min read

LinkedInShare on X WhatsApp

The 60-second summary

CNIL published guidance on 16 October 2026 about deducing professional email addresses from online information. Legitimate interests may support some uses, but not automatically: purpose, reasonable expectations and safeguards matter. Public availability does not remove privacy or marketing obligations. Teams should distinguish discovering an address from having permission to use it.

Timeline that matters

  1. 16 October 2026

  2. Existing obligations

  3. 24 October 2026

What changed

New professional and individual-facing guidance addresses inferred work-email processing.It explains the need to consider visibility restrictions, retention and objections.

Who should care

B2B sales and marketing teamsContact-enrichment and lead-generation providersPrivacy and rights-request teamsProcurement and customer-data platform owners

Why this matters for global organisations.

Contact-enrichment tools can create personal information that was never directly published. Preserve provenance, assess reasonable expectations and ensure objections stop later enrichment as well as current outreach.

13 actions to start now

  1. Inventory tools that infer or purchase work-email addresses.
  2. Identify controllers, suppliers and onward recipients.
  3. Record the overall purpose before enrichment starts.
  4. Document the lawful-basis assessment and separate marketing-law review.
  5. Evaluate how source visibility and privacy choices affect expectations.
  6. Check source and derivation records for representative contacts.
  7. Limit retention with justified review and deletion triggers.
  8. Provide clear information about provenance and use.
  9. Make objection and other rights channels easy to find.
  10. Synchronise suppression across CRM, suppliers and enrichment jobs.
  11. Test whether a suppressed person is re-created by a later import.
  12. Review accuracy and risks of reaching the wrong individual.
  13. Retain assessments, tests and supplier assurances and revisit when purposes change.

Evidence worth retaining

  • Tool and supplier inventory
  • Purpose and lawful-basis assessment
  • Source and derivation records
  • Notice versions and delivery evidence
  • Retention and deletion decisions
  • Suppression tests across connected systems
  • Rights-request and supplier-response records

Questions to take to counsel or your conformity team

These are discussion prompts, not legal advice or conclusions.

  • Is the intended outreach permitted under the applicable marketing rules?
  • What evidence supports reasonable expectations?
  • Can supplier provenance be verified?
  • What minimal suppression information is necessary to prevent re-enrichment?
  • How are inaccurate inferred addresses corrected or removed?

Official sources

PrivacyBuilt / PrivacyBuilt is an independent educational publisher. It is not affiliated with, or endorsed by, any regulator or the European Union.

PrivacyBuilt publishes educational and technical guidance. Nothing on this site constitutes legal advice, and it should not be relied on as a legal determination for your organisation.

LinkedInShare on X WhatsApp