Using AI lead-enrichment tools or bought contact lists? A GDPR Article 14 notice sheet for small businesses: what to tell people and by when
What you get: a finished Article 14 notice sheet: one row per contact source you did not collect from the person yourself (AI lead-enrichment tools, bought or rented lists, trade fair badge scans, lists from partners), a deadline formula for when the notice must reach people, one column per information check from Article 14(1) and 14(2), the objection line Article 21 asks for, a result formula, three made-up example rows and first-message wording you can adapt.
Short answer: when you get someone's personal data from somewhere other than that person, Article 14 GDPR says you must tell them who you are, why you use their data, where it came from and what their rights are. The deadline is the earliest of: one month after you got the data, your first message to them, or the first time you pass the data on. Data from public websites is not exempt: the notice must say whether the source was public.
Step 1: which of your contact data is an Article 14 case?
- Article 13 applies when the person gives you the data (a web form, a call, a booking). Use the Article 13 privacy notice AI section sheet for those.
- Article 14 applies to everything else: emails and job titles added by an AI lead-enrichment tool, bought or rented lists, contacts collected from websites by a crawler, trade fair badge scans from the organiser, names passed on by a partner.
- Fields the AI tool guesses (seniority, buying intent, company size) are still personal data about the person when they are linked to a name. List them in column B.
Step 2: the Article 14 notice sheet (one row per source)
| Column | What to write | Source |
|---|---|---|
| A. Source and AI tool | [AI lead-enrichment tool / bought or rented list / trade fair badge scans / list from a partner / web pages collected by a crawler] · [tool or supplier name] | Art. 14(2)(f) |
| B. Data categories | Name, work email, job title, company, phone, plus anything the AI tool adds or guesses (seniority, "buying intent" score, company size). Note guessed fields separately | Art. 14(1)(d) |
| C. Date obtained | dd/mm/yyyy the data reached you (import date, export date) | Art. 14(3)(a) |
| D. Planned first contact | dd/mm/yyyy of the first email, call or message to the person; blank if none planned | Art. 14(3)(b) |
| E. Planned first disclosure | dd/mm/yyyy you first pass the data to another recipient (a partner, a reseller, another company's CRM); blank if none | Art. 14(3)(c) |
| F. Notice deadline | =MIN(EDATE(C2,1),IF(D2="",EDATE(C2,1),D2),IF(E2="",EDATE(C2,1),E2)) The one-month date is the outer limit; the rule is "within a reasonable period" | Art. 14(3) |
| G. Lawful basis | [legitimate interests (Art. 6(1)(f)) + link to your assessment / consent / other] and, for legitimate interests, the interest pursued | Art. 6(1); Art. 14(1)(c), 14(2)(b); Recital 47 |
| H. Article 14(1) items in the notice | Y / Partial / N: your identity and contact details (and EU representative if any), DPO contact if you have one, purposes and legal basis, data categories, recipients, transfers outside the EU and the safeguard | Art. 14(1)(a) to (f) |
| I. Article 14(2) items in the notice | Y / Partial / N: retention period or criteria, rights (access, rectification, erasure, restriction, objection, portability), withdrawal of consent if consent is the basis, complaint to a supervisory authority, the source and whether it was public, automated decision-making or profiling if it applies | Art. 14(2)(a) to (g) |
| J. Objection line at first message | Y / N: the right to object (and to object to direct marketing at any time) is stated clearly and separately from other text in the first message | Art. 21(2) to 21(4) |
| K. Exception claimed | None / already has the information / disproportionate effort (write down why: number of people, age of data, safeguards, and publish the information) / laid down by law / professional secrecy | Art. 14(5); Recital 62 |
| L. Notice given on, how | dd/mm/yyyy · [in first email / separate email / letter / published page if exception K applies] | Art. 5(2) accountability |
| M. Result | =IF(COUNTIF(H2:J2,"N")>0,"Fix notice",IF(L2="",IF(TODAY()>F2,"Overdue","Due "&TEXT(F2,"dd/mm/yyyy")),IF(L2<=F2,"Given on time","Given late"))) | Art. 14(3) |
| N. Action, owner, date | [add source line to first email / add objection line / delete list / stop using guessed fields] · [role] · [dd/mm/yyyy] | Art. 5(2) |
Put Y, Partial or N in columns H to J. Sort by column M so "Fix notice" and "Overdue" rows come first. Partial counts as a pass in the formula, so read those rows by hand.
First-message wording (adapt to your business)
"We are [business name, address, contact email]. We found your work contact details through [source, e.g. an AI lead-enrichment tool / a list from (supplier) / your company's public website] on [month]. We use your name, job title and work email to [purpose] on the basis of our legitimate interest in [interest]. We keep them for [period] unless you ask us to stop. [Recipients and any transfer outside the EU with the safeguard.] You can ask for access, correction, erasure, restriction or portability, and you can complain to [supervisory authority]. Our full notice: [link]."
Separate line, clearly visible: "You can object to us using your details at any time, including for marketing: reply 'stop' and we will no longer use them for that purpose."
Email and phone marketing also fall under your country's rules implementing the ePrivacy Directive 2002/58/EC. Those rules decide whether you may send the first message at all; Article 14 only decides what it must say.
Three example rows (made-up businesses, for illustration only)
Example row 2, a small bookkeeping firm, "Example AI lead-enrichment tool": A. AI tool adds work emails to a list of local shop owners · B. name, work email, job title, shop name, guessed "turnover band" · C. 01/10/2026 · D. 20/10/2026 · E. blank · F. 20/10/2026 · G. legitimate interests, assessment done · H. Y · I. Partial: source named, but not that the turnover band is a guess · J. Y · K. None · L. 20/10/2026 in first email · M. Given on time · N. add "estimated by the tool" to the data categories; owner: partner in charge of marketing.
Example row 3, a recruitment agency, "Example AI sourcing tool" collecting profiles from public pages: A. crawler and AI ranking of candidate profiles · B. name, current employer, skills, AI fit score · C. 15/09/2026 · D. blank · E. 30/09/2026, shared with a client · F. 30/09/2026 · G. legitimate interests, no assessment yet · H. N · I. N · J. N · K. None · L. blank · M. Fix notice · N. stop sharing, write the assessment, send notices, check the Article 22 automated decision sheet for the fit score; owner: managing director.
Example row 4, a web design agency, "Example lead-scan app" from a trade fair organiser: A. visitor badge scans exported by the organiser, cleaned up by an AI tool · B. name, work email, phone, company · C. 05/10/2026 · D. blank · E. blank · F. 05/11/2026 · G. legitimate interests · H. Y · I. Y · J. Y · K. None (the organiser's notice did not name the agency) · L. blank · M. Due 05/11/2026 · N. send the follow-up email with the notice this week; owner: sales lead.
If you want to claim an exception
- Already has the information (Art. 14(5)(a)): write down how they got it and when. A partner's own notice only counts if it covered your business and your purpose.
- Disproportionate effort (Art. 14(5)(b)): Recital 62 points to the number of people, the age of the data and the safeguards. Write down your reasons and take appropriate measures, including making the information publicly available. If you are going to email the person anyway, Article 14(3)(b) already gives you a moment to tell them, so this exception is usually hard to argue.
- Laid down by law or professional secrecy (Art. 14(5)(c) and (d)): note the exact law. Accountants should check their own secrecy rules before relying on this.
Do this week
- List every contact source you did not collect yourself, one row each, and record it once in your Article 30 records
- Fill columns C to E and let column F give you the deadline
- Add the source line and the separate objection line to your first-message template
- Write or check the legitimate interest assessment for each source
- Route "stop" replies to the erasure and objection request sheet
- If the AI tool is a US supplier, check the international transfer sheet and the AI supplier clauses
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 5(2), 6(1), 13, 14 and 21 and Recitals 47 and 62, as published on gdpr-info.eu) and the Article 29 Working Party Guidelines on transparency under Regulation 2016/679 (wp260rev.01). Example rows are made up for illustration and do not describe any real business or supplier. Checked on 24 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Small clients who start using AI lead-enrichment tools or buy lists rarely know that a notice is due within a month or at the first message. Hand them this sheet with the client AI inventory so the source, deadline and wording are written down. Stay inside your professional rules and refer legal questions on.
Keep the answer next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once and attach its notice row and first-message wording as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: Article 13 privacy notice AI section · legitimate interest assessment · data retention schedule · Article 7 consent record sheet
Sources
- Article 14 GDPR, Information to be provided where personal data have not been obtained from the data subject (with Article 13, Article 21, Article 6, Recital 47 and Recital 62); official text: Regulation (EU) 2016/679
- Article 29 Working Party, Guidelines on transparency under Regulation 2016/679 (wp260rev.01)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.