How to legally process scraped or enriched contact data?

You've just bought a contact list from a data broker or scraped LinkedIn yourself. Now comes the hard question: what can you legally do with it?

The short answer is that data being public doesn't make it legal to use for email marketing. GDPR requires you to have a lawful basis before processing anyone's data, regardless of where you found it. In the US, CAN-SPAM is less strict about the source, but it still has compliance rules once you start sending.

The real risks with scraped data. Scraping LinkedIn, company websites, or other platforms often violates their terms of service. It can also run afoul of computer fraud laws. The platform tracks scrapers and sometimes pursues legal action. Even if you buy from a broker, you inherit the risk that their scraping was illegal or unauthorized.

How enrichment complicates things. When you combine data from multiple sources (LinkedIn + company website + email finder), you're creating new profiles. That aggregation itself counts as processing under GDPR. You need to document where each field came from and why you have a lawful basis for each one. Legitimate interest is often the claim, but it requires actual assessment and is defensible only if a regulator challenges you.

What documentation actually matters. Keep records showing where your data came from and how you sourced it. Write down your legitimate interest assessment if that's your legal basis. Be prepared to explain your sourcing if a contact requests it (they have that right under GDPR). If someone asks you to delete their data, do it promptly. This isn't legal advice, but these records are your protection if things go sideways.

Your next step. Before scaling cold email, audit your data source. Ask your broker in writing how they obtained the data and whether it complies with GDPR and CAN-SPAM. If it's your own scraped data, consult a lawyer who handles email compliance. Validating your list is a good start, but it doesn't solve the legal exposure.