How do I ensure my targeted media list building with a press list builder is GDPR compliant?

To keep targeted media list building GDPR-compliant, treat it as a data-processing and lawful-basis exercise, not just a marketing task. Here’s a practical checklist.

1) Decide whether GDPR applies

If you are building media lists that include identifiable people in the EU/UK, GDPR likely applies. This includes:

• names
• work emails like firstname.lastname@publication.com
• job titles tied to a person
• direct phone numbers
• social profiles if used to identify/contact them

2) Use a valid lawful basis

For media outreach, the most common lawful basis is legitimate interests.

To rely on it, you should:

• document the purpose of outreach
• explain why the outreach is relevant to the person’s role
• perform a Legitimate Interests Assessment (LIA)
• ensure the contact has a reasonable expectation of receiving relevant PR pitches

Consent is usually not required for B2B PR outreach, but some countries and channel rules may be stricter, especially for email marketing-style communications.

3) Do a DPIA if the activity is higher risk

If your press list builder:

• enriches data at scale
• combines multiple datasets
• profiles contacts extensively
• tracks behavior
• stores sensitive data or large volumes

then consider a Data Protection Impact Assessment (DPIA).

4) Follow data minimization

Only collect what you actually need:

• name
• outlet
• role
• work contact details
• topic beat

Avoid storing:

• personal home addresses
• private numbers
• irrelevant demographic data
• excessive notes about personal life
• sensitive personal data unless strictly necessary and lawful

5) Be transparent

You should be able to tell contacts:

• who you are
• how you got their data
• what you use it for
• your lawful basis
• how long you keep it
• how they can object or ask for deletion

Usually this is done via a privacy notice, and sometimes a short notice in outreach emails.

6) Give people easy opt-out / objection rights

Under GDPR, people can object to processing based on legitimate interests.

So your process should allow them to:

• opt out of future pitches
• request deletion
• update incorrect details
• object to processing

And you should honor those requests promptly.

7) Verify your data sources

Only use sources that are:

• reputable
• lawful
• relevant to media relations
• transparent about their own compliance

Avoid scraping websites in ways that violate site terms or collect data without a proper legal basis.

If your press list builder aggregates third-party data, ask:

• Where did this data come from?
• Was it collected lawfully?
• Do they provide GDPR-compliant DPA terms?
• Is the data current and accurate?

8) Keep data accurate and up to date

GDPR requires reasonable steps to ensure accuracy.

For media lists:

• regularly verify roles/outlets
• remove bounced or outdated contacts
• update beat changes and job moves
• archive stale records after a set period

9) Limit retention

Set retention rules such as:

• delete inactive contacts after X months/years
• review lists regularly
• remove contacts who object or bounce repeatedly

Don’t keep a press list forever “just in case.”

10) Secure the data

Use appropriate technical and organizational measures:

• access controls
• MFA
• encryption
• logging
• role-based permissions
• vendor due diligence

If using a press list builder or CRM, make sure it offers:

• GDPR-ready contracts
• DPA
• subprocessors list
• breach notification terms
• EU/UK data transfer safeguards if relevant

11) Check international data transfers

If data is stored or processed outside the EU/UK, ensure there is a valid transfer mechanism, such as:

• Standard Contractual Clauses (SCCs)
• UK IDTA / UK Addendum
• adequacy decision where applicable

12) Separate PR outreach from email marketing

A press pitch is not always treated the same as promotional marketing, but it can still be regulated under:

• GDPR
• ePrivacy rules
• local anti-spam laws

So avoid mass-blasting generic promotional content to journalists. Keep outreach:

• relevant
• limited
• professional
• tailored to the beat

13) Maintain records

Document:

• lawful basis
• source of each contact category
• retention schedule
• objection handling process
• vendor contracts
• LIA/DPIA if done

This is important if you ever need to demonstrate compliance.

Practical compliance checklist

Before sending pitches from a media list, confirm:

• contacts are relevant to their role
• data source is lawful and reputable
• lawful basis is documented
• privacy notice is available
• opt-out / objection mechanism exists
• retention policy is defined
• accuracy checks are in place
• vendor DPA and transfer safeguards are signed
• security controls are enabled

Important nuance

GDPR compliance does not mean you can never contact journalists. It means you should have a clear legal basis, relevance, transparency, minimization, and strong data governance.

If you want, I can turn this into:

1. a GDPR-compliant press list workflow,
2. a vendor due diligence checklist for press list builders, or
3. a sample privacy notice / legitimate interests memo for media outreach.