"How did you get my data?" How to answer, with the GDPR Article 14 notice

Answer in the first line with the real source, say what you hold and why you wrote, and offer to delete it or stop. GDPR Article 14 asks you to tell people the source and more when you did not collect their data from them, at the latest at first contact. Keep a record of where every contact came from so you can answer in minutes. This is not legal advice.

"Where did you get my details?" is one of the most common replies to cold outreach, and the answer you give in the next ten minutes decides whether it ends there or becomes a complaint. This post covers what to say, what the law expects you to be able to say, and how to build the record that lets you answer without searching. The legal statements come from the GDPR text and from regulator guidance, read on 25 October 2026. Rules differ by country and change, and nothing here is legal advice.

Why do people ask?

Because a message that arrives without context feels like surveillance. The question is rarely hostile. It is usually "do you have a right to be writing to me, and what else do you know?" A short, specific answer settles both. A vague one confirms the worry.

The question is also a legal one. Under the GDPR, people have a right to know where you obtained their data, and a right to object to direct marketing. A reply that dodges both is the one that ends up with a regulator.

What should the first reply say?

Four things, in this order:

1. The source. Name it exactly. "Your public LinkedIn profile", "the team page on your website", "[provider name], a business contact database".
2. What you hold. A short list: name, role, company, work email.
3. Why you wrote. One real reason tied to their role or a post.
4. A way out. Offer to delete the data or stop writing, and mean it.

Three examples, with placeholders:

Public profile: "Fair question, [first name]. I found your name and role on your public LinkedIn profile, and wrote because [reason]. All I hold is your name, job title and company. If you would like me to delete it or stop writing, tell me and I will do both today."

Company website: "Good question. Your name and work email are listed on [page], and I wrote because [reason]. I hold only that. I am happy to remove it if you prefer."

Database provider: "Your work details came from [provider], a business contact database we use. I hold your name, role, company and work email. I can remove them now, and I have added you to our do not contact list."

The matching reply template has a fourth, longer version for formal requests.

What does GDPR Article 14 require?

Article 14 applies when you did not collect personal data from the person themselves, which is the case for most cold outreach. It lists what you must provide:

• Your identity and contact details.
• The purposes of the processing and the legal basis.
• The categories of personal data concerned.
• The recipients, if any.
• The source the data came from, and whether it came from publicly accessible sources.

On timing, Article 14(3) says within a reasonable period after obtaining the data and at the latest within one month, or, if you will use the data to contact the person, at the latest at the first communication. Article 14(5) lists exceptions, for example where the person already has the information or providing it would take disproportionate effort. Whether an exception covers your case is a legal question.

Some teams put a short notice or link in the first message or the signature, and a full privacy notice on their site. The reply above is the short version. If someone asks formally, give the full list.

Is legitimate interest enough?

Recital 47 says the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest, weighed against the reasonable expectations of the people concerned. Article 21 gives individuals a right to object to direct marketing at any time, and then you must stop. The ICO adds that a named work email is personal data, so UK GDPR applies in a business setting. National rules on email and messaging, such as the UK PECR, apply on top, and treat companies and individuals differently. Our post on whether cold email is legal lists the regimes. None of this makes outreach always lawful. It means outreach can be lawful when you have a real interest, honest notice, a relevant audience and an easy stop.

What record should you keep?

You can only answer fast if you know. For every contact, store:

• The source, as a name and, where useful, the page or date.
• The date you obtained it.
• The reason you contacted them.
• Any opt out, on every channel.

Sellinger keeps each lead in a built in CRM with its conversation history. When a contact replies with an opt out such as STOP or unsubscribe, in English, Bulgarian or German among other forms, the contact goes on the team's suppression list, the agent stops and the lead is closed out. Before every send on email, LinkedIn and WhatsApp, the platform checks the list. For a request to delete data, an erasure function anonymizes the matching lead and adds the identifiers to the suppression list. See discarding a lead and data requests.

What mistakes make it worse?

• Guessing the source. If you say "your public profile" and the data came from a provider, you have made a false statement to someone who is already doubtful.
• Answering a different question. They asked where the data came from. A paragraph about your product is a dodge.
• Arguing the law. Quoting legitimate interest at an annoyed person turns a short exchange into a dispute. State the facts and offer the exit.
• Stopping on one channel only. If they leave a thread on LinkedIn and get an email the next day, the apology is worth nothing. Record the stop everywhere.
• Asking why they object. They do not owe you a reason.

What if it is a formal request?

A message that says "this is a subject access request" or "I object under Article 21", or that comes from a lawyer or a regulator, is no longer a casual question. It starts a legal clock. Stop all contact at once, pass the message to the person responsible for data protection in your company, and keep a copy of what you have said and sent so far. Use the casual replies above only for casual questions. The ICO's business to business marketing guidance, linked below, also reminds that individuals have an absolute right to object to direct marketing under the UK GDPR, which is why an opt out should be quick.

What should you do next?

• Write your three standard answers now, one per source you really use.
• Make sure you know the provider name behind every imported list.
• Add a link to your privacy notice to the first message or signature.
• Treat any request that cites the law as a task for a person, with the deadline in mind.
• Check the rules for each country you contact.

Again, this is general information, not legal advice. If you receive a formal request or a regulator's letter, take advice before you reply.