In principle, any file/processing relating to personal data must be declared to the CNIL. This declaration must be made prior to the creation of the customer file and regardless of its processing. The leads generated correspond to data processing (since it involves the collection of commercial contacts).
What type of declaration should I make?
There are two types of declaration:
the normal statement
the simplified declaration
The common law regime is that of the normal declaration. After having declared a certain number of elements (name of the data controller, category of persons concerned by the processing, purpose of the processing, etc.) to the commission, the latter will return a receipt attesting to the completion of the declaration formalities. You will therefore be able to use the data that you have collected. c level contact list
However, over the years, the CNIL has implemented specific standards. This simplifies the reporting obligations for the most frequent categories of processing. This is only possible for processing whose implementation does not infringe on freedoms or privacy. There are currently 55 standards of this type, including standard NS-048 relating to customer-prospect files and online sales.
This simplified standard concerns the processing of personal data. In particular, that which has as its purposes customer management, prospecting, exchange of customer and prospect files, development of commercial statistics, transfer, rental or even loyalty operations.
Therefore, it directly concerns the generation of “leads”.