Establish a Lawful Basis for Processing
This is critical. For phone numbers, common lawful bases include:
- Consent:
- Explicit, freely given, specific, informed, and unambiguous: This is often the safest and most robust basis for marketing calls.
- Clear affirmative action: Individuals must bahrain phone numbers list actively opt-in (e.g., ticking a box, signing a statement). Pre-ticked boxes are not valid.
- Specific purpose: Consent for one purpose (e.g., email newsletter) does not equate to consent for another (e.g., marketing calls).
- Easy to withdraw: Individuals must be able to withdraw consent as easily as they gave it. You must have a clear process for this and act on withdrawal requests promptly.
- Contractual Necessity: Processing is necessary for the performance of a contract with the individual (e.g., providing a service where a phone number is essential for delivery).
- Legal Obligation: Processing is necessary to comply with a legal obligation (e.g., specific regulatory requirements).
- Legitimate Interest:
- This can be a valid basis for certain non-marketing communications or B2B cold calling, but it’s more complex.
- You must conduct a “Legitimate Interests Assessment” (LIA) to balance your legitimate interest against the individual’s rights and freedoms. Your interest must not override theirs.
- For direct marketing, Recital 47 of the GDPR states that “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.” However, this is always subject to the individual’s right to object.
- You generally cannot use legitimate interest for cold calling consumers without their explicit consent, especially if it’s for marketing purposes.
- Vital Interest: Processing is necessary to protect the vital interests of the individual or another person (rarely applicable to phone number lists for business operations).
- Public Interest: Processing is necessary for the google sge: what to expect in 2024 performance of a task carried out in the public interest or in the exercise of official authority (usually applicable to public bodies).
Important Note for Marketing Calls (PECR): In addition to GDPR, the Privacy and Electronic Communications Regulations (PECR) are highly relevant for marketing calls in the UK/EU. PECR often requires specific consent for automated marketing calls and places restrictions on live marketing calls, particularly for consumers (e.g., checking against Telephone Preference Service – TPS/CTPS).
Transparency (Privacy Notice)
- Inform individuals at the point of collection: Clearly explain:
- Your identity and contact details.
- The purpose(s) for collecting their phone number.
- The lawful basis for processing.
- Who you will share their phone fresh list number with (e.g., third-party dialers, CRM providers).
- How long you will retain their phone number.
- Their rights under GDPR (see below).
- Make your privacy policy easily accessible: This should be comprehensive and clearly detail your data processing activities related to phone numbers.
