▷ What is the impact of the GDPR on B2B and B2C marketing?

Today, the protection of personal data has become a real challenge for companies with the entry into force of the General Data Protection Regulation on May 25, 2018. Thus, the processing of personal data has become more stringently regulated. So you should now take this into account when researching in order to avoid penalties imposed by the CNIL. Let’s check in…

Consent, one of the main foundations of the General Data Protection Regulation (GDPR)

As part of the development of its activities, the company must collect personal data of its customers or potential customers in order to implement their prospecting strategies. The process used is the same whether in a B2C or B2B context. Marketers may not collect or use personal data without the consent of the owners. This is one of the six legal bases of the General Data Protection Regulation (GDPR).

This provision is enshrined in Sections 4 and 7, which was already mentioned in the Data Protection Act 1978 and was updated in 2004. Consent allows individuals to whom it relatesThey control their data.

They have the right to know the purpose of using the data collected by a particular company. They can decide to refuse this use if they think it might harm them. They can also accept their own free will, with full knowledge of the facts.

Finally, whether they accept or decline, they have the right to change their mind. Whether it’s B2C or B2B, the GDPR requires companies to clearly identify and authenticate their identities, and make an objection form available to customers who no longer wish to receive such emails, which they often consider to be invasive. Said form must contain a link allowing them to unsubscribe or unsubscribe.

Subscribe to B2C

There may be differences between B2B and B2C companies in terms of approval.

In the context of Business to Consumer (B2C) marketing where business exchanges take place between businesses and individuals, subscription is essential. Recipient consent must be obtained prior to any form of advertising prospecting. The agreement must be clear. He agrees to receive digital advertisements and newsletters of all kinds via his email or phone number among others.

If the company wants to transfer the data it has to other partner companies, the customer must also give his consent. However, two exceptions must be taken into account. Approval is not mandatory for persons who are the subject of prospecting and who have already made purchases from the company. This is valid if the products offered on it are the same as those purchased before.

Withdrawal in B2B

B2B marketing refers to the business exchanges between two companies. In this caseConsent not required The principle of non-participation is applied. In this context, sending commercial emails will not require the recipient’s permission.

However, it is necessary to inform the latter of the commercial use of his email address. In addition, the products or services that are the subject of digital marketing must be related to the professional activities of the contacted individual.

Individual rights in relation to data use

In addition to consent, the protection of personal data is the same for all residents of the European Union. This is why transferring data to the US can be problematic, as laws may vary from country to country outside of Europe. Individuals whose personal data has been collected by a particular company can now exercise their rights, as already mentioned in Directive 95/46/EC, which was repealed in 2018 when the GDPR came into force:

  • This is the possibility, for those whose personal data has been collected for commercial purposes, to retrieve it at any time;
  • He has a right to be forgotten. This consists in asking the data controller to remove private information that could harm him from the World Wide Web;
  • The customer also has the right to object, which means that he can refuse the use of his data by a company or any organization, if the target is not for commercial purposes. The opposition must be justified. However, if the use that has been used falls within the scope of commercial exploration, the right of opposition may be applied without cause;
  • When using the collected data, you may be exposed to errors. The individuals concerned can exercise their right to rectification. This right can also intervene when it is necessary to update personal information or when its collection or storage is prohibited.

Obligations of companies regarding the use of collected personal data

Les entreprises qui collectent des données personnelles que ce soit par le biais des annuaires libres d’accès, grâce aux formulaires remplis en connaissance de cause par l’internaute quand il s’inscrit sur aux newsletter, ou quand pour il demand trav devis for example. It can be aggregated by the searches he performs or by the sites he visits.

Marketing strategies are developed from this information from Internet users’ publications, and their centers of interest. No matter how this data is obtained, companies have to enter it into a well-detailed log so that it can be traced and identified later.

Whether in B2B or B2C, in addition to keeping a record, Marketers must decide how long to keep data. The legal period has not been specified. But when the objectives set by the implemented marketing strategy are achieved, the personal data recorded by the company must be deleted or made anonymous or pseudonymized so that it can no longer be identified. All security measures must be taken to prevent leaks or illegal use.

The GDPR emphasizes three elements in order to improve the protection of user data.

  • Data controllers must ensure that only data inherent in products/services is collected.
  • In addition, it is necessary to determine the use from which it will be used by customers. Some companies hold sensitive data that may affect the individual rights and freedoms of an individual. It involves a data protection impact assessment application. It is mandatory in the context of health data processing including the collection of sensitive data relating to so-called vulnerable persons.
  • It is also required when the collected data is used to establish a profile of persons likely to be employed in a job, or when its purpose is to monitor said persons once they are employed. It can also happen if the data is used for profiling, as is often the case to personalize the processing of digital ads.


In conclusion, the GDPR is changing the way marketing works, whether in B2B or B2C. To avoid being penalized, the company and its partners must comply with the regulations.

Leave a Comment