GDPR: Q&A and Best Practices

1. What do the terms "personal data" mean, and who is designated by the term "data subject"?

Personal datameans "any information relating to an identified or identifiable natural person."

The data subject is the natural person to whom the processed data relates.

Anonymous data refers to information not relating to identifiable individuals.

Information such as postal addresses, telephone numbers, faxes, or email addresses — even without surnames — constitutes personal data if the person can be reasonably identified. This interpretation is consistent with the Federation of European Direct Marketing (FEDMA) Code of Conduct.

2. Are the data of legal entities also covered and protected by the GDPR?

Data relating to legal entities (name, registered office, company number) are not protected by GDPR rules.

However, data identifying natural persons within these entities — such as employee contact details or professional email addresses — are subject to GDPR requirements.

This includes information related to self-employed individuals (consultants, lawyers, professionals).

3. How does the GDPR regulate the processing of personal data in marketing campaigns, and what are the legal bases and purposes associated with such processing?

Purpose requirement

Processing must pursue a specific, explicit purpose. Examples from the Belgian DPA's 2025 recommendation include:

• Informing customers about new products or services
• Initiating product or service sales
• Establishing customer profiles
• Offering personalised promotions
• Keeping customers informed about campaigns
• Promoting brand image
• Inviting customers to promotional events
• Sending targeted offers matching interests
• Approaching new customers, subscribers, or affiliates

Legal basis 1: Consent

• Must be prior, clear, and explicit
• Active opt-in required
• Must be freely given, specific, informed, and revocable
• Data subjects can withdraw consent at any time
• For electronic communications, consent is typically required per the e-Privacy Directive, Article 13

Important: Consent is not freely given if making it a condition for receiving a service or benefit.

Legal basis 2: Legitimate interest

Legitimate interest can serve as a valid legal basis if it does not infringe on data subject rights and freedoms. It applies to existing customers who expressed interest in similar products or services when data was obtained from a sale (soft opt-in principle).

A Legitimate Interest Assessment (LIA) is required, involving:

• Identifying the pursued interest
• Verifying processing necessity
• Conducting a balancing test between interests and data subject rights

Data subjects must be able to object from first contact. If they do, processing must cease immediately.

4. What is meant by direct and indirect marketing?

Direct marketing encompasses "all activities resulting in direct communication to one or more identified or identifiable natural person(s) of messages with promotional content."

Service emails (order confirmations, tracking updates, feedback requests) are not considered direct marketing as they execute the buyer-seller contract.

5. In your marketing campaigns, who is responsible for data processing?

You are the data controller when you determine the purposes and means of personal data processing.

Data controller obligations

• Ensure lawful, fair, transparent processing for specific, explicit, legitimate purposes; retain data only as long as necessary
• Guarantee transparency: clearly inform data subjects about data collection and processing
• Obtain explicit, informed consent when required; provide withdrawal capability
• Facilitate data subject rights: access, rectification, erasure, processing restriction, portability, objection
• Implement appropriate security measures against unauthorised access, loss, or destruction
• Notify the DPA and affected data subjects of personal data breaches within 72 hours of awareness
• Maintain detailed records of processing activities

Note: Organisations purchasing data lists must be especially vigilant in complying with transparency obligations, including identifying data sources. Failure constitutes an Article 14 GDPR breach.

6. What is INFOBEL's role in the processing of data used for your marketing campaigns?

INFOBEL operates as a data controller at multiple levels:

• Acquisition and sale: Collects, validates, and sells databases with personal information for direct marketing
• Data processing and management: Processes data focusing on quality and relevance through updates, accuracy improvements, and consent management for GDPR compliance
• Segmentation and targeting: Enables data segmentation using statistical assessments and algorithms to optimise campaign relevance and ROI

You (the purchaser) remain the data controller in your marketing campaigns.

INFOBEL fulfils transparency obligations by providing data origin and validity information. It has implemented measures ensuring smooth handling of data subject rights requests (deletion, rectification).

7. Where do the data that INFOBEL provides to you come from?

INFOBEL data comes from indirect collections via data brokers who collect through:

• Contests, promotions, and newsletter sign-ups
• Purchasing databases from partners and third-party suppliers

INFOBEL implements regular verification mechanisms including:

• Postal address accuracy verification
• Checking against Robinson lists and "do not call me" (DNCM) lists

8. What are the rights of the individuals whose data you process?

As data controller, you are responsible for responding to data subject requests.

Right of access (Article 15)

Individuals can know if data is being processed, obtain copies, and receive information about data source, legal basis, and processing purpose.

Right to rectification (Article 16)

Request correction of inaccurate or completion of incomplete personal data.

Right to erasure (Article 17)

Request deletion when data is no longer necessary or processed unlawfully, including the right to be forgotten and delisting from search engines.

Right to restriction of processing (Article 18)

Request processing restriction when:

• Contesting data accuracy, pending assessment
• Processing is unlawful but erasure is not desired
• Data is no longer needed by the controller but is required by the subject for legal claims

Right to data portability (Article 20)

Receive data in a readable format and transfer to another organisation (when processing is automated and based on consent or contract).

Right to object (Article 21)

Object at any time for reasons related to a particular situation, especially for direct marketing based on legitimate interests. Marketing emails must include clear unsubscribe mechanisms.

Right to lodge a complaint (Article 77)

File complaints with the Data Protection Authority.

Important: Notify INFOBEL of any necessary rectifications or erasures. Data subjects can withdraw consent via dpo.infobel.com.

These rights are not absolute and are subject to exceptions (legal or contractual obligations, legal claims defence, prevailing legitimate interests).

9. Why and how must you inform data subjects about your data processing, particularly within the framework of your marketing campaigns?

Per Belgian DPA recommendations, controllers must provide transparent information whether collecting data directly or indirectly.

Direct collection (Article 13)

Provide clear information at the time of collection. For example, include a privacy policy on newsletter subscription forms.

Indirect collection (Article 14)

Inform data subjects about data sources when obtained indirectly (e.g. purchased from INFOBEL). Explain how the data will be used and how subjects can exercise their rights.

Exceptions: If providing information proves disproportionately effortful, controllers must demonstrate technical impossibility or unreasonableness per Article 14 exceptions.

10. Who can data subjects contact to exercise their rights?

Data subjects may exercise their rights by:

Web form

Complete the form at dpo.infobel.com

Mail

DPO – INFOBEL SA
Chaussée de St Job, 506
1180 Brussels, Belgium

Requirements

• Copy of identity document
• For legal entities: proof of representative authority

Response timeline

• Within one month of request receipt
• Extendable by two months for complex requests
• Extension notification within one month of initial receipt

Note: InfobelPRO cannot remove data from third-party websites. Data subjects must contact those sites directly.