The job change signal is rarely the thing that stalls a purchase. The legal review is.
Someone in procurement asks whether monitoring your own customer contacts for job moves is lawful, nobody on the deal team can answer in the language a DPO wants, and a signal that would have paid for itself sits in limbo for a quarter. This post is the answer, written so you can forward it.
One caveat up front: this is a practical summary with primary sources attached, not legal advice. Your counsel still has to sign the assessment. What follows is designed to make that conversation short.
Is job change tracking GDPR compliant?
Short answer: yes, job change tracking can be lawful under the GDPR, and it is normally justified on legitimate interests under Article 6(1)(f). It is not automatically lawful. Three things have to be true, and only one of them is about the vendor:
- You can articulate and document a legitimate interest, and show the processing is necessary for it and proportionate to it.
- The contact gets the privacy information Article 14 requires, by the deadline Article 14 sets.
- You honour an objection to direct marketing immediately and permanently.
Miss any of the three and the problem is not that you bought the wrong tool. It is that you skipped the paperwork.
What legal basis covers job change tracking?
Legitimate interests. Article 6(1)(f) permits processing that is “necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject” (GDPR Article 6(1)(f)).
Commercial motive does not disqualify you. Recital 47 says plainly that “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest” (GDPR Recital 47). The Court of Justice confirmed the broader point in 2024, holding that a commercial interest “could constitute a legitimate interest, within the meaning of point (f) of the first subparagraph of Article 6(1) of the GDPR, provided that it is not contrary to the law” (Case C-621/22, Koninklijke Nederlandse Lawn Tennisbond, Ninth Chamber, 4 October 2024, ECLI:EU:C:2024:858, paragraph 49).
Read the operative part of that judgment carefully though, because the shorthand version circulating in vendor decks is too generous. The Court allowed the commercial interest “only on condition that that processing is strictly necessary for the purposes of the legitimate interest in question” and that the data subjects’ rights do not override it. The EDPB makes the same correction to anyone waving Recital 47 around: the recital “does not mean that direct marketing always constitutes a legitimate interest, and that it is automatically possible to rely on Article 6(1)(f) GDPR to engage in all kinds of direct marketing activities” (EDPB Guidelines 1/2024 on Article 6(1)(f), paragraph 110; these were adopted for public consultation and no final version has been published, so treat them as direction rather than a settled instrument).
So the basis exists. You still have to earn it.
How do you pass the three part test on a champion list?
The UK regulator sets out the standard structure: a purpose test, a necessity test and a balancing test. The ICO is explicit about the obligation and the record: “To demonstrate that legitimate interests applies, you must do the three-part test. You should document the outcome. We refer to documenting the outcome as a ‘legitimate interests assessment’ or LIA.” It also says to do it before you start: “You should do your LIA before you start using the personal information” (ICO, How do we apply legitimate interests in practice?).
This is where champion tracking separates from cold prospecting, and the difference is substantive rather than cosmetic. The balancing test turns on expectations. Recital 47 asks “whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place,” and warns that rights override the controller “where personal data are processed in circumstances where data subjects do not reasonably expect further processing.”
Now compare two signals.
A cold intent signal involves a person who has never heard of you, whose data you acquired from a source they never pointed you to, being profiled for a pitch they would not anticipate. That is a hard balancing test.
A champion move involves a person who gave you their details during a commercial relationship, used your product, and would be unsurprised to hear from the vendor they already worked with. The ICO addresses this population directly: “It’s likely that much of what you want to do with this information is lawful on the basis of legitimate interests. But there’s no absolute rule here, and in all cases, you must apply the three-part test.” And on why: “Business contacts are more likely to reasonably expect you to use their personal information in a business context. Such use is less likely to have a significant impact on them personally” (ICO, When can we rely on legitimate interests?).
Two practical notes for the necessity limb, given the “strictly necessary” language in C-621/22. Monitor the contacts you have a relationship basis for, not your entire database, and keep the field set to what the play actually requires. A scope you can defend is a narrow one. If your vendor offers pre-move or intent-to-move detection, name that separately in the assessment rather than folding it into “job change data,” because it is a distinct inference about a person and deserves its own line.
When do you have to tell the contact?
This is the obligation teams miss, and it is the cheapest one to satisfy.
Because the new-role data did not come from the person, Article 14 applies. The headline deadline is “within a reasonable period after obtaining the personal data, but at the latest within one month” (GDPR Article 14(3)).
The trap is that one month is often not your real deadline. Article 14(3)(b) requires the information “at the latest at the time of the first communication to that data subject,” and 14(3)(c) “at the latest when the personal data are first disclosed” to another recipient. For a job change play, the whole point is to reach the champion in days, not weeks. So the operative deadline is the first touch, and in practice the fix is a line in the first email pointing at your privacy notice. The ICO states the same rule for marketing data: “If you collect personal data from sources other than the individual (eg public sources or from third parties), you must provide privacy information within a reasonable period of obtaining the data and no later than one month from the date of collection” (ICO, Business-to-business marketing).
Do not lean on the disproportionate effort exemption without reading the rest of the sentence. Article 14(5)(b) excuses notice where it “proves impossible or would involve a disproportionate effort,” but immediately adds that “the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available.” It converts one obligation into another. For a few hundred contacts a month, sending the notice is less work than arguing the exemption.
What happens when someone objects?
You stop, and there is nothing to weigh. Article 21(2) gives the data subject “the right to object at any time” to processing for direct marketing, and 21(3) is unqualified: “Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes” (GDPR Article 21). Unlike the general objection right in 21(1), this one has no balancing step.
The operational requirement that follows is specific to this use case: your suppression list has to be keyed to the person, not the email address. A contact who opted out at their old company has not re-consented by acquiring a new mailbox. If your suppression logic matches on email, a job move silently resurrects an opted-out person and the system does it automatically. Confirm the vendor suppresses at person level and that the flag survives the move, because that is a design question you cannot patch later with a workflow rule.
Are you allowed to send the email?
Lawful basis and marketing permission are two separate questions, and passing the first does not answer the second. The rule depends on where the recipient is.
UK and EU electronic marketing. In the UK, the consent rule for unsolicited email is scoped by PECR regulation 22(1), which “applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers” (PECR reg. 22). The ICO draws the practical line: “In general the marketing rules in PECR apply equally to corporate subscribers and individual subscribers. The main difference is that the rule on marketing by electronic mail (eg email or text message) doesn’t apply to corporate subscribers,” and so “you can email or text any corporate body.” Two qualifiers matter for a CRM list: “Sole traders and some partnerships are treated as individuals, so you can only email or text them if they have specifically consented,” and keeping a do-not-email list for objecting businesses is “good practice.” The ICO also reminds you that the other regime still runs underneath: “If you are processing personal data for direct marketing purposes, even in a business context, the UK GDPR applies” (ICO, Electronic mail marketing). EU member states implement the same directive with local variation, so check per country rather than assuming the UK position travels.
United States. CAN-SPAM is a disclosure and opt-out regime rather than a consent regime, and the FTC closes the obvious escape hatch: “The law makes no exception for business-to-business email. That means all email must comply with the law.” The operative duty is speed: “You must honor a recipient’s opt-out request within 10 business days,” and any opt-out mechanism “must be able to process opt-out requests for at least 30 days after you send your message” (FTC, CAN-SPAM Act: A Compliance Guide for Business).
Canada. CASL is the strict one. It “is prohibited to send a commercial electronic message unless the person to whom the message is sent has consented to receiving it, whether the consent is express or implied,” and the implied consent list is exhaustive: “consent is implied only if” one of the listed conditions applies (CASL, S.C. 2010, c. 23, ss. 6(1) and 10(9)). Note which limb you are relying on. Section 10(9)(b) covers an address the person “has conspicuously published,” which a new work email inferred or appended by a vendor generally is not. Section 10(9)(c) covers an address the person “has disclosed, to the person who sends the message,” which is closer to the champion case but attaches to the address they actually gave you. Get Canadian sends reviewed rather than assumed.
Does “publicly available” solve this?
No, and this is the most common wrong turn. The ICO puts it as well as anyone: “The UK GDPR doesn’t prevent you from using personal data from publicly available sources. However, you cannot assume that simply because an individual’s personal data is in the public domain they are agreeing to it being used for direct marketing purposes.” It then names the consequence people underestimate: “If you use publicly available personal data for your own purposes, you are a controller and take on full responsibility for compliance with data protection legislation for that personal data.”
That last sentence is the whole build versus buy argument in compliance terms. Scraping the detection layer yourself does not route around the regulation, it makes you the controller for the collection too. We walk through what that actually obligates, including the Clearview AI order and the EDPB’s position on public data, in should you build your own job change detection pipeline.
What to ask a job change data vendor
Put these in the security questionnaire. The answers should be in writing, not in a call.
- What is your role for each processing activity? Where are you a processor acting on our instructions, and where are you a controller using your own sources? Expect a split answer and ask them to map it.
- What are your detection sources, and what are your rights to use them? Terms of service exposure is a contract question, not a privacy question, and it is the one with the clearest precedent.
- Do you suppress at person level or email level? The only acceptable answer is person level, with the flag surviving a move.
- What privacy information do you provide, and who sends the Article 14 notice? Yours, theirs, or both, and on what trigger.
- Where do you process and store, and what transfer mechanism covers it? Ask for the specific mechanism, not a reassurance.
- What is your retention period for a monitored contact after we stop monitoring them?
- Will you sign a DPA on these terms, and will you support a DPIA if our risk assessment calls for one?
A vendor that cannot answer the controller and processor question crisply has not had the conversation before. That tells you something.
Champions is built by Champions OÜ, registered at Viru väljak 2, 10111 Tallinn, Estonia. For an EU buyer that is worth a line on the diligence sheet, because an EU-established provider is in scope as a matter of establishment and sits under an EU supervisory authority rather than being pulled in only by the extraterritorial reach of Article 3(2). Note what that does and does not tell you: establishment is a jurisdiction question, not a hosting question, and the two are independent. Our current security, encryption, breach notification and data centre position is written up on the data protection page, so read that rather than inferring residency from the registered address.
Put the seven questions above to us the same way you would to anyone else, including the ones about our own sources. [email protected] reaches a human who can answer them.
Why this signal is the easiest one to defend
Step back from the articles and look at what the compliance load actually buys.
Every month, 2 to 3% of your B2B contacts change jobs. Only about 6% of them tell the vendor they used to buy from, which means 94% of these moves are invisible unless something detects them. On a 10,000-contact CRM, roughly 20% surface as hot leads on day one, about 2,000 conversations, then 200 to 300 new warm leads every month after that. Champion-sourced deals close with 2.7x higher probability, in roughly half the sales cycle, which tracks with the broader pattern: a 60 to 70% chance of selling to an existing relationship against 5 to 20% for a new prospect, 65% of business coming from existing customers, and acquisition running 6x the cost of retention.
Then notice the compliance shape. A few hundred events a month is not a bulk processing programme, so the volume is proportionate on its face. The population is people who chose to do business with you, which is the strongest position you can take into a balancing test. The purpose is a relevant business message to a business contact in their professional capacity, which is the use the ICO describes as less likely to have a significant personal impact. Compared with a cold intent signal built on strangers, this is a narrower scope, a better expectations argument and a smaller footprint, for a higher conversion rate.
The signal with the best legal posture is also the one that converts best. That is not a coincidence. Both follow from the same fact: the relationship already exists.
Where to start
Write the LIA before you buy, not after the DPO asks. One page covering purpose, necessity, balancing, the Article 14 trigger and person-level suppression is usually enough, and having it drafted turns a procurement cycle into a review rather than an investigation.
On the delivery side, Champions writes each detected move back to the CRM and routes the alert to the owner who held the relationship, across Salesforce, HubSpot, Pipedrive, Zoho and others, with no app to install and no logins for reps. The platform page covers the monitoring loop, use cases covers what RevOps owns in it, and the API page has the event fields and delivery modes if the signal needs to reach a warehouse or a lead router instead. For how the detection approaches differ across the category, the job change tracking comparison puts the tools side by side.
We also back the signal contractually. If champion-sourced revenue does not reach 2x your annual service fee, you are covered under our terms. Among the compared tools, only Champions offers that.
The fastest way to settle this is to see the moves sitting in your own database and the paperwork that comes with them in the same conversation. Book a demo and bring your legal questions to it. If you would rather start in writing, email [email protected] and we will send the diligence answers first.
Your champions are moving either way. The only question is whether you detect it on a basis you can defend.
