Business development: rules for transmitting data to partners (B2C)

There sales prospecting It remains a growth driver, but transferring customer or prospect files to partners is not something that can be done without preparation. On June 10, 2026, the CNIL has reiterated the rules applicable to these B2C personal data transfers — and a new deadline is shaking up the telemarketing landscape. Here's a channel-by-channel summary of what you need to do to remain compliant without hindering your business growth.

Key takeaways

  • Transmit data to partners for their sales prospecting obeys rules that depend on the channel used.
  • Postal mail Legal basis = legitimate interest; information + right to object simple and free.
  • Electronic means or telephone information and consent prerequisites.
  • New (law of June 30, 2025) : from the August 11, 2026no more telephone solicitation without explicit consent (except for contracts in progress).
  • Consent is not transmitted "by cascade"; the partner who receives the data informs the person within one month.

Diagram reconstructed from the CNIL — “B to C prospecting: transmitting data to partners” (June 10, 2026).

Sharing data with partners: what are we talking about?

Let's start by defining the framework of the practice, because it is more widespread than we think and often poorly secured.

A common, regulated practice

It is common for an organization to share a contact list with partners for use in their operations. sales prospectingThese transfers take place within the framework of commercial agreements or for a fee — in other words, the file is sometimes sold.

The principle is not prohibited, but it is strictly regulated. As soon as personal data is involved, the GDPR applies, and the responsibility of the transmitting organization is engaged far beyond the simple sending of the file.

The stakes are twofold. On the one hand, these file exchanges fuel a real portion of sales acquisition, both in B2C and lead generation. On the other hand, it is precisely these practices that the CNIL Keep a close eye on it, because they multiply the recipients that the person never chose. Properly structuring the transmission process therefore protects both your partners and your own exposure to risk.

The rule varies depending on the prospecting channel.

The determining factor is the channel the partner will use for prospecting. Postal mail on one hand, electronic means or telephone on the other: the obligations are not the same, and confusing the two systems exposes one to penalty.

In all cases, the organization remains bound by the general obligations of the GDPR The obligations are to minimize data, limit its retention period, ensure its security, and facilitate the exercise of rights. Transmission does not eliminate these obligations; it adds to them.

Commercial prospecting by postal mail: information and objection

Let's start with the most flexible system, that of paper mail. Flexible does not mean without rules.

Legitimate interest as a legal basis

When partners prospect by mail, the transmission of data may be based on the legitimate interest of the transmitting organization. Therefore, it is not necessary to collect the consent people for that transmission.

This legal basis, however, is not a blank check. It requires a balance between the interests of the company and the rights of individuals, a balance that rests on two concrete guarantees. If one of these is lacking, the legitimate interest no longer holds and the transfer becomes unlawful.

Inform and enable the right to object

First, the transmitting organization must inform the individuals beforehand, for example on the data collection form. This information specifies the purpose of the transmission and the categories of recipients: sectors concerned, type of solicitation, approximate number of partners.

Next, each person must be able to exercise their right to object in a simple and free way, both at collection and at any time — typically via a checkbox. CNIL It is also recommended, as a good practice, to publish a comprehensive and up-to-date list of partners, with their identity and a link to their privacy policy.

Commercial prospecting by electronic means or telephone: consent is required

The rules become significantly stricter when it comes to email, SMS, automated calling systems, or telephone calls. Here, consent becomes the rule.

The principle: prior information and consent

For these channels, the organization wishing to transmit data to its partners must obtain the consent people for this transmission. consent must be free, informed and specific: the person must understand who their data will go to and for what purpose.

This represents a shift in logic compared to postal mail. We no longer simply inform and offer an outing: we require a positive, prior agreement, and we must be able to provide proof of it.

Telemarketing: what will change on August 11, 2026

A major change is coming. The law of June 30, 2025, modifies the rules for telephone marketing: as of August 11, 2026, consumers will no longer be able to be contacted by telephone without having given their consent Explicit prior notice, except when the appeal concerns a current contract.

This represents a complete reversal of the current approach, which relied on opting out via the Bloctel list. The implementing regulations will specify the details, but the direction is clear: without consent, no more calls. The companies concerned would be wise to review their processes now.

Two cases depending on who obtains the consent

There CNIL distinguishes two hypotheses. In case no. 1, recommended, the transmitting body also collects consent for prospecting from its partners: a single checkbox, unchecked by default, can cover both transmission and prospecting, provided that the identity of the partners is clearly disclosed and an exhaustive and up-to-date list is provided.

In case #2, the organization does not collect this consent for its partners. It then provides information on the categories of recipients and collects consent only for the transmission; it is then up to each partner to collect the consent to its prospecting. These solicitations may be based on legitimate interest, but must not promote the partner's products and must remain limited in number.

Are you sending files to partners and want to secure your consents?

Speak to a Viqtor® expert.

Rules that apply in all situations

Some principles apply regardless of the channel. Neglecting them undermines all other precautions.

No consent transmitted "in a cascading fashion"

THE consent Data collected by the organization on behalf of its partners is valid only for those partners. A partner wishing to share the data with its own partners must obtain new consent. Consent is not automatically transmitted.

This rule puts an end to a classic abuse: the chain resale of files that end up in hands that the person has never known or accepted.

Information from the partner who receives the data

Finally, the partner receiving the data must inform the individual from the first contact, and at the latest within one month. This information includes the name of the source company—the one that collected and then transmitted the data—as well as the individual's rights, including their right to object and the withdrawal of his consent.

This point is often overlooked by receiving partners, even though it determines the legality of all their prospecting activities. A purchased database never exempts them from this obligation of transparency.

In practice, this means sending an initial message upon receipt of a file that identifies the data source and outlines the recipient's rights. Many organizations include this information directly in their first email or letter of contact, resolving the issue without any additional steps. Conversely, those that solicit first and then inform later risk a complaint, which is all the easier to file if the recipient is unaware of the origin of the request.

Staying compliant in sales prospecting: document and prove

These rules are only valid if you can demonstrate that you have complied with them. However, prospecting is consistently among the leading reasons for sanctions against the [organization/company/etc.] year after year. CNIL.

Proof of consent and information

THE GDPR requires proving the consent and the information provided, not just asserting them. In 2024, the sales prospecting was among the major themes of sanction, including a fine of 50 million euros against a major operator; in 2025, prospecting still gave rise to about ten sanction decisions.

Maintaining the timestamps of consents, the version of the information notices displayed, and the list of current partners is therefore essential. This is precisely what a living register and structured governance can ensure, via the GDPR governance module.

Governing its partners and its treatments

Data transmission creates a chain of responsibilities that must be managed. Evaluate and monitor partners, formalize commitments, and keep track of who receives what. the subcontractor evaluation module And the sovereign Viqtor® platform equip this mastery from start to finish.

When properly managed, compliance ceases to be a hindrance to prospecting: it becomes the condition for sustainable prospecting, which exposes neither to sanction nor to loss of customer confidence.

FAQ — Sales prospecting and referral to partners

Yes, the data transmission Paid outreach is not prohibited in itself, but it is strictly regulated. Depending on the prospecting channel targeted, it requires either information and a right to object (postal mail), or prior consent (electronic or telephone). Without these guarantees, the sale or sharing of the file directly exposes the user to legal action.

No. For direct mail marketing, the transmission of information can be based on legitimate interest. However, individuals must be informed beforehand and given the opportunity to easily and freely object at any time. CNIL also recommends publishing the updated list of partners.

From August 11, 2026, in accordance with the law of June 30, 2025, a consumer will no longer be able to be contacted by telephone without having given their explicit prior consent, unless the call concerns an existing contract. This is the reverse of the current opt-out system: silence will no longer constitute consent.

Yes, in the case recommended by the CNIL A single box, unchecked by default, can cover both the transmission and prospecting of partners. This is provided that the identity of the partners and the purposes of the data processing are clearly disclosed, and that a comprehensive and up-to-date list is provided at the time consent is obtained.

Yes. The receiving partner must inform the individual upon first contact, and at the latest within one month. They must state the name of the company that transmitted the data and remind the individual of their rights, including the right to object and withdraw consent. This obligation applies even if the data file was purchased.

Secure your prospecting campaigns and data transmissions.

Request a Viqtor® demonstration.

To learn more, find all our resources on the data governance and GDPR compliance on the Viqtor platform.

en_USEN
fr_FRFR de_DE_formalDE es_ESES elEL it_ITIT hrHR pt_PTPT nl_NL_formalNL de_ATDE_AT etET fiFI lvLV lt_LTLT sk_SKSK sl_SISL en_USEN