73% of enterprise buyers have paused or canceled a vendor evaluation due to data privacy concerns (Gartner, 2024). Many intent data vendors cannot produce a signed Data Processing Agreement, a documented lawful basis, or auditable data lineage. Programs that pass technical evaluation often stall in legal review. The six provenance questions asked before vendor selection help prevent legal delays and protect the program from a blocked renewal.
B2B Intent Data Compliance GDPR Data Provenance: The Question That Blocks Procurement
Demand
Oct 27, 2026
In one illustrative scenario, the intent data renewal was in legal review for six weeks.
The vendor was a top-tier provider. Good data quality, multi-contact behavioral cluster methodology, strong SDR conversion history. The renewal was $84,000. The demand gen team had the budget. The procurement team had signed off on the commercial terms.
Then the privacy review went to Legal.
Legal asked for the Data Processing Agreement. The vendor sent their terms of service. Legal asked again: a signed DPA conforming to GDPR Article 28. The vendor sent a template that had not been executed.
Legal asked for the sub-processor list for EU data. The vendor’s response: sub-processor information was proprietary.
Legal asked for the lawful basis documentation for EU data subjects’ behavioral signals. The vendor said their data was GDPR compliant.
Six weeks later, the renewal was blocked. Not because the data was low quality. Because the vendor could not answer three compliance questions that a procurement team now requires.
The marketing team had to find an alternative vendor in 30 days. The pipeline program paused. The cost of the compliance gap was not an enforcement fine. It was six weeks, a program pause, and a rushed replacement process that produced a worse vendor at a higher annualized cost.
Why Provenance Is Now a Procurement Gate
Procurement teams now treat provenance as a gate.
The shift happened for three reasons:
First, GDPR enforcement against data brokers and B2B data processors continued through 2024 (EDPB, 2024). Fines averaged about €2.14M across all countries from 2018 to 2024 (CMS Law, 2024). Legal and privacy teams that previously reviewed software vendors but passed on data vendors are now applying the same scrutiny to signal providers.
Second, US state-level privacy law expanded rapidly: 19 states had enacted comprehensive privacy legislation by Q1 2025 (IAPP, 2025), covering California, Virginia, Colorado, Texas, and others. The compliance surface for US-based intent data programs grew materially.
Third, procurement teams learned that ‘GDPR compliant’ is not a compliance status. It is a marketing claim. The documentation that supports it is either present or it is not. Procurement now asks for the documentation.
What GDPR Actually Requires for Intent Data
Behavioral Cluster Intent is, at its foundation, a method built on behavioral data about individuals. Page views, content downloads, content network engagement. Each signal involves a person whose behavior is being collected and processed.
Under GDPR, processing personal data requires a lawful basis under Article 6. For B2B behavioral data used in marketing intent programs, the most commonly claimed basis is legitimate interest under Article 6(1)(f). This basis requires three elements: a legitimate interest pursued by the controller or third party, necessity of the processing for that interest, and a balancing test that the interest is not overridden by the data subject’s interests or fundamental rights.
The legitimate interest assessment must be documented. The data subject must have been informed of the processing. The right to object must have been available.
Intent data collected from EU data subjects without a documented legitimate interest assessment, or collected in contexts where subjects were not informed of marketing profiling use, cannot demonstrate a lawful basis. “Our publishers have consent” is not documentation. It is a claim about a claim.
The Supply Chain Problem
Many third-party intent data sources travel through multiple parties between collection and activation. A publisher collects behavioral data from visitors. They sell or license it to an aggregator. The aggregator processes and categorizes it. The intent vendor purchases the processed signals. The marketer activates the intent data.
GDPR Articles 26 and 28 impose requirements at each handoff. Article 26 governs joint controllership: when two parties jointly determine the purposes and means of processing, they are joint controllers with shared compliance obligations. Article 28 governs processor agreements: when a data controller uses a processor, a signed DPA is required.
A chain of four parties from collection to activation requires documented accountability at each link. In practice, many signal vendors cannot produce this documentation because the data they resell was sourced from aggregators who cannot trace it to documented collection events.
Many signal provider procurement reviews stall at the DPA or provenance documentation stage. The stall is not typically about poor data quality. It is about the absence of the supply chain documentation that legal teams require.
The Six Questions That Reveal the Gap
For the compliance evaluation of any intent data vendor, these six questions distinguish vendors with genuine compliance infrastructure from those using ‘GDPR compliant’ as a label without documentation:
Question one: What is the lawful basis for processing EU data subjects’ behavioral data in your intent product?
- A clear answer: “Legitimate interest under Article 6(1)(f) with a documented legitimate interest assessment available on request.”
- A deflection: “Our data is GDPR compliant.”
- A red flag: Any inability to name the specific Article.
Question two: Can you provide a signed Data Processing Agreement conforming to GDPR Article 28?
- A clear answer: “Yes. Our DPA is available and executable at signing.”
- A deflection: “Our terms of service cover data processing obligations.”
- A red flag: No DPA available, or DPA does not include sub-processor obligations and breach notification procedures.
Question three: Who are your sub-processors for EU data subjects, and do you have signed DPAs with each?
- A clear answer: a list of named sub-processors with DPA confirmation.
- A deflection: “Sub-processor information is proprietary.”
- A red flag: Refusal to name sub-processors or inability to confirm DPAs exist.
Question four: How do you handle data subject deletion requests received through your customers?
- A clear answer: a documented process with a defined SLA for deletion propagation.
- A deflection: “We honor all legal requests.”
- A red flag: No documented process or inability to describe how deletion propagates through the data infrastructure.
Question five: where is EU data subject behavioral data stored and processed?
- A clear answer: EU data residency, or specific non-EU locations with Standard Contractual Clauses executed.
- A deflection: “Our infrastructure is global.”
- A red flag: No data residency documentation or inability to confirm SCC execution.
Question six: what was the original collection context for the behavioral signals in your product?
- A clear answer: specific description of publisher networks, content types, and the notice provided to data subjects.
- A deflection: “We source from premium publishers.”
- A red flag: Inability to describe the original collection context or the disclosure made to data subjects.
These questions are not difficult for vendors whose data collection is genuinely compliant. The documentation exists because the collection events were structured to create it. They are unanswerable for vendors whose data was aggregated from secondary sources without documented lawful basis at each step.
For a broader vendor qualification framework, see How to Evaluate B2B Intent Data Vendors: Six Questions That Predict Pipeline Performance.
Why the Compliance Risk Falls on the Buyer
This is the point that many marketing teams have not fully absorbed. Purchasing intent data from a non-compliant vendor does not transfer the compliance liability to the vendor. It creates shared exposure.
Under GDPR, the marketer who activates intent data for outreach is typically a data controller. They are responsible for ensuring the data they use has a lawful basis for processing. The vendor who supplied the data has their own compliance obligations. The buyer’s obligations are not reduced by the vendor’s failures. They are compounded by them.
If enforcement action occurs, the buyer’s use of the data is scrutinized alongside the vendor’s collection and processing practices. A buyer who cannot demonstrate adequate due diligence on their vendor’s lawful basis has a weaker position in any enforcement proceeding.
This is why procurement teams require documentation before approval. The documentation is evidence of due diligence. “We asked the vendor if they were GDPR compliant and they said yes” is not due diligence. Reviewing and retaining a signed DPA, a sub-processor list, and a legitimate interest assessment is.
Finding out in the middle of a legal review that a vendor cannot document where its data came from is a stressful moment for any marketing team. Machintel’s demand generation team works with B2B marketers on that concern, bringing legal and procurement into the program plan early. Approval then becomes a step in the plan, not a surprise.
What Verified Provenance Looks Like
Vendors with genuine compliance infrastructure answer the six questions clearly because the answers exist in documented form.
A published legitimate interest assessment available for review. A named sub-processor list maintained and updated as the vendor’s infrastructure changes. A DPA template available pre-contract and executable at signing without negotiation over basic Article 28 requirements. A documented data subject deletion process with a defined SLA. Data residency information available for both EU and major US regulatory jurisdictions. Collection context described specifically: which publisher categories, what disclosures, what basis was claimed and documented at collection.
These are not aspirational standards. They are the baseline documentation that enterprise procurement teams now require. Vendors who cannot produce them are not failing a compliance test. They are revealing that the compliance infrastructure was never built.
The Operational Reality
The $84K renewal that blocked in legal review was not a compliance crisis. It was a procurement process working as designed. Legal identified a vendor that could not document its data supply chain and refused to approve the spend.
The operational consequence for the marketing team was six weeks of delay and a program pause during a pipeline-critical period. The replacement vendor search was conducted under time pressure, which reduces the quality of the evaluation. The program resumed with a different vendor at a higher annualized cost, with the compliance documentation that should have been required at the original selection.
Selecting vendors who can pass procurement review is not a compliance formality. It is a program continuity requirement.
Provenance checks work best when built into campaign execution, not added after vendor selection.
FAQs
Is ‘GDPR compliant’ enough for intent data procurement?
No. ‘GDPR compliant’ is a claim, not a documented status. Legal needs the evidence behind it, such as a signed Data Processing Agreement, a sub-processor list, and a documented lawful basis. A vendor that cannot produce them typically stalls the review.
Which documents should legal request from an intent data vendor?
Legal should request a signed Data Processing Agreement conforming to GDPR Article 28, a named sub-processor list for EU data, and the documented legitimate interest assessment. It should also ask for data residency details, a written description of the original collection context, and a documented deletion process with a defined SLA.
Is the buyer liable if an intent data vendor is non-compliant?
Potentially, yes. The marketer who activates intent data is typically a data controller, so the vendor’s failures add to the buyer’s exposure instead of removing it. A buyer who has retained the signed DPA, sub-processor list, and legitimate interest assessment has evidence of due diligence.
