PIPELINEGuide
Lead qualification and data protection: what GDPR requires
As soon as personal data is processed in lead qualification, clear obligations apply. Which ones specifically, what is almost always missing in practice, and what actually suffices.
As soon as personal data is processed in lead qualification, you need a legal basis, purpose limitation, defined retention periods, notification of data subjects, and a data processing agreement with every service provider involved. In practice, the same three things are almost always missing: the retention period, the notice at the point of collection, and clarification of whether the provider uses the data for its own training.
01 — Data Protection
What GDPR requires
As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.
In practical terms, this means for lead qualification: a data processing agreement with every service provider involved, verification of where processing takes place, a documented retention period, and a clear passage in the privacy policy. Three things are almost always missing in practice: the defined retention period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.
A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.
02 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
03 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
04 — Questions
Frequently asked questions
Won't we filter out good customers with this?
That's why nothing is automatically rejected, only sorted. Every inquiry remains visible, it's just not on the same pile anymore.
Will we lose inquiries from smaller customers because of this?
No, only the order of processing is sorted, not acceptance. Every inquiry remains visible and answerable — the sorting only decides which one is handled first.
What's a realistic scoring approach?
Points for hard criteria you can actually verify: region within your service area, scope within your service range, timeframe feasible. Everything else is guesswork and leads to nobody trusting the scoring.
Does this need integration with our CRM?
Useful, but not mandatory. Without CRM integration, scored inquiries land structured in your inbox; with integration, a record with scoring is created directly in the system.
Does this work in B2C?
Limited. Enrichment with company data drops out, but pre-qualification through good questions and distribution work just the same.
How long does setting up the scoring logic take?
One to two weeks for the criteria and the form, then a test run on your recent inquiries before anything goes live — misclassifications show up right there.
What if our criteria change over time?
The scoring rules are in a table you can adjust yourself without changing any code. A new criterion is one line, not a project.
05 — Next
Related pages
- Lead qualification — Overview
- Lead qualification — process
- Lead qualification — alternatives
- Lead qualification — provider comparison
- Lead qualification — where to start
- Lead qualification — costs
- Lead qualification — duration
- Lead qualification — implementation
- CRM integration
- Process automation
- Automate Quote Creation
- All guides
Lead qualification by region
Next step
Initial assessment, no obligation.
Briefly describe what you need. You'll get an honest answer about what's realistic and what it will roughly cost.