← All resources

Guessed work emails: the CNIL B2B rules (16/10/2026)

Published October 20, 2026 · 7 min read · CyberNovaLabs.io

On 16 October 2026 the CNIL framed the practice behind half the prospect lists in Europe: guessing a business email address. Legitimate interest still works, under three written conditions.

The short version

On 16 October 2026 the French data protection authority, the CNIL, published two guidance notes on reconstructing business email addresses — guessing someone's address from their name, their employer and the company's address pattern.^[1][2] The position: the practice can still rest on legitimate interest, but only where the organisation has documented three criteria and put safeguards in place.^[1] For any SME doing B2B appointment setting, it is the first time an authority in the four countries we work in has written down how to judge that step.

What counts as a reconstructed address

The CNIL defines reconstruction as deducing a business email address from information available online: a first name, a surname, the employer's identity, and the organisation's address format, typically firstname.lastname@company.com.^[1] That is precisely what data enrichment tools do, and what a salesperson does by hand after finding a profile on a professional network with no address on it.

The point both notes hammer is the one most sales teams have backwards: the fact that the source data sits on the open internet does not exempt you from the GDPR.^[1][2] A guessed address is personal data like any other. The person never published it. You manufactured it, so you answer for it.

The three tests to write down before the next campaign

The CNIL accepts legitimate interest as a lawful basis, provided you run a documented balancing test. It recommends examining three things.^[1]

One. Purpose and intrusiveness. The authority notes that reconstruction is almost never a standalone operation: it is a technical step serving a wider objective, identified from the outset. The practical consequence favours SMEs: where the main processing is B2B commercial prospecting based on legitimate interest, the reconstruction can generally rest on that same basis.^[1] The CNIL immediately adds that this is neither automatic nor systematic.

Two. Visibility of the data and the person's control over it. This is the new test, and the expensive one to apply. You have to ask whether the person could reasonably expect their address to be reconstructed, given how their information was made accessible: privacy settings, restricted access, use of a contact form rather than a direct address.^[1]

Three. The safeguards in place. The CNIL names two concrete ones that tip the balance back: keep a reconstructed address only where effective first contact is made within a reasonable period, and make an objection exclude the person immediately from any further reconstruction processing, without requiring them to justify a particular situation.^[1]

The costliest signal: no online presence at all

The CNIL singles out two profiles who cannot, in principle, expect their address to be reconstructed: people with no identifiable online presence, and people who have taken steps to restrict access to their data.^[1] For the first group, the authority holds that the absence of an online presence can be a strong indication that the person did not wish to be easily reachable that way.^[1]

Read that from inside a prospect list. The owner of a small manufacturer with no professional profile, no team page and no published address is exactly the contact an enrichment tool earns its licence fee on. Under the 16 October guidance, they are also the hardest balancing test to win without written safeguards. Where those conditions cannot be met, the CNIL says the organisation must abstain, unless it can obtain consent.^[1]

The other duty, routinely skipped: information. The notes state that the organisation must set out, as soon as possible and clearly, the purposes pursued and explain how the address was obtained.^[2] That means one more line in your outreach email, not a buried privacy page. Anyone asking for access, rectification, erasure or restriction must get an answer within one month; past that with no reply, the CNIL says a complaint can be brought to it.^[2]

What changes in each of the four countries

The legal basis the CNIL relies on is Article 6 of the GDPR, identical in the four countries CyberNovaLabs.io works in.^[1] What differs is how far each authority's published doctrine goes as at 20 October 2026.

France

The only one of the four whose authority has published dedicated guidance on this exact practice. If you prospect French contacts, these two notes are now the text your team or your provider must be able to cite. They point back to the rules on electronic commercial prospecting, updated by the CNIL on 10 June 2026.^[3]

Netherlands

The Autoriteit Persoonsgegevens has not published guidance on address reconstruction, but on 2 April 2025 it published a handreiking on scraping by individuals and private organisations, starting from the finding that scraping almost always collects personal data.^[4] It governs the step before reconstruction: harvesting the names and employers.

Belgium

The Data Protection Authority works from recommendation no. 01/2020 of 17 January 2020 on processing for direct marketing purposes, which devotes a section to buying, renting and enriching personal data.^[5] As at 20 October 2026 we found no Belgian position specific to address reconstruction.

Luxembourg

The CNPD publishes its positions as thematic dossiers.^[6] We found no dossier dedicated to address reconstruction as at 20 October 2026. For a multi-country campaign, the prudent reading is to apply the French criteria everywhere: they are the most explicit of the four.

For the country rules on the send itself rather than on manufacturing the address, see our comparison of B2B prospecting and the GDPR in France, Belgium and the Netherlands; and if the channel is still an open question in your team, our analysis of phone, LinkedIn or email by type of decision-maker.

At CyberNovaLabs.io

We write the qualification criteria and the data provenance before launching a B2B appointment setting campaign, including for French-speaking markets run out of Brussels: where each address came from, a record of the balancing test, a purge rule, how objections are handled. If your current list cannot say where an address came from, that is the first job. Let us look at your list and your criteria — quoted per project, no minimum term.

Sources

1. CNIL - Reconstitution d'adresses electroniques professionnelles : dans quel cadre est-ce autorise ? (16/10/2026)
2. CNIL - Reconstitution d'adresses electroniques professionnelles : quels sont vos droits ? (16/10/2026)
3. CNIL - La prospection commerciale par courrier electronique, SMS-MMS et automate d'appel (10/06/2026)
4. Autoriteit Persoonsgegevens - Handreiking scraping door particulieren en private organisaties (02/04/2025)
5. Autorite de protection des donnees (BE) - Recommandation n° 01/2020 du 17 janvier 2020 relative au marketing direct
6. CNPD (LU) - Dossiers thematiques (consulte le 20/10/2026)

Read next