Sharing a business contact's details across borders: GDPR basics

Can you share a business contact's details with a third party under GDPR?

Often yes, if you have a lawful basis, share only what is needed and are open about it. A business email address that names a person is personal data under the GDPR, even when it is a work address, so "it is only a business contact" is not a safe assumption.

The safest route for an introduction is the simplest: ask the person first, share only the details they agreed to, and let them take it from there. This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

What the GDPR says, in outline

The official text is Regulation (EU) 2016/679. It applies from 25 May 2018 and can apply to organizations outside the EU in some situations. The UK has its own version, the UK GDPR, with the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). Those are separate texts you should read on the UK government's legislation site, and your ICO guidance applies if you are in the UK.

The ideas that matter for an introduction are these.

Is a business introduction email "marketing"?

It depends on its purpose. If the message is primarily to promote a product or service, electronic marketing rules, such as PECR in the UK and national rules implementing the EU ePrivacy Directive, may apply as well as the GDPR. Rules for emailing businesses differ between corporate and individual subscribers and by country, so check the position in each country involved. A permissioned introduction the contact asked for is a very different case from an unsolicited promotion, and the US side has its own rules, covered in whether CAN-SPAM applies to a one-to-one B2B email and not repeated here.

How does permission-first minimize the data you share?

The program is designed so that partners handle very little personal data. A partner makes an introduction and gives basic fit information only. A partner never exports, uploads or describes confidential records. The owner decides whether to be introduced, and the company, not the partner, takes any later steps.

For an introduction, that points to a short routine.

1. Ask first. Tell the person who you want to introduce them to, why, and what you will share.
2. Share the minimum. A name, role, company and work email are normally enough.
3. Say it in writing. Keep the person's yes, with the date.
4. Introduce, then step back. Let them continue the conversation directly.
5. Do not keep extra. Delete working notes you no longer need.
6. Honor objections. If they ask you to stop, stop and note it.

Situations and what to check

Who is the controller, and does the program change that?

Whoever decides why and how personal data is used is a controller in the GDPR's terms. When you pass on a contact's details, you may well be using personal data for your own purpose, which is the introduction, so you may carry responsibility for that step. This is one reason to keep what you share small. How SourceX processes data after the introduction is described in its own privacy information, which you should read on the site, and the program terms cover what partners agree to.

Scenarios worth working through

Illustrative and fictional. A UK fractional finance director wants to introduce the US owner of a 90-person staffing firm. She messages the owner privately, explains that she would pass on his name, job title, company and work email, and says why. He replies yes. She then writes one short introduction email, which includes a sentence disclosing a possible referral reward, and steps back. She keeps his yes and deletes her working notes. The routine takes ten minutes and leaves her with a record.

Contrast an adviser who sends a whole client list to a third party without asking. That second pattern is the one data-protection regulators worry about, and it is not how this program works.

Questions for your counsel or data-protection adviser

• Which lawful basis should I rely on for an introduction: consent or legitimate interests?
• What do I need to tell the contact, and when?
• Do the rules differ because the recipient is in the US?
• What should I keep as a record, and for how long?
• Do my professional rules add to the legal requirements?

Next step

Ask first, share the minimum, keep a record, and then register as a partner. The introduction email builder drafts the owner-approved message, the LinkedIn introduction guide covers the permission step, and the employee count guide helps you check the 50+ full-time employees at peak baseline (contractors excluded). Credit rules are explained in what an attribution window is, and partners outside the US may also read introducer agreements and referral fee clawbacks. Rewards are 25% of the eligible platform fees SourceX actually collects, capped at $100,000 cumulative per referred company, and they become payable only after the buyer pays and SourceX receives its fee. No reward is guaranteed.