GDPR Compliant B2B Data: What to Check

A work email and a job title are personal data under GDPR, exactly as much as a home address, and that applies regardless of where the company processing them is based, as long as the data subject is in the EU. This makes a B2B data provider's compliance posture something worth real diligence, not a checkbox on a vendor questionnaire.

Deleting a record on request is the easy part, and every provider will say yes to it. The question that actually reveals whether a provider has built for this properly is narrower: what happens the next time your underlying dataset is refreshed from source? Does the deleted person quietly reappear, because the refresh process has no memory of the erasure request?

A provider that only flags a record as deleted, rather than excluding the underlying identifier from all future re-ingestion, has not really solved this. It has deferred the problem to the next scheduled refresh.

A request against an identifier that has been erased should return a distinct, honest response, not a generic 404 that implies the record simply was not found and might reappear on retry:

Skip the compliance page and ask a provider directly: where is data actually hosted, what is the technical mechanism (not the policy) that prevents a deleted record from reappearing, and what HTTP status does an erased record return. A provider with a specific, confident answer to the third question has almost certainly solved the second one too, since you cannot build the response without building the underlying mechanism first.