Explain Prospect Data Sources Without Exposing Others
Trace field-level origins, prepare a concise source explanation, and protect unrelated records while routing privacy questions and complaints appropriately.
10/23/20263 min read
“Where did you get my details?” is a request for an understandable explanation, not an invitation to send a complete research spreadsheet. A vague answer such as public sources may be unhelpful, while an unreviewed screenshot can expose other contacts or confidential material. The response should be accurate, specific to the person's information, and routed appropriately if it becomes a formal rights request or complaint.
Prepare a source-transparency framework before the question arrives. It should connect the data field to its actual origin and distinguish direct collection, partner transfer, licensed sources, and inference. Never invent a provenance story to make the contact seem more expected.
Trace the record before answering
Locate the relevant field-level source reference, collection or observation date, import history, and any transformations. A CRM entry created by an import identifies a technical route, not necessarily the original source. Follow that route far enough to establish what your organization can truthfully say.
ICO's lead-generation guidance addresses telling people about sources when information comes from elsewhere. Apply current requirements for the relevant jurisdiction and have the privacy owner determine the full response needed. A short source explanation should not replace a required notice or rights response.
If provenance is missing, say the source is being investigated through the authorized process. Do not name a familiar platform merely because staff often research there.
Use a concise response framework
The internal preparation should answer four questions: which information is being discussed, where it came from, why it was obtained or used, and who handles any further privacy request. Add the relevant verified source or privacy-information link where appropriate.
Keep the tone factual. Avoid justifying the contact through the person's seniority, public visibility, or presumed need. A source explanation should not become another sales pitch. If the person also asks for contact to stop, process that instruction independently and promptly rather than delaying it until the source investigation finishes.
Do not promise deletion, correction, or full disclosure beyond what the authorized process has established. Preserve the difference between acknowledging a request and confirming its completion.
A fictional source reconstruction
Synthetic contact T38 asks how fictional Lantern Advisory obtained a work email. The CRM shows an import from File B, but File B combines an authorized event export with company-page research. The reviewer traces T38's email to the event export and the role description to a later company page.
The response preparation records those two origins separately. It does not say that all details came from the company website. It also checks the event's relevant notice and proposed use, because explaining the source does not itself establish that the use was appropriate.
If the source review reveals an unsupported use, the privacy owner handles that issue and any necessary corrective action. The team should not hide the event source simply because it makes the original outreach harder to defend.
Protect unrelated records during explanation
Provide a reviewed explanation or extract limited to the relevant information. Do not forward a partner's entire list, a multi-contact spreadsheet, or a screenshot showing adjacent CRM records. Source transparency and data minimization should work together.
If a document includes other people's information or confidential terms, route disclosure decisions to the privacy owner. Do not invent a blanket confidentiality exemption, and do not assume every source document must be shared in full. The appropriate response depends on the request and applicable rules.
Verify links before including them. A private download URL may reveal a token or fail for the recipient. A public source link may have changed since collection, so distinguish the current page from the historical evidence where that matters.
The completed internal record should contain verified provenance, the approved explanation, any linked rights or complaint case, current contact restrictions, and unresolved questions. Close the loop with the person through the authorized channel. An honest explanation may reveal a process weakness, but that is more useful than a polished answer that conceals where their information actually came from.
If you are also choosing research access, ask about Leads Automation’s independent Sales Navigator offer at US$15/month on WhatsApp. Confirm the available plan, eligibility and terms before ordering; this is not LinkedIn’s official price or an assurance that any particular integration is included.