B2B intent data is sold at two levels. An account-level record says that a company is showing interest in a topic, and a contact-level record says that a named person is. The level decides what your team can do with the data and where the rules on personal data and direct marketing attach. This post sets out what each record holds, the questions to put to a vendor of each, what the European Data Protection Board, the UK Information Commissioner's Office and the European Commission publish on those rules, and one account worked at both levels. None of it is legal advice.
What account-level and contact-level intent data hold in B2B
Account-level intent data holds one record for a company and a topic: the company's name and domain, the topic, a score or a buying stage, and a date. Contact-level intent data holds one record for a person: a name, an employer, a role, usually a work email, and the content or pages that person engaged with.
Intent data is evidence that a company is moving towards a purchase, and the level is the unit it is reported at. Bombora's Company Surge page uses the term account-level intent and describes a score for each pairing of account and topic, comparing the most recent three weeks of activity with a 12-week baseline. G2's Buyer Intent data reference documents a record about the buyer organisation: its name, website domain and industry, the G2 page visited and the date, and the region and country of the individual visitor. At the other level, Informa TechTarget's page on intent data for sales offers Prospect-Level Intent insights, which its 2020 announcement of the feature describes as data on individual prospects, based on their research, engagement and buying team associations.
An account-level record can be rolled up from the activity of people: Bombora's page says research consumption is collected through a consent-driven tag on the sites in its Co-op. Fokals Intent Scores are account-level records: a weekly score from 0 to 100 for each company and topic, each with the dated evidence behind it, and the data is company-level throughout. The comparison of company signals vs third-party intent data sets the outputs side by side.
| Account-level record | Contact-level record | |
|---|---|---|
| Unit | One company, with a row for each topic and period | One person at a company |
| Key | The company's domain or a vendor's company ID | A name, a work email or a vendor's person ID |
| A row states | The topic, a score or stage, the period and, in some products, the evidence | The person's role, what they read or did, when, and how to reach them |
| Built from | Public actions of the company, or people's activity rolled up to their employer | The activity of an identified person |
| Personal data | A record about a legal entity alone is company data. Check sole traders and any field about a visitor | Every row: a name with a corporate email relates to an individual |
What each level lets a team do
An account-level record answers which companies, and when. It ranks a target list, times a campaign, feeds account scoring and account-based marketing segments, and joins to a CRM on the company's domain. The choice of person stays with you.
A contact-level record answers who. A rep can write to the person who did the reading, and a marketing team can score and route that person as a lead, which is lead scoring. It sees only the people who were identified, so one active reader can stand for a whole account, and every use of it is a use of personal data.
The two work in sequence: rank accounts on an account-level source, as in prioritising accounts with intent scores, then work the people in the chosen accounts whom you have a basis to contact.
Where the GDPR attaches: account-level intent against contact-level intent
The GDPR attaches to personal data, whatever level a product is sold at. The European Commission states that the rules cover personal data about individuals, not data about companies, and that a business email address naming a person is personal data. A contact-level record falls inside the rules. An account-level record describing only a legal entity is company data.
The source is the Commission's page on the application of the GDPR, under its heading on data about legal persons. It makes three points. The rules do not govern data about companies or other legal entities. Information about a company can be personal data where it allows a natural person to be identified. And the rules apply to personal data about people in the course of a professional activity: a company's employees, a business email address made of a forename and a surname, an employee's business telephone number. The page lists an IP address and a cookie ID among its examples of personal data, and an address such as info@company.com among its examples of what is not.
Three things follow for a buyer of intent data.
- A contact-level file is personal data from the first row. A professional capacity changes nothing in the Commission's account.
- An account-level file can describe companies alone and still rest on data about people. Where a score is rolled up from people's activity, identifiers of the kind the Commission lists may have been processed first, so ask the vendor what was observed, about whom and on what basis. Put the same question to Fokals: its data is company-level throughout, and the sourcing statement sets out the rules of its collection.
- A small account can be a person. The ICO's page on what personal data is says information about a legal person is not personal data, and that the UK GDPR applies to personal data about individuals acting as sole traders, employees, partners and company directors, where they can be identified and the information is about them as individuals.
What the EDPB says on legitimate interest and profiling of personal data in business-to-business marketing under the GDPR
The European Data Protection Board states three cumulative conditions for relying on legitimate interest: a legitimate interest is pursued, processing personal data is necessary for it, and the individual's interests and rights do not take precedence. Its guidelines, published in version 1.0 for public consultation, cover direct marketing, and in them we found no separate test for business-to-business marketing.
The Board announced Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR in October 2024. The announcement says the balancing exercise weighs the individuals' interests, the impact of the processing, their reasonable expectations and any additional safeguards. For contact-level data, reasonable expectations raise a plain question: would a person who read an article at work expect the reading to be scored and passed to a seller? On 7 October 2026 the Board's page for the guidelines showed version 1.0, with the public consultation of 9 October to 20 November 2024 marked closed for feedback, and we found no final version on the Board's site.
On profiling, the Board lists Guidelines on Automated individual decision-making and Profiling, on a page dated 25 May 2018, among the WP29 guidelines it endorsed. The Commission's page for individuals describes profiling as evaluating a person's personal aspects in order to make predictions about them, even where no decision is taken, which is close to a propensity score on a named contact. It adds that when a person objects to direct marketing, the company must stop using their personal data.
The Commission's page on the legal grounds for processing data counts direct marketing among the purposes for which an organisation may have a legitimate interest, and says what applies to an acquired contact list, the nearest case on that page to a contact-level intent file. The supplier must be able to show that the data was obtained in compliance with the GDPR, and a consent relied on should have covered passing the data on for the recipient's own direct marketing. Where the list is used on the ground of legitimate interests, the buyer must tell each person, at the latest at the first communication, that their data is processed to send adverts and that they can object at any time. The page adds that email marketing must follow the ePrivacy Directive.
What the ICO says on direct marketing to business contacts: personal data, legitimate interests and profiling
The UK Information Commissioner's Office says the UK GDPR applies to business-to-business marketing whenever an individual can be identified, even in a business capacity. It says consent and legitimate interests are the lawful bases most likely to apply, a business contact's right to object to direct marketing is absolute, and profiling must be explained and have a lawful basis.
Personal data. The ICO's business-to-business marketing guidance gives two examples: the name and number of a business contact held on file, and an email address that identifies an individual. Where you do not know the name of the person you are writing to, as with post addressed to the IT department, it says you are not processing personal data.
Lawful basis. The section on planning direct marketing names consent and legitimate interests as the two lawful bases most likely to apply. Where PECR, the UK's rules on marketing by electronic message, does not require consent, the business-to-business guidance says legitimate interests is likely to be appropriate in many cases, after a three-part test: identify the interest, show that the processing is necessary, and balance it against the individual's interests, rights and freedoms. The legitimate interests guidance, updated on 23 March 2026 to reflect the Data (Use and Access) Act, says the UK GDPR names direct marketing as a potential legitimate interest.
Electronic mail. The business-to-business guidance says PECR's rule on marketing by electronic mail does not apply to corporate subscribers, which are bodies with separate legal status such as companies and limited liability partnerships, though the sender must not conceal its identity and must give a valid address for opting out. It classes sole traders and other types of partnership as individual subscribers, which PECR treats as individuals.
Objection. The same guidance says a business contact's right to object to direct marketing is absolute. Article 21 of the UK GDPR extends it to profiling related to direct marketing, and says the data is no longer to be processed for that purpose once the person objects.
Profiling and bought-in data. The direct marketing guidance, last updated on 28 April 2026, describes profiling in its section on collecting information and generating leads as looking at people's interests, habits and behaviour. You must tell people about it and have a lawful basis for it, and people whose data came from another source must be given privacy information within a month at the latest. The business-to-business guidance adds that the use of personal data on a bought list of business contacts must comply with the UK GDPR.
On 7 October 2026 the business-to-business guidance and the page on what personal data is each carried a notice that the guidance is under review because of the Data (Use and Access) Act, so read the current page before you act.
Questions to put to a vendor of each level
Ask for the answers in writing before a contract. The ten questions for a company data vendor cover coverage, freshness and licence at both levels.
For a vendor of account-level data:
- What is observed to build a score: public actions of the company, or the activity of people?
- If people, which identifiers tie a person's activity to an employer, and on what lawful basis are they collected?
- Does any field describe a visitor or a person, such as a visitor's region or a job title?
- Can each score be opened to dated evidence that your team can check?
- How are sole traders and one-person companies handled?
For a vendor of contact-level data:
- Where was each person's data collected, and what was the person told at the time?
- On which lawful basis does the vendor collect and pass on the data, and which does it expect you to use?
- If the basis is consent, does it cover passing the data to you for your own direct marketing?
- How do objections reach you, and how quickly?
- Which contacts are individual subscribers under PECR?
- Does a record carry a score on the person, and what are people told about that profiling?
A worked example: Acme Robotics at both levels
This example is illustrative: Acme Robotics is an invented company, and every figure is invented.
Assumptions:
- Your team sells CRM software in the UK, and Acme Robotics is a limited company on your target list.
- For one closed week, an account-level file holds one row for Acme Robotics on the CRM topic: a score of 58 with the surge flag set, and three dated items of evidence.
- For the same week, a contact-level file holds four named people at Acme Robotics, each with a work email, and 12 content views between them: 8, 2, 1 and 1.
At the account level. The row has the shape of a Fokals Intent Scores row, and what a Fokals intent score gives you shows how to read one. The surge flag says that Acme Robotics has become active on CRM against its own record, and the three items of evidence each carry a date. A rep opens the call with that evidence, and the row names no person.
At the contact level. The file holds four rows about four people. One person made 8 of the 12 views, which is 67%: the account in research is mostly one reader. Each row is personal data, so the guidance above applies four times: a lawful basis for the scoring and the outreach, privacy information to each person within a month at the latest, and four absolute rights to object. As a limited company, Acme Robotics is a corporate subscriber in the ICO's terms, so by that guidance PECR's rule on electronic mail does not apply to its addresses, while the UK GDPR applies to each named contact.
| Account-level file | Contact-level file | |
|---|---|---|
| Rows for Acme Robotics | 1 | 4 |
| Each row describes | The company on one topic in one week | One person and what that person read |
| The rep opens with | Three dated items of evidence about the company | The reading of one person, who made 8 of the 12 views |
Run the same tally on a sample from each vendor: the rows for one account, what each row describes, and the share of activity that comes from the most active person.
Frequently asked questions
What is the difference between account-level and contact-level intent data?
Account-level intent data reports interest for a company: one record for each company and topic, with a score or a stage and a date. Contact-level intent data reports it for a named person, with that person's role, employer and what they read. The first tells a team which accounts to work and when. The second tells it whom to contact, and every row of it is personal data.
Is account-level intent data personal data under the GDPR?
The European Commission states that the GDPR's rules apply to personal data about individuals and do not govern data about companies or other legal entities, so a record that describes only a company is company data. The same page says information about a company can be personal data where it allows a natural person to be identified, and the ICO says the UK GDPR applies to personal data about sole traders where the information is about them as individuals. Ask the vendor what was observed about people to build the score.
Is a business email address personal data?
Yes, where it identifies a person. The European Commission names a business email address made of a forename and a surname, and an employee's business telephone number, as personal data, and gives an address such as info@company.com as an example of what is not. The ICO says a name and a corporate email address clearly relate to a particular individual.
Can you rely on legitimate interests for B2B marketing to named contacts?
The ICO says that where PECR does not require consent, legitimate interests is likely to be the appropriate lawful basis in many cases, once a three-part test of purpose, necessity and balance is passed. The European Data Protection Board states three conditions of the same kind as cumulative. The ICO calls a business contact's right to object to direct marketing absolute, and the European Commission says a person can object at any time. This is what the guidance says, and advice on your own case comes from your counsel.
Do you need contact-level intent data for account-based marketing?
Account selection and timing need the account level only. An account-level score ranks your target accounts and shows when one has become active, and the people you then contact can be those already in your CRM. Contact-level data adds who has been reading, and brings the handling of personal data for every row. Rank on the account level first, and add contacts inside the accounts you have chosen.
What does Fokals deliver at the account level?
Fokals delivers company-level intent data: a weekly score from 0 to 100 for each company and topic, across 69 topics in 9 groups, each with the dated evidence behind it. A surge flag marks a company that has become active on a topic against its own record, and each weekly row is written once and never revised. Scores arrive weekly and Company Signals daily, by REST API or as bulk files.
What this page says about the products it names was checked against their public documentation on 7 October 2026. Product and company names are trademarks of their owners. Fokals is not affiliated with them or endorsed by them.