Data Enrichment: Definition, Methods, and GDPR Compliance in 2026

You've exported a list of 500 companies: a name, an address, sometimes a phone number, sometimes a website. On screen, every row looks the same. You have no way to tell the fifteen-person firm founded twenty years ago apart from the sole trader registered last month, no way to know which one has a reachable professional email, which one has closed. You're about to contact all of them the same way — and half the effort will land nowhere.

That's exactly the problem data enrichment is designed to solve. A raw list lets you count rows; an enriched list lets you decide who to contact, how, and in what order. Here is a concrete definition of data enrichment, the types of information you can add, the methods used, and the GDPR framework that applies in France in 2026.

Definition of data enrichment

Data enrichment consists of completing an existing dataset with additional information from other sources, in order to make it more actionable. Concretely, you start with a sparse list — a few columns — and add the information needed to qualify, sort, and decide: legal identifiers, company size, sector, email addresses, technologies in use.

The term applies to any type of data, but in B2B prospecting, data enrichment specifically means transforming a list of company names into a working database: each row is matched against external sources to attach the attributes that allow prioritization. A list of names is not a database; enrichment is what makes the difference.

Raw list vs. enriched list: what changes for decision-making

A concrete example: you scrape 500 accounting firms in a given region. The raw output looks like this: name, address, phone number, website. With only these columns, you can do nothing but go down the list from top to bottom and call everyone at the same pace.

The same list, enriched, also carries each firm's SIREN number, its legal form, registration date, approximate headcount, a verified professional email address, and the technologies detected on its website. From there, the nature of the work changes: you filter out dissolved entities, identify firms over ten years old with the budget for your offering, personalize the message based on the tool detected on their site, and spend your follow-ups only on reachable contacts. The list is no longer for counting — it's for deciding.

Data enrichment is the link between scraping, which builds the raw list, and lead generation, which turns those contacts into opportunities. Without enrichment, you prospect blind; with it, you prospect with intent.

Types of data enrichment

Not all enrichments are equal, and they don't serve the same purpose. Five main categories can be distinguished based on the nature of the information added.

• Legal identifiers. SIRET, SIREN, RCS (trade register), intra-community VAT number. These are the stable keys that enable invoicing, unambiguous deduplication, and verification that a business legally exists. Without a SIREN, two similar names remain two separate rows instead of one.
• Firmographic data. Legal form, incorporation date, headcount, NAF industry code, share capital, active or dissolved status, directors. This is the enrichment that enables sorting: targeting companies of a given size, age, or sector.
• Emails and contact details. Professional email addresses, direct lines. This is the role of an email finder: locating the right contact channel from a domain name or a director's name.
• Technologies (technographic data). The CMS, payment system, and marketing tools detected on a company's website. Useful for anyone selling a service tied to a specific technology.
• Web signals and social media. LinkedIn presence, Facebook, Instagram, recent activity, funding rounds, job postings. These signals indicate an opportune moment to reach out.

In practice, a serious workflow combines several categories: enrich first with legal identifiers and firmographic data to sort, then with emails — only looking up contact details for the leads you've already decided to keep. Order matters: enriching emails on a list you haven't yet filtered means spending effort on rows you'll discard later.

Data enrichment methods

How, concretely, do you attach information to a row? Three main methods coexist and are often combined.

Matching against open databases

The first method involves matching each row against a public reference database. In France, the reference database for companies is the INSEE Sirene database, published as open data and covering all legal entities and registered establishments since 1973. It carries the label "public reference data service." Matching a list against the Sirene database lets you attach legal form, NAF code, incorporation date, or active/dissolved status.

A variant of this matching works directly from the company's website: in France, the SIRET number appears in the legal notices of almost every site, because the law requires it to be displayed. Reading this public notice and attaching it to a row is open-source enrichment. This is exactly the principle behind the outsend legal_ids module, which automatically retrieves SIRET, SIREN, and RCS numbers from a list of establishments and computes the intra-community VAT key in the same pass.

Waterfall (cascaded source lookup)

No single source is complete on its own. The waterfall method queries multiple sources in priority order: it takes the information from the first source that provides it, and only moves to the next if the first fails. For an email address, for example, you first attempt to read the website, then deduce it from the domain name, then try another source. This cascade logic maximizes coverage without paying for the same data multiple times.

Public sources vs. purchased sources

The fundamental distinction is not technical — it is legal and economic. Public sources (the Sirene database, legal notices, official registries) are data that the law makes open or that companies are required to display: reading them amounts to consulting public information. Purchased sources are databases assembled and resold by third-party vendors, whose provenance and legal basis are not always documented. Prioritizing open public sources means keeping a clear audit trail for each data point — which becomes critical for compliance, as described below.

Beyond legal identifiers, enrichment also covers structured legal data — legal form, directors, key dates — to qualify a list before the first contact, always from official registries.

Data enrichment and GDPR compliance in 2026

This is the point most people overlook, and it's the one that separates a clean enrichment practice from a risky one. The principle is simple to state: enriching a database means processing data, and any processing of personal data must rest on a lawful basis.

Public data does not mean free data

The CNIL (France's data protection authority) is clear: personal data that is publicly accessible online remains personal data. Its public availability does not make it freely reusable. Purely legal company data (SIRET, legal form, NAF code of a legal entity) is not personal data and can be enriched without issue. However, as soon as you handle the name of an individual director, a nominative email address, or a sole trader, you are dealing with personal data, and the GDPR applies.

The legal basis for processing

All processing of personal data must rest on one of the six legal bases set out in Article 6 of the GDPR: consent, contract, legal obligation, vital interests, public interest task, or legitimate interest. In B2B, enrichment and prospecting typically rely on legitimate interest — provided the individual could reasonably expect such processing and the message relates to their professional role.

The resulting obligations

According to the CNIL's guidance on the reuse of publicly accessible online data, any organization that enriches data and then prospects must:

• Inform the individual of the source of the data at the time of first contact (GDPR Article 14): state where the collected information comes from.
• Honor the right to object and not contact individuals registered on an anti-prospecting list such as Bloctel, nor those who have already objected.
• Check the terms of service of the sites from which data is extracted: if they prohibit scraping for commercial purposes, the practice is not permitted.
• Obtain prior consent for any electronic prospecting directed at a private individual — accepting terms of service does not constitute consent.

Keeping a record of the origin of each enriched data point is therefore not a technical detail: it is what makes informing the individual possible and compliance demonstrable. This is also why serious enrichment tools store the source URL for each collected identifier. If you want to test an enrichment tool that traces its sources, outsend is available in free alpha by application.

FAQ — Data enrichment

What is the difference between scraping and data enrichment?

Scraping builds the raw list by extracting information from a source (a directory, Google Maps listings, websites). Data enrichment completes that existing list with additional information from other sources (legal identifiers, emails, firmographic data). You scrape first, then enrich.

Is data enrichment legal in France?

Enriching with legal company data (SIRET, legal form of a legal entity) poses no issue: this is not personal data. As soon as you handle personal data (an individual director, a nominative email, a sole trader), the GDPR applies: you need a legal basis (Article 6), must inform the individual of the data source, and must respect the right to object. The CNIL emphasizes that publicly accessible data is not freely reusable data.

What are the public sources for enriching a company list?

The main one is the INSEE Sirene database, published as open data on data.gouv.fr, covering legal entities and registered establishments since 1973. It is complemented by legal notices published on company websites (where the SIRET number must appear by law) and official trade registries.

What is the waterfall method in data enrichment?

The waterfall method queries multiple sources in priority order and retains the information from the first one that provides it, moving to the next only on failure. It maximizes coverage without unnecessarily querying all sources for every row.

Should you enrich emails before or after filtering your list?

After. Enrichment with legal identifiers and firmographic data is for sorting and filtering out out-of-scope rows. Looking up email addresses is only justified for the contacts you've decided to keep — otherwise, you spend effort finding addresses for rows you'll discard anyway.

Public data vs. personal data: what's the difference for enrichment?

Legal company data (SIRET, NAF code, legal form of a corporate entity) is not personal data: it can be enriched freely. Data linked to an individual (a director's name, a nominative email, a sole trader) is personal data, even if it is publicly available: enriching and reusing it falls under the GDPR and requires a legal basis and notification to the individual.

Need a full overview? See the complete prospecting glossary.