CNIL guidance on lawful reconstitution of professional email addresses

What happened

The CNIL explains that reconstructing professional email addresses from publicly available data must comply with the GDPR and can rely on legitimate interest only if specific conditions are met. Organizations must assess the visibility of the data, the expectations of the data subject, and implement safeguards such as limited retention and immediate exclusion upon objection. The guidance also notes that public administrations may rely on the public interest basis under article 6.1(e) of the GDPR.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• Clarifies when legitimate interest can be used for email reconstruction, impacting B2B prospecting practices.
• Takes effect October 16, 2026.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.
3. Map the security requirements to existing controls and close gaps.
4. Identify affected vendors and update due-diligence and contract terms.