A lead is a company or person that might become a customer. In business-to-business (B2B) sales, leads do not appear by chance: they come from somewhere, and the source shapes almost everything that follows. It decides how well the lead fits, how much it cost to find, and whether you are allowed to contact the person at all.
This guide compares the most common sources and gives an overview of the EU rules, as of 1 November 2026. It is written for teaching and is not legal advice.
Inbound and outbound
Inbound: the lead comes to you. Someone fills in a form on your website, downloads a guide, signs up for a webinar or calls you. Inbound leads have already shown interest, but you cannot choose who shows up.
Outbound: you go to the lead. You pick companies that match your ideal customer profile (ICP), the description of the companies that benefit most from your product, and contact them first. You control who you target, but nobody is waiting for you.
Most companies use both. Inbound takes months to build up and keeps working; outbound starts faster but needs constant effort.
The main sources
Your website and content. Guides, webinars, newsletters, articles and talks by your own experts attract people who search for a problem you solve. They leave their email address themselves, with a clear explanation of what happens next, which makes this the cleanest source in terms of data protection.
Referrals. A customer or business contact recommends you. Referred leads often trust you faster because someone they know vouches for you. The best way is an introduction: the customer writes to both sides, or asks their contact before passing on the details.
Events and trade fairs. Trade fairs and business events bring many conversations in a short time. They are expensive, but you can qualify people face to face. Note what you agreed with each person, such as "send the price list", and follow up only on that.
Partners. Companies that sell something related to the same customers, such as an accountant and a payroll software provider, can host events together or recommend each other. Swapping customer lists needs a legal basis and transparency towards every person on them.
Public registers and directories. Commercial registers, such as the Handelsregister in Germany or Companies House in the UK, list companies with their legal form, address and managing directors; chambers of commerce and trade associations publish member directories. They are excellent for firmographics: facts about a company such as industry, size and location. But directors' names are personal data, and many directories forbid advertising use in their terms of use.
Job ads as signals. A company that advertises for three warehouse workers is growing; one that looks for its first IT administrator is probably building up its systems. Job ads tell you who might need you now, not whom to write to: they are signals, not lead lists. The buying signals exercise practises how to read them.
Bought or rented lists. List providers sell company and contact data, often with email addresses. It looks like the fastest source and carries the most risk. People change jobs, and outdated addresses bounce, which makes it harder to reach anyone else by email. A seller's promise that the contacts "agreed to receive offers" rarely covers your company and your purpose. Under the GDPR, the company that uses the data must be able to show it is allowed to (Article 5(2), accountability), not the seller.
Comparison
Cost and effort are rough illustrations for teaching, not measured figures; real costs depend on the industry and the team.
Source | Direction | Cost | Effort | Typical fit | Data protection and consent |
|---|---|---|---|---|---|
Website and content | Inbound | Medium, mostly time | High at first, then lower | Interested, but not always in your ICP | Person gives the data; consent can be documented |
Referrals | Inbound | Low | Low to medium | Often high | Best when the referrer introduces both sides |
Events and trade fairs | Both | High | High | Depends on the event | Agree on the next step in the conversation and note it |
Partners | Both | Low to medium | Medium | Often high | Sharing lists needs a legal basis and transparency |
Public registers and directories | Outbound | Low | High (research by hand) | High if filtered by ICP | Company data is fine; directors' names are personal data; check terms of use |
Job ads | Outbound | Low | Medium | Signals timing, not a contact | Use for company research; contact people in job ads only about the job |
Bought lists | Outbound | Medium to high | Low at first, high to clean | Often low | Highest risk: consent rarely covers you, and you are responsible |
Consent and data protection in the EU: an overview
The GDPR applies to business contacts. A name together with a work address such as anna.berger@fabrikam.example is personal data, even at a large company. The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) therefore applies to every source above as soon as a person can be identified. Data about a company alone, such as its turnover or address, is not personal data.
Legal basis (Article 6). You need a legal basis to use the data. For marketing this is usually the person's consent (Article 6(1)(a)) or a legitimate interest that is not outweighed by the person's interests (Article 6(1)(f)). Recital 47 says that direct marketing may be a legitimate interest, which still requires weighing up both sides.
Information (Article 14). If you did not get the data from the person, for example from a register or a list, you must tell them who you are, where the data came from and what you do with it. When you use the data to contact them, this must happen at the latest with your first message.
Objection (Article 21). Anyone can object to direct marketing at any time. Afterwards their data may no longer be used for it. Keep a list of objections and check every new list against it.
Email needs more than the GDPR. The ePrivacy Directive (Directive 2002/58/EC, Article 13) says that marketing by email to natural persons requires their prior consent. There is an exception for existing customers: a company that received an email address when it sold something may advertise its own similar products to it, as long as the customer can refuse easily, both when the address is collected and in every email. For emails to companies as legal persons, the directive leaves the rules to each member state, so they differ between countries.
Germany as an example. The Act against Unfair Competition (§ 7 UWG) treats advertising by email without the recipient's prior express consent as an unreasonable nuisance, and this applies to businesses too. Advertising phone calls to businesses need at least their presumed consent, which means a concrete reason to assume they would welcome the call. Paragraph 3 contains the existing-customer exception for email.
Outside the EU the rules differ. The UK's PECR allows marketing emails to companies without consent if the sender is identified and offers an easy way to opt out, but treats sole traders like private individuals (ICO guidance on business-to-business marketing). The US CAN-SPAM Act is built on opting out rather than opting in (FTC compliance guide).
What follows for lead sources: a source that gives you a company is a starting point for research. A source that gives you a person's email address is only usable if you know how that address may be used.
Worked example 1: cost per qualified lead
Fabrikam, a fictional maker of booking software for clinics, compares three sources from one quarter. All figures are invented.
Source | Cost | Qualified leads | New customers |
|---|---|---|---|
Regional trade fair (stand, travel, staff) | 9,000 € | 30 | 6 |
Downloadable guide with ads | 4,500 € | 45 | 4 |
Referral programme (20 hours of staff time at 50 €) | 1,000 € | 6 | 3 |
Cost per qualified lead is cost divided by qualified leads: trade fair 9,000 / 30 = 300 €, guide 4,500 / 45 = 100 €, referrals 1,000 / 6 = about 167 €.
Cost per customer is cost divided by new customers: trade fair 9,000 / 6 = 1,500 €, guide 4,500 / 4 = 1,125 €, referrals 1,000 / 3 = about 333 €.
The guide is the cheapest source per lead, but referrals are the cheapest per customer by far, because half of the referred leads bought. Comparing sources only by the number or price of leads hides the most important figure.
Worked example 2: choosing a mix
Northwind Traders, a fictional office supplies wholesaler in Hamburg, wants to reach offices with 50 to 500 employees nearby. Its plan:
Filter the commercial register and the chamber of commerce directory for companies in the delivery area. Result: a list of companies, without personal email addresses.
Research each company's website and job ads. A company hiring an office manager or moving offices goes to the top.
Because German law requires prior consent for advertising emails, Northwind does not email these companies cold. It sends a short letter by post to the office instead. Where the letter is addressed to a named director from the register, it says where the name came from, as Article 14 GDPR requires. The letter offers a free guide on cutting supply costs and invites people to sign up for the newsletter with double opt-in (a second confirmation click).
In parallel, it asks its ten happiest customers to introduce Northwind to neighbouring firms.
Common mistakes
Counting leads instead of customers. A source with many cheap leads can still be the most expensive per customer.
Assuming "public" means "free to use". A name on a website or in a register is still personal data. Public availability does not replace a legal basis or the duty to inform.
Trusting a seller's consent. "All contacts opted in" usually means they agreed to something else, for someone else.
Ignoring objections across sources. A person who objected once must not come back through the next list you import.
No ICP filter. Every source produces poor leads if nobody checks the fit first.
Check yourself
Where B2B leads come from
1.A visitor downloads a guide from your website and leaves her work email. What kind of lead is this?
2.Why is a name with a work email address covered by the GDPR?
3.You found a company's managing director in the commercial register. What must you do if you store her data and contact her?
4.What is the main risk of a bought email list?
5.In Germany, what does § 7 UWG say about advertising emails to businesses?
6.A trade fair cost 9,000 euros and brought 30 qualified leads, 6 of whom became customers. What was the cost per customer?
7.What is a job ad most useful for in lead generation?
Practise cleaning a list from several of these sources with the fictional B2B lead list, and decide which companies to target first with the ICP lesson.