People Data API and GDPR: What Builders Need to Know

A people data API handles personal data, so GDPR is a live question whenever the people involved are in the EU or EEA, and the UK and Switzerland have comparable regimes. The simplest provider approach is exclusion: BusinessMCP says its API never returns people located in those places. That reduces risk but does not replace your own legal analysis.

Why this topic is unavoidable

The GDPR defines personal data as any information relating to an identified or identifiable natural person. A work email, a job title and an employer, assembled together, clearly meet that test. The fact that the context is professional does not take it outside the regulation, though the way rules apply to business contacts can differ by country and by activity. Read the text of the regulation on EUR-Lex for the definitions and principles, and ask a lawyer how they apply to you.

Builders often assume the provider carries the compliance burden. In practice, responsibility is shared. The provider is responsible for how it collects and stores records. You are responsible for your own purpose, your lawful basis, what you store, how long you keep it and how you contact people.

Two approaches providers take

Approach	What it means	Your remaining duties
Serve everywhere, manage compliance internally	Provider returns people in regulated regions and documents its legal basis	You still need your own lawful basis, notices and rights handling
Exclude regulated regions	Provider declines to return people in specified locations	You must not treat the API as a source for those regions, and you need your own process if you hold data from elsewhere

BusinessMCP takes the second route. Its People Data API page says it never returns people located in the EU, EEA, UK or Switzerland. It frames GDPR carefully: it does not state that the product is compliant, it says the API avoids returning people the regulation would apply to. That wording is more honest than a blanket compliance badge, and you should look for the same care in any vendor’s claims.

Key takeaway: “GDPR compliant” on a landing page is a marketing statement. The useful questions are who is excluded, what happens on opt-out and which uses the terms forbid.

US state rules and data brokers

Europe is not the only constraint. The page also says it never returns people placed in California, Texas, Vermont or Oregon, and explains that those states require data brokers to register, so it does not sell records on people placed there. It adds that US people who cannot be placed in a state are never returned, and that when a person’s own state is unknown the employer’s state is used.

California’s privacy law is summarised by the state Attorney General’s office on its CCPA page, which is the primary source to consult for what it requires. Other states have their own statutes and registers, and the landscape moves quickly, so check current rules before relying on any summary, including this one.

What opt-out looks like

The provider describes these controls.

• Anyone can opt out without an account, through an opt-out form.
• Each result is checked against the opt-out list before it leaves.
• Opted-out people are removed from the store within about a day and never returned again.
• Every people call is logged against the account with the declared purpose.
• Use for credit, employment, insurance or housing decisions is prohibited.

The page does not state retention periods beyond the opt-out timing, nor the legal basis for processing, and BusinessMCP’s trust page likewise does not describe how opt-out requests are handled in detail. If these matter for your risk assessment, ask the vendor directly and get answers in writing.

What you should do on your side

1. Define your purpose. Write down why you are using people data, as the provider’s own terms ask you to declare it.
2. Check geography in your own pipeline. Do not rely on the API alone; if you also use other sources, apply the same rules to them.
3. Minimise. Store only fields you use, with a timestamp and a source.
4. Respect opt-outs downstream. If someone asks you to stop, suppress them in every system, not just one.
5. Set a retention rule. Delete or re-verify records on a schedule.
6. Mind the message. Rules for emailing differ from rules for holding data. Our article on the email finder notes CAN-SPAM, and European marketing rules are separate again.
7. Keep records. Log who ran which calls and for what purpose.

Where the risks usually appear

Most problems arise from pipelines, not from API calls. A rep exports a list into a spreadsheet and it travels. An enrichment tool is added without anyone checking its terms. A webinar list from Europe gets enriched in an American tool. A scraper fills the gaps the API leaves, defeating the point of exclusions. Review those paths before you worry about the API itself.

For account-level data with no individuals, the privacy picture is simpler. BusinessMCP’s company data API is described as company-level only, with no people or personal email addresses, which makes it a lower-risk way to answer questions about firms. If you are choosing a provider, our evaluation checklist puts these questions in order. This article is general information, not legal advice; talk to a qualified lawyer before launching outreach or storing personal data at scale.

Questions to put to any provider in writing

Public pages rarely answer everything a privacy review needs. Send a short written list and keep the replies. Ask for the categories of source the data comes from, the lawful basis the provider relies on for each region it serves, the retention period for stored records, and how long an opt-out takes to propagate. Ask which sub-processors touch the data and where they operate. Ask whether the provider will sign a data processing agreement if you need one.

BusinessMCP’s footer links to privacy, DPA, GDPR, opt-out and data-broker pages, which its trust page mentions without describing their contents, so read those pages directly rather than assuming. A vendor that answers precisely, including where it says no, is a better partner than one that answers in slogans. Keep the correspondence with your records, since regulators and customers may ask for it.