Lead Enrichment Explained: Fields, Sources, Accuracy and GDPR

Lead enrichment is filling in missing fields on a lead or company record, such as job title, work email, company size or industry, from other data sources. Done well it lets you qualify and segment leads without manual research. Done carelessly it fills your CRM with stale, unverifiable data and creates GDPR obligations you did not plan for.

This guide covers which fields are worth enriching, where enrichment data comes from, how quickly it goes wrong, and what the law requires in the UK and EU.

What enrichment actually does

Enrichment takes a thin record and adds the fields you need to act on it. The input is usually one of three things: an email address from a form, a company domain, or a name plus a company. The output is a fuller record.

Typical uses:

• Qualifying inbound leads without making the form longer. Ask for an email, enrich the company size and industry.
• Routing: send enterprise accounts to one rep and small ones to another.
• Segmenting outbound by role, industry or technology.
• Filling the gap in outbound research: you have a name and a company, and need the email address.

Which fields to enrich

Enrich only the fields you will use to make a decision; every extra field is something to keep accurate and justify. Fields fall into two groups that behave very differently.

Field type	Examples	How fast it changes	Typical use
Firmographic (company)	Domain, industry, headcount band, country, founded year	Slowly	Qualification, routing
Technographic	Website platform, email provider, CRM	Occasionally	Segmentation, relevance
Contact (person)	Name, job title, seniority, department	When people change roles	Personalisation
Contact channel	Work email, phone, LinkedIn URL	When people change jobs	Reaching the person
Signals	Hiring, funding, new location	Constantly	Timing

Company-level fields are usually the safer place to start. They change slowly, are often published by the company itself, and in many cases are not personal data at all. Person-level fields are where both the accuracy problems and the legal duties concentrate.

Where enrichment data comes from

Every enrichment tool draws on some mix of public sources, licensed data, contributed data and live checks, and the mix decides both accuracy and legal risk.

• The company's own website. Team pages, contact pages and footers often list addresses, names and social profiles. Highest confidence, because the company published it.
• Public registries and filings. Company registers such as Companies House give legal name, status and officers.
• Professional profiles and press. Job titles, moves and announcements.
• DNS and technical signals. A domain's MX records reveal its email provider; page source reveals its website platform.
• Contributed or co-op data. Some vendors build databases partly from data their users share. Ask any vendor how it sources contacts before you buy.
• Live verification. For emails, a check against the mail server confirms whether a mailbox accepts mail, without sending a message.

Some platforms combine many sources. Clay, for example, says on its pricing page (checked 8 October 2026) that it can "find and enrich data from 150+ providers" and run "multi-provider waterfalls", meaning it asks one provider after another until one returns a value. Waterfalls raise coverage, but each extra provider is another source you may need to name to the data subject.

Accuracy and decay

Enriched data starts ageing the moment you receive it, and person-level fields age fastest. A job title or work email is correct until the person moves, and then it is wrong without any warning in your CRM.

How fast does that happen? There is no single audited figure. The widely quoted "22.5% a year" cannot be traced to a published study; our analysis of B2B contact data decay uses US job tenure data to estimate that roughly 10% to 25% of people leave their employer each year, depending on role.

Practical rules:

1. Store the date and source of every enriched field, not just the value.
2. Spot-check a sample of each new source against primary evidence, such as the company website, before trusting it at scale.
3. Verify every email before sending, even if the enrichment tool labelled it valid. Labels on catch-all domains in particular can only be guesses.
4. Re-enrich on triggers: before a campaign, when a contact bounces, when an account re-enters the pipeline.

Treat a provider's headline accuracy figure as a claim to test, not a fact. Our verifier claims audit shows how loosely accuracy numbers are used in this market.

GDPR and enrichment

Enriching a record about a person is processing personal data, so the UK and EU GDPR apply in full, and Article 14 adds a duty that many teams miss. This is an outline, not legal advice.

• Lawful basis. Most B2B teams rely on legitimate interests, which requires a balancing test you can document. Sending the email is a separate question governed by PECR and the ePrivacy rules; our GDPR and B2B cold email post covers the two-layer test.
• Data minimisation. Article 5(1)(c) of the GDPR requires personal data to be "adequate, relevant and limited to what is necessary". Enriching thirty fields because a tool offers them is hard to justify.
• Accuracy. Article 5(1)(d) requires data to be "accurate and, where necessary, kept up to date", with inaccurate data "erased or rectified without delay". Decay is not just a deliverability problem.
• Telling people. When you obtain data from a source other than the person, Article 14 requires you to tell them, including "from which source the personal data originate". The deadline is "at the latest within one month", or, if you use the data to contact them, "at the latest at the time of the first communication". In practice that means a short privacy notice linked from your first email, naming your sources.

Keep the source column. Without it you cannot answer an Article 14 or access request.

Tool categories

Enrichment tools fall into a few categories, and the right one depends on whether you start from a company, a person or an email address.

Category	Starts from	Returns	Watch for
Contact databases	Filters (role, industry)	Lists of people with contact details	Sourcing, decay, credit costs
Email finders	Name plus company domain	A work email and a status	How catch-all results are labelled
Website enrichment	Company domain	Published emails, names, social links	Coverage varies by site
Orchestration platforms	Any field	Whatever their connected providers return	Cost per action, many sources to disclose
Verifiers	Email address	Deliverable, risky or invalid	Must run before sending

SimpleVerifier sits in the last three rows (see pricing): an email finder, website enrichment for published emails, owner names and socials, and verification. It is not a large contact database.

The takeaway

Enrich the few fields you will act on, start at company level, record the source and date of everything, verify emails before they are used, and plan your Article 14 notice before the first send rather than after the first complaint.