LinkedIn Activity of Contact & Company Founder April 2026: B2B Sales Compliance & GDPR Guide

What 'Activity of Contact and Company Founder' Means in 2026

LinkedIn Sales Navigator's April 2026 release consolidates five previously separate intelligence streams — lead engagement, account news, founder posts, talent and growth signals, and aggregated buyer intent — into a single intelligence panel attached to every saved account. The phrase 'activity of contact and company founder' has emerged as the natural-language description that B2B sales teams use to describe the consolidated view, and the search demand reflects how broadly the feature is being adopted across go-to-market organisations.

The feature is well-documented for sales operations. It is undocumented for compliance teams, and that is the gap this guide fills. When a saved lead likes a competitor's launch post, when a target company's founder shares a hiring update, when a senior voice at the account comments on a category-relevant article — Sales Navigator now bundles those events into one continuously updated narrative that drives outbound prioritisation. For compliance and legal teams, the same panel represents a personal data processing surface that did not exist in this consolidated form before April 2026.

"Our 2026 release reorganises Sales Navigator around buying centres rather than individual leads. Activity signals from contacts, founders, and the broader account team are now surfaced together so sellers can act on coordinated intent rather than isolated events."
— LinkedIn Sales Solutions, April 2026 product update

The compliance question is not whether the feature is useful — it is. The question is what data protection obligations attach to a sales workflow that is now driven by continuous personal data signals about identifiable professionals, particularly when those signals are extracted into a CRM, scored, sequenced, and translated into outbound communication.

Which Sales Navigator Signals Are Now Surfaced

Five signal categories sit inside the consolidated April 2026 panel. Each has a different data origin, a different personal data classification, and a different lawful basis profile for downstream use.

The five categories share an underlying characteristic that matters for compliance — they describe identifiable natural persons acting in a professional capacity. UK and EU data protection law does not exempt professional-context processing from data protection rules. Business email addresses, professional titles, and public LinkedIn activity all qualify as personal data under Article 4 of the GDPR when they relate to an identifiable individual. The fact that the data subject is acting at work does not change the classification.

What does change with professional context is the lawful basis analysis. Legitimate interest under Article 6(1)(f) is the typical basis for B2B prospecting because the reasonable expectations of a senior professional in a public-facing role differ from those of a private consumer. The analysis still has to be performed and documented, and the conditions still apply — particularly the Article 14 information duty and the one-click opt-out requirement.

Where the Compliance Risk Lives

Three distinct risk surfaces emerge when the consolidated signal panel feeds into a B2B sales workflow. Each surface has its own lawful basis question, its own data subject rights exposure, and its own enforcement profile.

Risk Surface 1: Joint Controllership with LinkedIn

For Page Insights and the aggregated audience demographics that LinkedIn surfaces to Page admins, LinkedIn and the Page operator are joint controllers under the LinkedIn Page Insights Joint Controller Addendum. The addendum allocates the data subject information duty to LinkedIn and assigns the Page operator the obligation to reference the joint controllership in its own privacy notice. Many B2B controllers have not updated their privacy notices to reflect this allocation, which is itself a compliance gap. The April 2026 release does not change the joint controllership scope, but it does increase the volume of Page-derived data that flows into downstream sales workflows, which makes the gap more material.

Risk Surface 2: Independent Controllership for Extracted Data

When a brand's sales team extracts an activity signal into its own CRM — whether through manual copy, browser extension, API export, or sales-engagement platform integration — the brand becomes an independent controller for the extracted data. The controller duties include having a documented lawful basis, serving an Article 14 notice on first contact, handling data subject rights requests at the brand level, and applying retention rules that operate independently of LinkedIn's retention. The most common compliance failure is brands treating all LinkedIn-sourced data as 'LinkedIn's problem' and never establishing their own controls — a position that no European supervisory authority accepts.

Risk Surface 3: Automated Decision-Making and Profiling

If the activity signals are scored algorithmically inside the CRM and the score determines whether a human ever contacts the lead — or determines which sales rep, which sequence, or which offer — then Article 22 of the GDPR is in scope. Article 22 prohibits solely automated decisions producing legal or similarly significant effects unless one of the narrow exceptions applies. Most B2B intent-scoring systems include a human in the loop, which keeps them outside the Article 22 prohibition, but they remain subject to the profiling rules, the transparency obligations, and the recently-expanded UK definition of direct marketing that captures profiling and segmentation as preparatory marketing activities.

For tactical guidance on Page-level configuration and joint controllership documentation, see LinkedIn Advertising Policies.

GDPR Legitimate Interest: The Three-Part Test

Legitimate interest under Article 6(1)(f) is the established lawful basis for B2B prospecting on the back of LinkedIn signals. It is not automatic and it is not free. It requires the controller to pass and document a three-part test before processing begins, and the test has to be revisited when the processing changes or when the data source materially changes — the April 2026 signal consolidation is a triggering event that should force a Legitimate Interest Assessment refresh for every UK and EU B2B team.

Part One: Purpose Test

The controller's interest must be specific, lawful, and clearly articulated. 'Generate revenue' is not specific enough. 'Identify buying centres at companies that have publicly signalled intent in the controller's product category and offer a category-relevant solution to senior decision-makers' is specific enough. The purpose statement should be written down, dated, and version-controlled, and it should be re-examined whenever the campaign objective changes.

Part Two: Necessity Test

The processing must be necessary for the stated purpose and must be the least intrusive way to achieve it. If a campaign objective could be met by serving paid LinkedIn ads to a broader audience without extracting individual signals into a CRM, the controller should consider whether the more intrusive intent-extraction approach is genuinely necessary. The necessity test is not a prohibition on intent-based outreach — it is a requirement to consider alternatives and to record the reasoning that supports the chosen approach.

Part Three: Balancing Test

The controller's interest must not be overridden by the data subject's interests, rights, and freedoms. The balancing test weighs several factors — the nature of the data (professional vs. private), the reasonable expectations of the data subject (a CMO has different expectations than a junior engineer), the purpose-data fit (role-relevant outreach vs. unrelated marketing), the safeguards in place (privacy notice, opt-out, retention rule), and the impact on the data subject (one-time outreach with opt-out vs. persistent profiling). For senior decision-makers in publicly visible professional roles, the balance typically favours the controller. For junior employees whose professional activity has been scraped at scale, the balance typically does not.

Documentation and Re-Assessment

The three-part test is operationalised through a written Legitimate Interest Assessment that records the controller's reasoning. The ICO and the EDPB both treat the absence of a documented assessment as evidence that the controller has not properly considered the data subject's rights. The assessment should be revisited annually, when the data source changes, when the processing purpose changes, when the audience changes, and when the regulatory environment changes. The April 2026 Sales Navigator update and the June 2026 UK Data Act 2025 alignment are both triggering events.

UK Data Act 2025 Article 6(1)(ea) — June 2026 Deadline

The UK Data (Use and Access) Act 2025 introduces a new lawful basis under Article 6(1)(ea) of the UK GDPR, recognising a defined list of 'recognised legitimate interests' that do not require the controller to run the full three-part balancing test for each processing activity. The provisions enter operational force on 19 June 2026, and the Information Commissioner's Office expects controllers to have aligned their lawful basis documentation by that date.

What's Inside the New Basis

Expanded Definition of Direct Marketing

The Act also broadens the definition of direct marketing to cover preparatory steps including profiling and segmentation, which means that scoring prospects in a CRM using LinkedIn engagement data is itself a marketing activity for the purposes of the Privacy and Electronic Communications Regulations — not just the eventual outbound message. Controllers should audit their CRM scoring logic and ensure that profiling is included in the privacy notice and in the opt-out mechanism.

What to Do Before 19 June 2026

• Re-classify lawful basis register: Activities that fall inside the new enumerated list should be re-classified to take advantage of the simpler basis.
• Refresh LIAs: Activities that remain under Article 6(1)(f) — including LinkedIn-driven cold prospecting — should have their LIAs refreshed and dated post-19 June 2026 to demonstrate alignment.
• Update privacy notices: The first-touch privacy notice should reference both bases where the controller uses both.
• Audit CRM scoring: Profiling logic should be disclosed and opt-out should suppress profiling as well as outbound.

For UK and EU regional context, see European Union DSA Compliance.

Sales-Compliance Workflow for Activity Signals

A defensible workflow ties the activity signal to the lawful basis, the lawful basis to the privacy notice, the privacy notice to the opt-out, and the opt-out to the suppression — with each link auditable. Eight operational steps make the workflow concrete.

Step 1: Tag Signal Source in the CRM

Every activity-signal-derived record should carry a structured source field — for example, source = 'LinkedIn Sales Navigator — Lead Activity Alert' or 'LinkedIn Sales Navigator — Founder Post' — alongside a lawful basis field that references the governing LIA version. Free-text notes do not meet the auditability bar.

Step 2: Maintain Per-Campaign LIA Documentation

Each outbound campaign that uses activity signals should reference an LIA that covers the campaign's purpose, audience, and processing. A single template LIA can be reused with campaign-specific overrides for purpose, audience size, and data minimisation choices.

Step 3: Serve Article 14 Notice on First Touch

The first outbound communication should include or link to a privacy notice that identifies the controller, explains the lawful basis, identifies the source (LinkedIn Sales Navigator), describes the processing, references the joint controllership with LinkedIn where relevant, and provides the opt-out path.

Step 4: One-Click Opt-Out

The opt-out mechanism should be a single click. List-unsubscribe headers in email, a clearly labelled link in any messaging-based outreach, and a respectful response handling protocol for in-platform LinkedIn outreach are all part of the same obligation.

Step 5: Suppression List Propagation

Opt-out events should propagate within minutes across the CRM, the marketing automation platform, the sales engagement platform, the LinkedIn Sales Navigator integration, and any data enrichment provider. Re-import scenarios — where a new dataset reintroduces a previously suppressed contact — should be tested quarterly.

Step 6: Three-Year Retention Rule

Inactive prospect records should be deleted within a defensible retention window. Three years from last meaningful engagement is the common B2B practice unless a renewed engagement justifies a longer window. The retention rule should be automated, not left to manual review.

Step 7: Quarterly Compliance Review

The workflow should be reviewed quarterly with a small cross-functional group — sales leadership, compliance, legal, and data engineering. The review covers volume of signal-triggered outreach, opt-out rate, complaint rate, retention compliance, and any platform changes that affect the workflow.

Step 8: Tooling

Automated audit and rejection-prevention tooling reduces the manual compliance burden and surfaces drift before it escalates. For ad-side compliance, see AI Compliance Audit. For outbound message language risk, see Keyword Risk Checker.

Compliance Checklist

• [ ] LIA written, dated, version-controlled, and stored alongside the record of processing activities
• [ ] LIA refreshed after the April 2026 Sales Navigator signal consolidation
• [ ] Lawful basis register reviewed against UK Data Act 2025 Article 6(1)(ea) before 19 June 2026
• [ ] Privacy notice references LinkedIn Page Insights joint controllership
• [ ] Article 14 notice served on first contact when the data was not collected directly from the data subject
• [ ] One-click opt-out present in every outreach channel
• [ ] Suppression list propagation tested across CRM, marketing automation, sales engagement, and LinkedIn integration
• [ ] Three-year retention rule automated
• [ ] Re-import scenarios tested quarterly
• [ ] CRM scoring logic disclosed in privacy notice and covered by opt-out
• [ ] Special category data excluded from targeting even when LinkedIn surfaces it
• [ ] Source field structured in CRM so audits can trace any record back to the signal that produced it
• [ ] Quarterly compliance review scheduled with sales, compliance, legal, and data engineering
• [ ] Record of processing activities under Article 30 updated to reflect April 2026 signal consolidation
• [ ] Employee training updated to cover the joint controllership boundary and the independent controllership duties

For continuous policy monitoring across LinkedIn and the other major B2B platforms, see Policy Tracker.