Yes, GDPR applies even if you work exclusively with other businesses. The regulation does not look at who your customer is, but at what you process: as soon as you record the name, email address, telephone number or job title of a contact person, you are processing personal data. The fact that this contact person calls or emails on behalf of a business makes no difference in law.
The confusion arises because people associate GDPR with consumer data: orders, customer accounts, newsletters. But an invoice address with the name of a purchasing manager, a CRM entry with the mobile number of a contact person, or email correspondence with a supplier all fall under the same rules. It is about the data of a natural person, not about the type of relationship you have with that business.
What changes and what does not in B2B
The fact that you operate in a B2B environment does not change the core of GDPR, but it does change the practical application. Many of the obligations that feel burdensome with consumer data, such as asking permission for marketing or explaining why you collect data, often have a different, lighter application with business contact details. For example, there is often a legitimate interest to approach a contact person about an ongoing assignment than with a random consumer. That does not change the fact that you still must be able to explain why you keep that data and for how long.
What also does not change: the obligation to keep this data secure, and the right of the contact person themselves to ask what you have recorded about them. A purchasing manager at a client could in theory submit a data access request, just like a private customer. GDPR makes no distinction based on who is asking.
Practical examples
An installation company that works only with other businesses usually still has a CRM full of names, telephone numbers and email addresses of contact persons at customers and suppliers. An HR manager who keeps CVs of applicants processes personal data, even if the vacancy is for a technical position within a B2B business. An office manager who has visitors sign in upon arrival likewise records the names of people who visit on behalf of another business.
In none of these cases is it about consumer data in the classical sense, and yet they fall under the same regulation. The distinction that does matter in practice is not B2B versus B2C, but: is it a natural person who is identifiable, or is it completely anonymised or purely business data such as a company registration number or a generic info@ address without a name.
What this means for your processing activity record
Because business contact details fall under GDPR, they also belong in your processing activity record: where they come from, why you keep them, who has access to them and how long you keep them. In many SMEs, this turns out to be precisely the category that is overlooked, because attention goes to personnel files or customer data of end consumers. In the knowledge base with guidance for each situation you will find more background on when data counts as personal data and when it does not.
If you use SaaS tools for your CRM, email traffic or invoicing, those tools often also process these business contact details. That is relevant to the processor agreements you have or should have with those vendors, and to the question of which tool processes which data exactly. Via the most frequently asked questions about GDPR in practice you can read how that relates to your broader obligations.
Whether your specific situation falls under certain exceptions, or which legal basis precisely applies to your way of working, varies from business to business and is something you should best discuss with a legal advisor or the Dutch Data Protection Authority if in doubt. What does apply to virtually every business: if you record personal data of contact persons without knowing exactly which ones and why, that is a good starting point to get in order.
Check your own situation
Do you want to quickly see which data flows in your business count, including business contact details of customers and suppliers? Take the free quick-scan or read first how gdpria.eu structures the information from the GDPR and the supervisory authorities, and create a business account if you want your register to be built from the tools you already use.