GDPR and Customer Feedback in B2B: What You Can Actually Collect [2026]

You do not need consent to run a satisfaction survey. You need the right legal basis, disciplined data minimisation, and feedback data you can actually take with you. Here is what GDPR, and now the EU Data Act, require in practice.

Do you need consent to send a customer satisfaction survey under GDPR?

No. For an existing B2B customer relationship, a satisfaction survey almost always runs on legitimate interest under Article 6(1)(f) of the GDPR, not on consent. A survey is not direct marketing, you already have a relationship, and the person you are contacting reasonably expects to be asked about the service they bought.

Legitimate interest is not a free pass. It requires a documented, three-part legitimate interest assessment (LIA) before you send anything: name the interest (understanding and improving the service), show that the processing is necessary for it (could you get there with less data?), and balance it against the respondent's rights and reasonable expectations. For surveys to existing customers this balancing is usually easy to pass, but you have to write it down. Do it once, reuse it across your programme.

Consent under Article 6(1)(a) still has a place. Use it when you want to reuse feedback for something the customer would not expect, such as publishing a named public testimonial or feeding a response into a marketing sequence. Then get consent for that specific, separate purpose.

One Danish wrinkle worth calling out: the Danish Marketing Practices Act (markedsføringsloven) section 10 requires prior consent for electronic direct marketing. A genuine satisfaction survey is not marketing, so section 10 does not apply. But the moment your "survey" turns into a sales pitch or a nudge toward a review site, you are in section 10 territory and you need consent. Keep the two things separate, in intent and in wording.

Why consent is usually the wrong basis for feedback

Here is the part most privacy checklists get backwards. Consent feels like the safe, respectful default, so teams reach for it automatically. For an ongoing feedback programme, it is often the worst choice.

Consent under the GDPR must be freely given, specific, informed, and unambiguous, and it must be as easy to withdraw as it was to give. For a recurring relational NPS programme that is fragile: one withdrawal and you have to scrub that person from every future wave, prove you did, and hope your systems actually enforce it. A consent gate in front of the survey also quietly wrecks your numbers, because you lose respondents at the gate before they ever see a question, which is the last thing you want when you are already fighting for a decent survey response rate.

Legitimate interest, documented properly, is both more robust and more honest. You are asking existing customers about a service they pay for. Say that, base your processing on it, and reserve consent for the genuinely optional and the genuinely unexpected.

A 2024 EU Ruling Confirmed Commercial Interest Counts, But Raised the Documentation Bar

Does a commercial motive, more upsell, better retention, a stronger renewal rate, disqualify a legal basis of legitimate interest? The Court of Justice of the EU answered that directly on 4 October 2024, in Case C-621/22 (KNLTB). The case started when the Dutch data protection authority fined a tennis association 525,000 EUR for sharing member data with sponsors, arguing that a purely commercial motive could never be "legitimate" under Article 6(1)(f). The CJEU disagreed: commercial interests can constitute a legitimate interest, provided they are lawful and pass the same three-part test as always (legitimate interest, necessity, balancing).

That is good news for a CX programme built on legitimate interest instead of consent, exactly the position this article recommends. The part worth reading twice came four days later. On 8 October 2024, the European Data Protection Board (EDPB) published draft Guidelines 1/2024 on Article 6(1)(f), and it raised, rather than lowered, the documentation bar. The counterintuitive detail: the safeguards you already have in place, short retention periods, transparency notices, minimisation, do not automatically count in your favour during the balancing test itself. The EDPB treats them as separate obligations, not as credit toward passing the third step. In practice, your LIA cannot simply say "we minimise and delete after 12 months, so we win the balancing test." It has to independently show why the processing is proportionate before those safeguards are counted at all.

For a B2B feedback programme, this changes nothing about which legal basis to use. Legitimate interest is still correct. But it changes what your LIA needs to contain. Write the three steps separately and explicitly: name the interest, show necessity on its own terms, then balance against the customer's rights, and only afterwards list your safeguards as separate mitigations. A one-line LIA that leans entirely on "we already minimise data" will not hold up if a supervisory authority looks closely.

What data should a B2B feedback programme actually collect?

Data minimisation is Article 5(1)(c): personal data must be adequate, relevant, and limited to what is necessary for the purpose. In plain terms, collect enough to act, not everything you could capture. Every "nice to have" field is data you now have to secure, justify, and eventually delete. That constraint is less of a trade-off than it looks: personalization only builds loyalty when the customer can see why you know what you know, so the minimal, explainable data footprint is usually the commercially stronger one too.

Then there is the trap almost everyone walks into: the open-text field. Customers paste whatever they want in there. A named colleague ("Anna in support was brilliant"), a direct phone number, sometimes health or financial context depending on your sector. You are now processing personal data you never asked for, occasionally special-category data. Two defences: tell respondents in the field label not to include sensitive personal details, and put your verbatims on a redaction or deletion schedule so they do not accumulate forever. This matters most in a Voice of Customer programme where verbatims are the whole point and the volume is high, and it is exactly the raw material AI text analytics tools are built to process at scale, which raises the stakes on minimisation before that data ever reaches a model.

How long can you keep customer feedback under GDPR?

Storage limitation is Article 5(1)(e): keep personal data only as long as necessary for the stated purpose, then delete or anonymise it. For CX this means identifiable responses have a working life. You need them long enough to close the loop, track an account's trajectory, and see a trend. After that, aggregate the scores, anonymise the verbatims, and drop the identifiers.

Set the clock before you launch, not after a data subject access request forces the question. A common and defensible pattern: keep identifiable responses for a rolling 12 to 24 months for trend analysis and account tracking, then anonymise. Pick a number, document it in your LIA and privacy notice, and actually enforce it.

One caution that trips people up: pseudonymised data is still personal data. The European Data Protection Board reaffirmed this in its January 2025 guidance. Replacing names with a key reduces risk and is good practice, but it does not take the data out of scope. Pseudonymisation is a safeguard, not an exemption.

Anonymous, pseudonymous, or identified: which one for B2B?

This is where B2C privacy advice actively misleads B2B teams. In a mass consumer survey with 40,000 respondents, anonymity can make sense. In B2B, where you have 40 accounts that each matter, anonymity is usually a mistake.

You cannot recover an anonymous detractor. You cannot connect an anonymous score to renewal risk, to a customer health signal, or to the person who can actually fix the problem. The point of B2B feedback is to act on it by account, and anonymity removes exactly that. The privacy-preserving answer is not anonymity. It is identified collection with strict minimisation, a clear legal basis, and short retention, so you can close the loop without hoarding data.

Anonymity does have its place, just not here. Employee sentiment, eNPS-adjacent studies, and anything whistleblower-shaped need it. That is a different problem with a different answer.

What information do you owe respondents?

Transparency lives in Articles 13 and 14. At or before the point you collect data, you have to tell people who the controller is, the purpose, the legal basis (and if it is legitimate interest, what that interest is), how long you keep the data, their rights, and any processor involved. In practice this is a one-line privacy notice beneath the survey with a link to your full policy. Do not bury it and do not skip it. It is cheap insurance, and being upfront tends to improve trust and response rather than hurt it.

EU Data Act: your feedback data has to be portable now

Since 12 September 2025 the EU Data Act (Regulation 2023/2854) has applied across the EU. It targets exactly the lock-in that plagues cloud CX tools. Customers can switch data-processing services, including SaaS, IaaS, and PaaS, and providers must support interoperability and structured data export.

The rollout is staged, not a single date. The core access and switching obligations have applied since 12 September 2025. From 12 September 2026, new connected products must meet "data by design" requirements, and cloud providers face enhanced interoperability obligations. From 12 January 2027, switching charges and data-egress fees are banned outright, not merely capped at cost as they are today. For a CX vendor contract you sign or renew now, that means the vendor's current "reasonable switching fee" is on a countdown clock, not a permanent feature of the deal.

The practical CX implication is blunt. When you choose or renew a feedback vendor, "can we get our raw responses out in a usable, structured format, on demand, without a penalty?" is now a compliance question, not a nice-to-have. Vendor lock-in on your own customers' feedback is a liability you can be asked to justify. Get the export commitment in writing before you sign, and note the January 2027 date if your current contract still references switching fees.

How SurveyGauge handles this

We treat this as advisory work, not a settings page. For most clients we base relational and transactional programmes on legitimate interest, help write the LIA once so it covers the whole programme, keep collection minimal by default, and agree a retention period with you up front rather than leaving verbatims to pile up. And because the EU Data Act says your data is yours, we give you your raw responses in a structured export whenever you ask, no penalty and no lock-in. Platform and CX advisory in one subscription, so the compliance and the value questions get answered together instead of falling between two vendors.

For a hypothetical picture: when Nordika A/S moved from an anonymous annual survey to identified, minimised relational NPS with a documented legitimate interest basis and a 24-month retention rule, they did not just tighten compliance. They could finally act on named detractors and tie feedback to account renewals, which is the entire reason to collect it.

Want your feedback programme on solid legal footing without killing response or usefulness? SurveyGauge combines the platform and the CX advisory in one subscription, and your data is always yours to export. Book a free demo or see pricing.