Position paper · August 2026

A specific reason. A known source. A deletion that stays deleted.

Almost every CRM demo fills the record from a LinkedIn profile in one click. 21 pages on why we will not sell you that button, and the enrichment architecture we build in its place.

By Lars Jankowfsky, Founder, Gradion

Paper cover: Compliant Data Enrichment - a product architecture for Europe and Vietnam

We could have built it in a week. The technical difficulty was never the issue. LinkedIn's contract forbids the plugin by name. European privacy law asks who told the person their data was collected. And in Germany, software that watches which pages an employee opens stops being a CRM feature and becomes a works-council matter.

Inside

Article 14 GDPR - the duty to tell the person, which most enrichment products treat as somebody else's problem, and how it becomes a release gate instead.
What the enforcement record actually says: Bisnode, Kaspr (€240,000), Lusha (€2m and an order to delete the Italian data), Clearview - and how hiQ v. LinkedIn really ended.
The decision table: fourteen capabilities, the one question that decides each, and whether Margince builds, gates, defers or refuses it.
Vietnam under Law 91/2025: why verifiable consent is the only defensible route, and why buying broker data is the highest-risk act in the paper.
Why the Betriebsrat belongs in the design rather than in a late approval step - and which feature choices decide how hard that conversation gets.
Ten questions to put to any enrichment vendor - answerable from architecture, not from a compliance seal.

Written for the people the paper says are at the table in DACH: the works council, the data-protection officer and counsel.

Primary sources where they exist, and four open gates left visible rather than buried - including counsel approval on the Article 14 notice wording and a pending Member Data Portability API application.