100% phone coverage in healthcare: the GDPR dead end (2026)

In December 2024, the CNIL (France’s data protection authority) fined a provider of professional contact details €240,000 for building a database of 160 million contacts by scraping LinkedIn profiles, including contact details that users had chosen to hide (CNIL, decision of December 5, 2024). That’s the real cost of maximum coverage obtained outside the rules.

No healthcare prospecting list reaches 100% phone coverage while staying GDPR-compliant. Official public sources, such as the RPPS, cap out at around 30 to 40% coverage for direct phone numbers. Beyond that, you have to either scrape data or buy lists from brokers, two practices the CNIL sanctions, and the liability falls on whoever uses the list.

This article explains why 100% is mathematically impossible with compliant data, what the CNIL says about the status of professional contact details, the risk carried by the buyer of a list, and the coverage rate an auditable method actually produces.

Can you reach 100% phone coverage and stay GDPR-compliant?

No. You can’t reach 100% phone coverage from compliant public sources. Official directories and the RPPS (France’s national registry of healthcare professionals) don’t publish every practitioner’s direct mobile number. The phone coverage actually available sits around 30 to 40%. Claiming 100% means filling the rest through non-public means, which falls outside the legal framework for personal data.

The reasoning is arithmetic before it’s legal. A public source is exhaustive about what it publishes and silent about everything else. The RPPS gives a physician’s identity, specialty, and affiliated facility, but rarely their direct line. Facility listings give a switchboard number, not a named mobile. The share of your target you can reach directly by phone, using these sources alone, is partial by design.

To get from that partial share to “100%,” there are only two levers: scrape contact details wherever they’re lying around (social networks, private directories), or buy them from a broker who did one or the other before you. Both shift the problem; neither solves it. A round number always hides one of these two operations.

Is a healthcare professional’s phone number personal data under the GDPR?

Yes. A practitioner’s named professional phone number is personal data, even when it’s publicly accessible. The GDPR applies fully to its collection and reuse. It isn’t health data within the meaning of Article 9, but ordinary personal data, and that’s enough to require a legal basis, notice to the person concerned, and a right to object.

The distinction matters to a DPO. A physician’s contact details aren’t sensitive data under the stricter Article 9 regime, which covers patients’ health. They fall under the general regime. That general regime isn’t a free-for-all: it requires a documented legal basis and respect for the person’s rights from the very first contact.

For business-to-business prospecting, that legal basis is generally legitimate interest, provided that the purpose of the outreach relates to the person’s profession, and that they’ve been told how their number is being used and can easily object (CNIL, rules for commercial phone prospecting). Legitimate interest isn’t a blank check: it comes with conditions, and those conditions are not met if the data was collected unlawfully upstream.

Why isn’t “public” data free to reuse?

Data that’s publicly accessible isn’t free to reuse for prospecting. The CNIL is explicit: this data remains personal data and therefore can’t be freely reused by just any data controller. The fact that a profile or listing is visible doesn’t authorize you to load it into a sales database.

That’s the heart of the misunderstanding around 100%. Many players reason as if “visible online” meant “collectable and resellable.” The CNIL ruled the opposite in its guidance on reusing publicly accessible online data: reuse requires its own legal basis, informing people of where the data came from, and respecting the right to object, including checking do-not-call lists.

The €240,000 fine mentioned at the start is a direct illustration. Scraping contact details from a social network, even when they were displayed on profiles, was found to lack a legal basis, all the more so because the company was collecting information whose visibility the people concerned had restricted. The “public” nature of the source protected no one.

What does a company risk when it buys a “100% phone numbers” list?

A company that uses a purchased list is itself responsible for the list’s compliance, not just the broker who sold it. The CNIL fined FORIOU €310,000 (decision of January 31, 2024) and HUBSIDE.STORE €525,000 the same year for reusing broker data without making sure people had validly consented to be contacted. The contract with the supplier doesn’t let the buyer off the hook.

That’s the point the 100% promise glosses over. The list vendor hands you the volume and leaves the risk with you. The CNIL has made clear that contractual guarantees imposed on the broker upstream aren’t enough: the buyer has to run its own checks on the origin and lawfulness of the data, and be able to document them. Otherwise, it’s the buyer who answers to the regulator on the day of an audit or a complaint.

In healthcare, the ground is even less forgiving. A compliance-minded buyer, an ISO audit, a quality program, or a CNIL complaint can quickly turn an opaque list into a liability. A purchased B2B healthcare database goes stale and proves impossible to verify precisely because its origin can’t be traced. If you can’t show where each number came from, you don’t own an asset; you’re carrying an exposure. A 30-minute scoping call is enough to measure what your current list can’t justify.

How do you get phone coverage that’s compliant and usable?

You get compliant coverage by keeping only the contact details tied to a verifiable public source. Each number is linked to the URL that justifies it, an RPPS record or an official facility listing; without an identifiable source, the data doesn’t go into the list. The resulting coverage, around 30 to 40% for direct phone numbers, is lower than an advertised “100%,” but it’s auditable from end to end.

This choice accepts a trade-off: we’d rather have a gap than guesswork. An empty field is honest and risk-free; an unverifiable number is debt lying dormant until the first audit. With healthcare professionals’ data, where rigor is part of the product, this trade-off is hardly a trade-off at all. The right benchmark for targeting practitioners using the RPPS isn’t the displayed fill rate; it’s the share of rows you can source.

That’s Agify’s approach: deliver only contact details traced to a public source, and leave the field empty when proof is missing. Coverage looks more modest on paper and holds up better in practice, because it contains nothing you can’t defend. When a vendor promises 100%, the useful question isn’t “how many numbers”; it’s “can you give me the public source for each one?”

Frequently asked questions

Is a professional phone number subject to the GDPR?

Yes. A named professional phone number identifies a natural person, so it’s personal data subject to the GDPR, even if it appears in a public directory or on a facility listing. Collecting and reusing it requires a legal basis, notice to the person, and a right to object. The fact that the data is professional doesn’t take it outside the regulation.

Is it legal to buy a healthcare prospecting list?

Buying one isn’t prohibited in itself, but using it puts the buyer’s liability on the line. The CNIL has fined several companies (FORIOU, €310,000; HUBSIDE.STORE, €525,000, in 2024) for prospecting with broker data without checking that it had been lawfully collected. Buying a list obliges you to check and document the origin of every data point; otherwise, the risk falls on whoever uses it.

Is scraping LinkedIn allowed for prospecting?

No, not to build a commercial prospecting database. In 2024, the CNIL fined a company €240,000 for scraping contact details from LinkedIn, including information whose visibility had been restricted, without a legal basis. The fact that data appears on a profile doesn’t make it free to reuse for sales outreach.

What phone coverage rate is realistic from public sources?

Around 30 to 40% for direct phone numbers on a healthcare professional target, using the RPPS and official facility listings. Public sources don’t contain every practitioner’s direct line, which mechanically caps coverage. A higher rate claimed without proof of source signals that the list was topped up through scraping or purchased data.

Does B2B phone prospecting require consent?

Today, phone prospecting between businesses relies on legitimate interest, provided that the purpose relates to the person’s profession and that they can easily object. Every call must allow the person to identify the caller and say no. The rules governing phone solicitation change as of August 11, 2026, with professionals keeping a right to object.

Conclusion

“100% phone coverage” isn’t a performance claim; it’s a sign of non-compliance. Three facts sum it up. Public healthcare sources cap out at around 30 to 40% for direct phone numbers, so any higher figure comes from somewhere else. Public data isn’t free to reuse; the CNIL has put that in black and white. And liability for using the data falls on the buyer, not the broker.

So the right criterion isn’t the fill rate; it’s traceability: for every number, a public source you can check. More modest coverage that you can source beats a complete list you can’t defend. Let’s look at your case in 30 minutes: we’ll review your current list and the share of contact details you could actually justify in an audit.

---

Agify deploys autonomous AI outbound agents within B2B sales teams, with a specialization in the French MedTech market, its public healthcare data sources, and their compliance constraints.