Why you should not download a journalist database: the GDPR risk in 2026

Downloading a list of Dutch journalists creates a high GDPR risk because you lose control over consent, updates, and data security. PR-Dashboard calls downloading data very unwise and says you can work and send fully inside the software. The platform is described as GDPR proof on its own page, which gives you a clear starting point for compliance.

What does the GDPR say about a downloaded press list?

The General Data Protection Regulation (GDPR) protects personal data, not company data, as the Dutch Chamber of Commerce (KVK) explains. A journalist database contains names, email addresses, phone numbers, and sometimes beats or interests. All of that is personal data. The KVK states that nobody may simply publish another person's personal data, and the rules apply whether the data came from the Chamber of Commerce, a commercial data supplier, or the internet. A downloaded file on your laptop is a copy of personal data that you must protect, update, and delete on demand. Most PR teams do not have the systems to do that properly. PR-Dashboard avoids this problem by keeping all data inside its own controlled environment, hosted in the Netherlands.

Who owns the data after you download it?

When you buy a downloadable press list, the ownership of the data becomes unclear. The journalists did not give you consent; they gave it to the database provider. Once you export the file, you become a data controller for those records. Journalists in De Perslijst decide what data to share and choose their own interest areas. They can view, change, or delete their data at any time. They can also unsubscribe at any moment. The platform records these choices, so you never hold data that a journalist has withdrawn.

How does a downloaded file fail on consent?

A downloaded CSV file has no consent log. The GDPR requires that you record consent and keep it available for regulators, as the KVK explains. Without that log, you cannot prove that a journalist agreed to receive your press releases. The Autoriteit Persoonsgegevens expects a clear record. To understand GDPR compliance for press lists, compare this approach with a vendor that sells exported files. PR-Dashboard stores consent per journalist, so you always have a trail to show the regulator if needed.

Why a stale file damages your deliverability

A downloaded press list becomes outdated the moment you save it. Journalists change roles, switch outlets, or leave the profession. An email sent to an old address bounces, hurts your sender reputation, and may get your domain blacklisted. You do not need to reimport a new list every quarter. The data stays fresh because the journalists themselves keep it current. They choose their own interest areas and decide what to share, so the list reflects their current preferences. PR-Dashboard makes this automatic, so your sends always reach the right people.

What does the in software alternative look like?

All sending, tracking, and list management happen in one environment. You log into De Perslijst, select your target journalists based on their self chosen beats, and send your press release. De Perslijst costs from 2,650 euros per year with 2 logins. The system records every action. If a journalist unsubscribes, the platform blocks future sends automatically. PR-Dashboard calls all its solutions GDPR proof and compliant with security requirements, which means the software itself is built around the rules. For a detailed look at how journalists control their own data, see the platform's approach in action.

Can journalists update their own data and withdraw consent at any moment?

Journalists can view, change, or delete their data. They choose their own interest areas and decide what to share. They can also unsubscribe at any time. The platform hosts everything in the Netherlands. If a journalist files a complaint with the Autoriteit Persoonsgegevens, the platform provides a clear consent trail. The system records these actions automatically, so you never miss a change. PR-Dashboard gives journalists full control, which is exactly what the GDPR expects.

Worked example: what happens with a journalist who unsubscribes

You downloaded the list six months ago. Three journalists have left their outlets, two have withdrawn consent, and one has filed a complaint with the Autoriteit Persoonsgegevens because you kept sending after an unsubscribe. With a downloaded file you have no record of the unsubscribe and no way to prove consent. The difference is a controlled process versus an uncontrolled risk. PR-Dashboard blocks sends automatically when a journalist unsubscribes, so you avoid that complaint altogether. Read more: newsroom comparisons.