How to build a B2B prospect list that survives first contact

A prospect list is a hypothesis written down, not an export. Build it account first, keep six fields, record where every row came from, and size it against the accounts you can genuinely work this quarter rather than the number you can download.

Most prospect lists are built in the wrong order. Someone picks a tool, exports two thousand contacts that match a job title, and then the team spends a quarter discovering that the title was the only thing those two thousand companies had in common. The list was never the problem. The definition was missing.

A prospect list is a hypothesis written down. It says: these specific organisations have the problem we solve, at a scale that justifies our price, and we can reach a person inside them who owns it. Every field in the list should exist to test one part of that sentence. If a column does not help you decide whether to contact the account, it is decoration.

Start from the account, not the person

The common mistake is building a list of people and inferring the company from them. It should be the other way round. You qualify the organisation first, because that is where fit actually lives, and only then find the person.

Account level criteria are also the ones you can verify from outside without guessing: sector, headcount band, whether they have the thing your product attaches to, whether they operate in a market you can serve and invoice. Person level criteria are softer and change every few months as people move.

In practice this means your first pass produces a company list with no names on it at all. That feels unproductive and it is the most valuable hour in the process. If the company list is weak, adding contacts just multiplies the error.

The six fields that earn their place

A list with forty columns is a list nobody maintains. These are the ones that change a decision.

• Trigger. The observable reason this account is worth contacting now rather than in general. A new site, a funding round, a job posting for the role next to yours, a regulatory deadline. No trigger means no reason, and no reason is what produces the cold email nobody answers.
• Fit evidence. The specific thing you observed that says they have the problem. Not a score. A sentence a colleague could check.
• Owner of the problem. The role that feels the pain, which is frequently not the role that signs.
• Route in. How you will actually reach that person: a mutual connection, an event, an inbound path, or cold. Fill this in before contacting, because a list where every row says cold is a list that will perform like one.
• Source and date. Where each data point came from and when. This is the field everyone skips and the one that saves you later, both for accuracy and for the legal position below.
• Disqualified reason. Kept, not deleted. A list without a graveyard gets rebuilt from scratch every year and you re contact people who already said no.

Where the data can honestly come from

Ranked by how well it holds up, which is roughly the inverse of how fast it is. Your own records of past enquiries that went nowhere. Public registries and licensing bodies. Industry associations and member directories. Event attendee and exhibitor lists. Company websites and filings. Purchased or scraped databases last, because you inherit someone else's collection practices along with the rows.

That last point is not squeamishness. If you cannot say where a contact came from, you cannot answer a question about it later, and in the Gulf that question has a regulator attached to it.

The legal position, as far as the official guidance actually goes

If you are prospecting into Saudi Arabia, the Personal Data Protection Law applies and it is enforced by the Saudi Data and Artificial Intelligence Authority. Two things from SDAIA's own published guidance manual on the PDPL are worth having straight.

First, the definition of personal data is broad. The manual quotes it as any data, whatever its source or form, that could lead to identifying the individual specifically. A named person at a named employer with a work email is comfortably inside that. The common assumption that business contact details sit outside data protection because they are professional does not follow from this wording.

Second, on marketing the guidance is explicit about one case and silent on another. It states that sensitive data may not be processed for marketing purposes even if the individual's consent has been obtained. So there is no consent route for sensitive categories at all. The same manual does not set out the rules for marketing with non sensitive personal data, and it says of itself that it is a guidance document rather than a substitute for the regulations.

We are going to be honest about the limit of that rather than paper over it. The secondary summaries we checked disagree with each other about which article number carries the direct marketing consent rule, and whether the 2025 draft amendments to the implementing regulations changed the definition of direct marketing at all. We could not resolve that from the official guidance alone. If your outbound programme targets Saudi contacts at any volume, this is a question for local counsel against the current regulations, not something to settle from a blog post including this one.

What is safe to act on today, and costs you nothing: record the source and date of every contact, keep a working opt out that you honour promptly, never put sensitive personal data in a marketing list, and keep the suppression record permanently.

Size it against your actual capacity

A list should be sized by how many accounts you can work properly, not by how many you can export. The arithmetic is simple and almost always produces a smaller number than people expect: meetings you need, divided by your reply to meeting rate, divided by your contact to reply rate, gives contacts required. Then compare that against hours available.

Most small teams discover they can genuinely work somewhere between forty and a few hundred accounts per quarter with real research behind each one. Building a list ten times that size does not increase output, it just guarantees that most rows are never touched and the data on all of them goes stale at the same rate. The account based approach for small teams is the version of this that fits a team of two or three.

Where the list lives, and why that decides whether it survives

A prospect list in a spreadsheet is fine on day one and a liability by month three, because two people edit it, nobody knows which copy is current, and the disqualified reasons get overwritten. The fix is not a bigger CRM. It is deciding that one place is authoritative and that contact outcomes write back to it, which is mostly a discipline problem and partly a tooling one. Our rules for keeping that from rotting are in CRM hygiene for small sales teams.

On the tooling half, the honest answer for a small team is usually to stay in the cheap tool longer than feels dignified and to move only when a specific thing breaks. The engineering view of exactly where that line sits, written from the build side rather than the sales side, is this piece on internal tools for a small business and when to stop using Excel.

What a finished list looks like before anyone is contacted

Every row has a trigger and a sentence of fit evidence. Every row has a named route in. Every row has a source and a date. The disqualified rows are still in the file with their reason. And the count matches what the team can actually work this quarter.

Then, and only then, the sequence question becomes worth asking, and the structure we use for that is in the six touch outbound sequence. Qualification after the first reply is a separate discipline again, covered in a qualification framework that survives an audit.

One closing admission. A well built list does not make a bad offer work. If the fit evidence column is hard to fill in honestly for most rows, the problem is upstream of the list and no amount of data hygiene reaches it.