The short answer is that you may contact a lead who filled in your form themselves and asked to be contacted. The hard part is everything around it: what you promised them, how long you keep it, and what happens if they change their mind.
The legal basis has to match the channel
A call or an SMS about precisely what the lead asked about rests on the arrangement they started themselves. A newsletter is something else. That needs its own separate consent, and that consent has to be collected while they filled in the form, not afterwards.
This is why putting every lead into the same sequence is a bad idea. Separate the two, and store what they actually agreed to alongside the lead.
Four things that need to be in place
- A privacy policy linked from the form itself, which mentions that you will call.
- A data processing agreement with the suppliers that process data on your behalf.
- A deletion deadline. Leads you never reached should not sit around for five years.
- Unsubscribing that works in one click and takes effect immediately.
What is most often missing
Not the consent, but the trail. When a customer asks where you got their number, you need to be able to answer with which ad, which form and which date. If you cannot, the problem is not legal, it is logging.