Who needs your data — and the lawful way to reach them.