Not sure if this is the best place to ask. I've posted in Employment as well.
I work for a small company. Without outing myself, we sell a service. Another rival company also sells the same service. Later on this year we will be taking over the supply of this service from the rival company. I've been tasked with contacting former users of the service supplied by the rival company. We have gained this information to contact them from a middle man. I don't think we can use their contact information to get in touch without breaching GDPR. My boss is adamant that I must contact them but I'm not happy to do so. Who is correct? More importantly, how do I refuse without sounding awkward?
Sorry this is a bit vague, but hopefully it makes sense!