Data privacy is sooooo complicated!
Further to what Marina said - if the individual can be identified from the data, it's considered personal data - whether a mobile number is "private" or "business" doesn't matter under GDPR - both require lawful basis for processing.
Article 14 GDPR: When personal data has NOT been obtained directly from the data subject (e.g., from data enrichment tools like Clay), the controller MUST inform the data subject of "from which source the personal data originate, and if applicable, whether it came from publicly accessible sources" Information to be provided where personal data have not been obtained from the data subject is here: https://gdpr-info.eu/art-14-gdpr/
You can check https://www.gdpreu.org/ and https://gdpr-info.eu/ for full compliance info, as well as each region/ individual country where your prospects live.
Germany: Bundesdatenschutzgesetz (BDSG) - Federal Data Protection Act.
Netherlands: Uitvoeringswet Algemene verordening gegevensbescherming (UAVG) - Implementation Act for the General Data Protection Regulation
In the US there are multiple privacy acts:
California’s CCPA
Colorado Privacy Act
Connecticut Data Privacy Act (including amendments regulating consumer health data, children’s data, and social media platforms)
Delaware Personal Data Privacy Act
Florida Data Privacy and Security Act
Iowa Consumer Data Protection Act
Montana Consumer Data Privacy Act
Nebraska Data Privacy Act
New Hampshire Consumer Expectation of Privacy Act
New Jersey Personal Data Privacy Act
Oregon Consumer Privacy Act
Texas Data Privacy and Security Act
Utah Consumer Privacy Act
Virginia Consumer Data Protection Act