Prospect databases are sold on volume: fifty thousand decision-makers, verified, ready to contact. What is rarely explained is that owning the data and being allowed to use it are two separate questions, and the second one is where businesses get into trouble.
This is not legal advice, and if you are planning serious outbound it is worth getting some. But these are the distinctions that decide whether an approach is sound.
Where the data comes from
Public registers. Companies House, professional bodies, regulators. Accurate on company facts, thin on individuals.
Scraped from the web. Company sites, directories, professional networks. Whether the scraping complied with the source’s terms is usually not something you can verify.
Inferred. Email addresses generated from a pattern – firstname.lastname at the domain – and then tested for deliverability. The person never provided anything.
Co-registration. Someone downloaded a white paper and the small print said their details could be shared with partners. This is the basis most list vendors rely on when they say contacts have “opted in”.
Only the last of those involves the person doing anything, and even then they usually have no memory of it.
The two sets of rules
UK GDPR governs processing personal data at all. PECR governs electronic marketing specifically – email, phone, text. You have to satisfy both.
For business addresses at limited companies and LLPs, PECR permits marketing email on a legitimate interests basis without prior consent. Sole traders and partnerships are treated as individuals and need consent.
Even where you can rely on legitimate interests, UK GDPR still applies. You need a lawful basis you have actually documented, you must tell people where you got their data, and you must honour objections and unsubscribes immediately. A generic address such as info@ or sales@ is not personal data, which puts it outside much of this.
Phone
You must screen against the Corporate Telephone Preference Service. Calling a registered number is a breach regardless of how good your list is.
LinkedIn and similar
Platform terms apply on top of the law. Automated connection and messaging tools generally breach those terms, and account restrictions are the common outcome.
The part people miss
If you obtain personal data from somewhere other than the person, UK GDPR requires you to tell them – generally within a month of getting it, or at first contact if that is sooner. That means your first email has to say where you got their details and link to a privacy notice explaining what you are doing with them and how to object.
Most bought-list outbound simply does not do this. It is also, in practice, a reasonable test of whether an approach is defensible: if you would rather not tell someone how you got their address, that is worth paying attention to.
What to ask a list vendor
- Where did this data originate, specifically?
- What lawful basis are you relying on, and what are we relying on?
- When was each record last verified?
- Has it been screened against the Corporate TPS?
- What happens if someone objects — do you suppress it at source?
- Will you indemnify us if the provenance turns out to be wrong?
Vague answers to the first two are the signal to walk away. The last question tends to produce the most revealing response.
The approach that usually works better
Build a smaller list yourself. Define the companies you want – sector, size, location, something observable that suggests they have the problem you solve. Use public sources to identify the right role. Research enough to write something specific.
Two hundred researched prospects with a relevant first line will out-perform twenty thousand bought records, and they do not create a compliance problem. They also give you something to learn from, because when a message does not land you know who you sent it to and why.
And before any of it: your existing contacts. Past enquiries, lapsed clients and people who downloaded something are warmer than anything you can buy, and you already have a relationship to reference. Our piece on emailing past clients covers that ground.
Frequently asked questions
Is it illegal to buy a B2B list?
No. Buying is lawful. What matters is whether your use of it satisfies UK GDPR and PECR — the lawful basis, telling people where you got their data, and honouring objections.
Does “opted in” from a vendor protect us?
Only if the consent was valid, specific and genuinely covers you by name. Consent given to an unnamed set of “partners” is widely regarded as too vague to rely on.
What are the actual risks?
Regulatory action from the ICO, which publishes enforcement against firms conducting unlawful marketing. More commonly: domain reputation damage from spam complaints, which quietly stops your legitimate email reaching anyone.
Can we email people whose addresses are published on their website?
Published does not mean consented. A generic company address is not personal data and is lower risk. A named individual’s address still falls under the rules above.
Build a prospect list worth working
Targeted research beats volume, and it keeps you on the right side of the rules. We help established businesses define who to approach and build the process around it — see our lead generation and sales service, or get in touch.
