- When you buy data and decide how to use it for your own marketing, you are the controller and the compliance work is yours.
- Write a legitimate interests assessment before you first use the data, covering purpose, necessity and balancing.
- Named contacts must get privacy information within one month of you getting their details, or in your first message if sooner.
- Sort records into corporate and individual subscribers before any email or text; if in doubt, treat the record as an individual.
- Re-screen phone numbers against the TPS and CTPS if 28 days have passed since the last screening.
- Keep one suppression list for every channel, and answer subject access requests within one month.
01
Who is responsible for a bought marketing database?
You are. If you choose the data, decide why it is used and decide how (who to contact, by which channel, with what message), you are the controller for that marketing, and the UK GDPR puts the duty to comply on you.
The ICO explains that a controller is the person or organisation that decides the purposes and means of processing, and that a controller must be able to show it complies with the data protection principles (ICO: controllers and processors). A supplier who sells you a licence to use a file does not take that job off you. Your supplier has its own duties for collecting and selling the data; you have yours for everything you do with it once it arrives.
That is good news in one way: almost every part of database compliance is in your control, and a UK GDPR marketing database routine is mostly about habits you set yourself. It also means a complaint about a cold email goes to you, not to whoever sold you the list.
What that means in practice
- Name an owner. One person in the business looks after the database, the suppression list and any requests from the public.
- Decide the purpose. Write one or two sentences on what the data is for (for example, offering your services to care home managers in the North West). Use it only for that.
- Know your channels. Email, calls, texts and post each have different rules, so plan which ones you will use before you load the data anywhere.
- Check the licence. Ours is a 12-month multi-use licence for your own business's marketing. Using data outside its licence, such as passing it to a partner, is a separate decision that needs its own lawful basis.
02
How do you write a legitimate interests assessment?
A legitimate interests assessment (LIA) is a short written record of the three-part test: what your purpose is, why using the data is necessary for it, and why it doesn't override the interests of the people in it. Do it before you first use the data and keep it on file.
For B2B marketing, GDPR compliance usually rests on legitimate interests where PECR doesn't require consent. UK GDPR Article 6 now names direct marketing as an example of a possible legitimate interest (UK GDPR Article 6), but the ICO is clear that this only answers the first question. You still have to pass the necessity and balancing tests, and it says you should record the outcome (ICO: legitimate interests in practice).
What to write down for each part
- Purpose. Why you want to use the data, what benefit you expect, and whether the people contacted also gain (for example, hearing about a service relevant to their job). Be specific: a sector, an area, an offer.
- Necessity. Why this data, and this much of it, is needed. Could you reach the same people with less, such as the job title only or a smaller area? If a less intrusive way would work just as well, say why you aren't using it.
- Balancing. Whose data it is (people at work, in their professional role), whether they would reasonably expect a business approach like yours, the likely impact on them, and the safeguards you use: a clear opt-out, a suppression list, TPS and CTPS screening, and a limit on how often you get in touch.
- Outcome. Your conclusion, including any factors that pointed the other way. The ICO says to record them too, so the file shows you weighed everything.
An LIA for a typical B2B campaign can be a page or two. Review it when something changes: a new channel, a new type of contact, a new purpose, or a bought file from a different source.
PECR comes first for email and texts: legitimate interests can't replace the consent PECR requires for sole traders and ordinary partnerships.
03
What must you tell people, and by when?
Because you didn't collect the data from the people themselves, UK GDPR Article 14 applies. Give named contacts your privacy information within a reasonable period and at the latest within one month, or at the latest in your first message to them if that comes sooner.
Article 14 sets out the list (UK GDPR Article 14). In plain English, your privacy information must cover:
- who you are and how to contact you (and your data protection officer, if you have one);
- what you are using the data for and your lawful basis, and, if that basis is legitimate interests, what those interests are;
- the types of personal data you hold (for example name, job title, work email and phone number);
- who you share it with, if anyone, and any transfer outside the UK and the safeguards used;
- how long you will keep it, or how you decide that;
- their rights to access, correct, erase or restrict the data, to object, and to data portability;
- their right to complain to you, and their right to complain to the regulator (the ICO);
- where the data came from, and whether it came from publicly accessible sources;
- any automated decision-making, including profiling, with meaningful information about how it works and its effect.
If you rely on consent, you must also explain that people can withdraw it at any time.
How to deliver it without fuss
Most B2B marketers put a full privacy notice on their website and add a short paragraph to the first email or letter: who you are, that you got their work details from a business data supplier, why you are getting in touch, how to opt out, and a link to the full notice. Article 14 also has exemptions, for example where telling people would be impossible or take disproportionate effort, but if you are about to write to someone anyway, a sentence in that message is hardly disproportionate. If you plan a use you didn't mention, tell people before you start it.
04
How do you tell companies from sole traders before emailing?
Before any email or text campaign, mark every record as a corporate subscriber (company, LLP, Scottish partnership or other body with its own legal identity) or an individual subscriber (sole trader, ordinary partnership, other unincorporated body). Email the first group only, unless you have consent from the second.
This is the heart of PECR for B2B email. The ICO's B2B guidance draws this line and adds one rule that saves arguments: if you can't tell which type a business is, treat it as an individual subscriber (ICO: business-to-business marketing). Bought data never counts as consent given to you, so a sole trader on a bought file is a postal or telephone prospect, not an email one.
A quick sorting routine
- Look for a legal form. Names ending Ltd, Limited, PLC, LLP or CIC, or a registered company number in the data, point to a corporate subscriber.
- Check Companies House. Search the Companies House register for anything you aren't sure about. A trading name that matches no company is a warning sign.
- Watch for trading names. A name such as "J Smith Plumbing" or "Smith & Co" is often a sole trader or ordinary partnership. Without proof otherwise, move it to the individual group.
- Mark the record. Add a column to your CRM or spreadsheet (corporate, individual or unknown) and make your email tool send only to corporate.
- Re-check on reply. If someone tells you they are a sole trader, update the record and stop emailing them.
A generic address such as info@ isn't personal data under UK GDPR when no person is named, but PECR still protects it if the business behind it is an individual subscriber. The type of business, not the type of address, decides the PECR question.
Post isn't covered by PECR, so letters reach sole traders and partnerships too, provided you meet UK GDPR for named contacts.
05
How should you screen phone numbers against the TPS and CTPS?
Screen every number against both the TPS and the CTPS, plus your own do-not-call list, before each calling campaign. A newly registered number is only protected once it has been on the register for 28 days, so a screen more than 28 days old is out of date.
PECR regulation 21 says you aren't in breach if the number had been on the register for less than 28 days when you called (PECR regulation 21). That gives you a working cycle: screen, call within 28 days, screen again. Our data is screened before supply, but your calling may go on for months after delivery. The registers are run by the TPS and CTPS.
A 28-day screening routine
- Note the screen date. Store the date the file was screened in its own column, by batch.
- Plan call blocks. Split a large file into batches you can call within 28 days of screening.
- Re-screen the rest. Before you start a batch whose screen date is more than 28 days old, screen it again.
- Remove your own refusals. Take out anyone who has told you not to call, whatever the registers say.
- Keep the evidence. File the screening result with the date, so you can show what you checked before each block.
On the call, say who is calling, show your number, and give your contact details if asked. Under the Data (Use and Access) Act 2025 changes, calls count even if they don't connect (GOV.UK: PECR factsheet), so unanswered dials to a registered number are not a safe gap. Automated recorded calls need specific consent whatever the list.
06
How do you run a suppression list across every channel?
Keep one master suppression list of everyone who has opted out or objected, check every campaign against it on every channel, and never delete from it. The right to object to direct marketing is absolute, so one "stop" covers email, phone and post.
A suppression list only works if it travels with the data. The classic failure is an opt-out recorded in the email tool that the sales team's call list never sees, or a new bought file loaded straight over the old one. Under UK GDPR there is no balancing to do when someone objects to direct marketing: you stop.
How to run it
- One list, every channel. Hold it centrally (a CRM field or one shared sheet) and match on email address, phone number, and business name plus postcode.
- Capture objections anywhere. Unsubscribe links, replies, calls, returned letters marked "no marketing", social media messages: log them all the same day.
- Keep the minimum. Store only what you need to recognise the person again (such as the email or phone number) and the date. Deleting them entirely would let them back in on the next bought file.
- Suppress before import. Run every new file against the list before it reaches your email tool or your callers.
- Corporate opt-outs too. PECR doesn't require consent to email companies, but the ICO says you should honour a company's request to stop. Keep a do-not-email list for them.
07
What records should you keep, and how do you handle requests?
Keep a record for each file of where it came from, when you got it, when it was screened and what lawful basis you use, plus every opt-out with its date. That record is what lets you answer a complaint or a subject access request quickly and correctly.
The records worth keeping
| Record | Why you need it |
|---|---|
| Source and date received | Article 14 requires you to tell people where their data came from; you can't if you don't know. |
| Licence terms and end date | Shows the use was permitted and when to stop or renew. |
| LIA and privacy notice version | Shows your lawful basis and what people were told at the time. |
| Subscriber type per record | Shows why each email went to a corporate subscriber. |
| TPS and CTPS screen dates | Shows numbers were checked within 28 days of each call block. |
| Opt-outs and objections, dated | Shows you stopped when asked, on every channel. |
| Campaign log | What went to whom, when and by which channel, so you can answer "why did you contact me?". |
Complaints
Since the Data (Use and Access) Act 2025, organisations must make it easy for people to complain about how their personal data is used, acknowledge a complaint within 30 days and respond without undue delay (ICO: DUAA). A simple contact route in your privacy notice and a log with dates covers it. Article 14 also lists the right to complain to you among the things your privacy information must mention.
Subject access requests
Anyone in your database can ask for a copy of what you hold on them. The ICO says you must respond without undue delay and within one month of receipt, can extend by up to two further months if the request is complex or one of several from the same person, and in most cases can't charge a fee (ICO: a guide to subject access). Requests can arrive verbally or in writing, including through social media, and don't need any special wording, so train whoever answers the phone and the inbox to spot them.
08
What should you check before each campaign?
Run the same short check before every campaign: suppression list, subscriber type for email and text, TPS and CTPS screen date for calls, and privacy wording for anything going to a named person.
| Channel | Check before sending | In every message or call |
|---|---|---|
| Corporate subscribers only (unknowns treated as individuals); suppression and do-not-email lists applied; tracking pixels handled under PECR cookie rules. | Your identity, a working opt-out, privacy information or a link to it. | |
| Text | As for email: corporate subscribers only unless you have consent given to you. | Your identity and a way to opt out. |
| Live calls | TPS and CTPS screen no more than 28 days old; own do-not-call list applied. | Say who is calling, show your number, give contact details if asked. |
| Automated calls | Specific consent to automated calls from you, or don't make them. | Not applicable without consent. |
| Post | Suppression list applied; a lawful basis for named contacts. | Privacy information for named contacts and how to opt out. |
| Any channel | LIA on file; data within its licence period; source and date recorded. | Log every reply, objection and request the same day. |
For the wider picture, including what changed with the Data (Use and Access) Act 2025, read the law section of the complete guide.
This page is general information based on official guidance checked on 13 November 2026. It isn't legal advice; for anything unusual, take advice or read the ICO's guidance in full.
09
Database compliance: FAQs
Is it legal to buy a marketing database in the UK?
Yes. Buying business data is legal; using it is regulated. For your own marketing you are the controller, so you need a lawful basis (usually legitimate interests for B2B marketing), privacy information for named contacts within a month, TPS and CTPS screening before calls, and consent before emailing or texting sole traders and ordinary partnerships.
Do I need consent to email businesses?
Not for companies, LLPs and other corporate bodies: PECR lets you email them without consent if you say who you are and give a working opt-out. You do need consent given to you for sole traders and ordinary partnerships, and a bought list doesn't provide it.
What is a legitimate interests assessment?
A written record of the three-part test: your purpose, why using the data is necessary for it, and why your interest isn't overridden by the interests of the people involved. The ICO says to do it before you start and to record factors on both sides.
How often should I screen against the TPS?
Before every calling campaign, and again whenever the last screen is more than 28 days old. Screen against both the TPS and the CTPS, and remove anyone who has asked you not to call.
Who is the data controller when I buy a database?
You are, for your own marketing, because you decide why and how the data is used. The supplier is responsible for how it collected and sold the data; you are responsible for everything you do with it.
Does UK GDPR apply to B2B marketing? Is there such a thing as a GDPR marketing database?
No database is compliant on its own; compliance depends on how you use it. B2B marketing GDPR rules apply whenever a record identifies a person, such as a named contact or an email like jane.smith@. They don't apply to a generic address with no named person, but PECR may still apply to that address.
What should my first email to a bought contact say?
Who you are, why you are writing, that you got their work details from a business data supplier, how to opt out, and a link to your full privacy notice. That meets the Article 14 timing for named contacts.
Do the PECR B2B rules cover marketing calls?
Yes. You mustn't call numbers on the TPS or CTPS unless that business has said it doesn't object to your calls, or anyone who has told you not to call. Say who is calling and display your number.
How long do I have to answer a subject access request?
Without undue delay and within one month of receiving it, according to the ICO. You can extend by up to two further months if the request is complex or one of several from the same person.
What if a company asks me to stop emailing?
Stop. PECR doesn't require consent to email companies, but the ICO says you should honour their opt-out. Add them to your do-not-email list so the next bought file doesn't bring them back.
Is this legal advice?
No. It's a plain-English summary of official guidance checked on 13 November 2026. For unusual cases, read the ICO's guidance in full or take legal advice.