DataMembershipFree phone app
Guide

Is It Legal to Buy Data in the UK? A Plain-English Guide

Short answer: yes. Buying and using marketing data is legal in the UK, as long as the data was collected fairly, with the right consent, and you use it in line with UK GDPR and the Privacy and Electronic Communications Regulations (PECR). Here is what that means in practice.

The two sets of rules

UK GDPR covers how personal data is collected, stored and used. You need a lawful basis to use it (for bought marketing data, usually consent or legitimate interests), you must tell people where you got their details, and you must stop when they object.

PECR adds specific rules for electronic marketing: phone calls, texts and emails. These rules depend on the channel you use.

What the rules mean channel by channel

  • Live phone calls — you can call people who haven't objected, but you must screen numbers against the TPS (Telephone Preference Service) first and not call anyone registered unless they told you directly they are happy to hear from you.
  • Texts and emails — need the person's consent. Consent given through a third party has to be specific enough to cover you, so check the consent wording and keep the record.
  • Recorded (automated) calls — need specific consent to receive automated calls from you.
  • Post — can usually be sent under legitimate interests, and you should screen against the Mailing Preference Service.

What to ask your data supplier

Before you buy, ask where the data came from, when each person opted in, what they were told, and which channels they agreed to. A good supplier can show the opt-in date and time, the website (URL) and the consent channels on every record — every DataMembership record carries all three.

After you buy

  • Screen phone numbers against TPS/CTPS again if you are calling more than 28 days after delivery.
  • Say who you are on every call, text or email, and show your number.
  • Tell people where you got their details and how to opt out, and honour opt-outs straight away.
  • Keep a suppression list of everyone who says no.

Questions

Do I need consent to call people from a bought list?

For live calls you don't always need consent, but you must screen against the TPS and you must not call anyone registered unless they told you directly that they are happy to receive your calls.

Can I text or email a bought list?

Only where the people consented to marketing by text or email in a way that is specific enough to cover your organisation. Check the consent wording and keep the records.

This guide is general information, not legal advice. For the full rules see the Information Commissioner's Office (ico.org.uk). Last updated October 2026.