What does prospecting software data protection mean for England buyers?

What to take away

Census 2021 data on cultural identity, published by the ONS, covers ethnic group, national identity, language and religion; those categories become personal data once attached to a named contact.
The ICO separates controllers from processors by who decides the purpose, so a broker choosing what to sell is normally a controller.
Outbound marketing email sits under the UK GDPR and the Privacy and Electronic Communications Regulations (PECR), so a lawful basis and a suppression process are the minimum.
Supplier risk stays with you, so map what a vendor can access and how that access is removed.

Controller or processor roles in lead data

The distinction decides who answers a subject access request and who is liable when a campaign goes wrong. A platform that only processes records you already hold acts on your written instructions as a processor.

Controller and processor roles

Supplier compiles list: supplier is controller
You load data: you are controller
You mail records: you are controller
Platform processes your records: processor
Platform acts on written instructions

Buy a compiled list, though, and the roles shift. The supplier decided which contacts to gather and why, so it is a controller for that stage. You are a separate controller once you load the data and mail it.

Controllers and processors guidance from the ICO explains how to allocate those roles in writing, which is where disputes are usually settled.

The ICO's Guide to the UK GDPR, its legitimate interests guidance and its direct marketing guidance set out how those duties apply at each stage.

Due diligence that holds up

This guide is written for England-based buying teams. Data protection is not devolved, so the same UK GDPR and PECR duties apply in Scotland, Wales and Northern Ireland.

Supplier due diligence checklist

List every field ingested, enriched or exported
State whether buying net-new or enrichment
Record lawful basis campaign by campaign
Request field source and collection date
Request notice shown and consent record
Push for audit rights and deletion on exit

Before signing, list every field the tool will ingest, enrich or export. Net-new contacts and enrichment carry different risks, so the contract should say which you are buying.

Record the lawful basis campaign by campaign. Legitimate interests can support business-to-business outreach, but it needs a balancing test that names the prospect category and the objection route.

Documentation to request from a list supplier

Ask for the source of each field, the date it was collected, the notice shown to the individual and any consent record. Treat retention as unproven if the supplier cannot produce collection dates.

Clauses that shift risk back to you

Indemnities limited to direct losses, or terms that let a supplier reuse your suppression list, leave you carrying the regulatory cost. Push for audit rights and deletion on exit.

The ICO's lawful basis interactive tool covers the common cases; unusual data or vulnerable audiences still need a qualified adviser.

Comparing supplier types

Roles and risks turn on what the supplier does with data.

Likely UK GDPR role

Broker selling compiled contacts: Controller
Enrichment of records you hold: Processor
Outbound sequencing platform: Processor, sometimes joint controller
Intent data provider: Controller

Main risk

Broker selling compiled contacts: No evidenced basis for sale
Enrichment of records you hold: Drifts beyond your instructions
Outbound sequencing platform: Sending with no basis check
Intent data provider: Profiling without transparency

Ask for

Broker selling compiled contacts: Field sources and collection dates
Enrichment of records you hold: Written instructions and deletion terms
Outbound sequencing platform: Suppression logs and opt-outs
Intent data provider: Privacy notice and request process

A vendor can hold two roles at once, so split the contract by activity.

For the England contract and record-keeping angle, see our guide to prospecting software rules in England.

Managing supplier access

Access is the part buyers underestimate. A prospecting platform wired into your CRM and mailbox holds credentials reaching beyond any contact list.

Supply chain security guidance from the National Cyber Security Centre explains how to map supplier dependencies and agree security expectations before onboarding.

Scope each integration to the fields it needs, log exports, and revoke access when a contract ends. Practical controls beat contractual promises.

Special category data and audience segments

The ONS publishes cultural identity statistics covering ethnic group, national identity, language and religion. For market sizing those figures are aggregate, and using aggregate data is not the problem.

Attach ethnic origin or religion to a named contact and it becomes special category data, which needs an Article 9 condition on top of a lawful basis and usually an appropriate policy document. Keep those categories out of prospect scoring and out of any profiling for advertising.

Common questions

Does prospecting software break data protection law?

No. The software is rarely the issue; using it without a lawful basis, retention rule or opt-out process is.

Do we need consent for every B2B email?

Not always. Legitimate interests can support some business-to-business outreach, but each message still needs an opt-out route.

Who is liable if a list supplier breaks the rules?

You can be. As a separate controller you must show you checked the source, so keep the due diligence with the contract.

How long can we keep prospect data?

Only as long as the purpose needs: UK data protection law sets no fixed retention period. Set a retention period, document it, and delete or anonymise when the campaign ends.