Data is easy to obtain and hard to clean afterwards. Whether it comes from a list broker, a partner, a public website or another part of your own organisation, it arrives with the conditions under which it was collected. The time to check them is before you use it.
Bought and shared data
Before using personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out. from a third party, establish:
- Where it came from, and on what lawful basis it was originally collected.
- What people were told: does the original notice cover your use?
- What they agreed to, if consent is the basis. Consent to marketing by “selected third parties” does not stretch to you unless you were named or clearly described.
- When it was collected and whether it is still accurate.
Record the answers. A supplier’s warranty that the data is “fully compliant” moves contractual risk, not legal responsibility.
Telling people
When you obtain data from somewhere other than the person, you must give them the Article 14 information within a reasonable period, at the latest within one month, or at first contact or first disclosure if earlier. That includes the source. The disproportionate effort exception is narrow and must be recorded and justified.
Electronic marketing
Bought lists are where PECR bites hardest. Marketing emails and texts to individuals need consent that named you or described you specifically, or the soft opt-in, which only works for your own customers and, since 2026-02-05, a charity’s own supporters. Automated calls need prior consent. Live calls must be screened against the Telephone Preference Service. The regulator’s PECR penalties fall disproportionately on firms using bought data.
Scraped and public data
Publicly available does not mean free to use. Scraping personal data needs a lawful basis, usually legitimate interestsLegitimate interestsA lawful basis needing a three-part test: a legitimate purpose, necessity, and a balance against the individual's interests and rights., and the assessment must deal with people’s expectations about how data they published would be reused. The Clearview AI case shows the regulator will act against foreign scrapers of UK data.
Internal reuse
Moving data from one system to another for a new purpose is reuse, even inside one controllerControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties.. Run the compatibility test, update the notice, and update the record of processing.
A short due diligence list
- Original controller, date and method of collection
- Notice wording and consent wording at the time
- Lawful basis now, for your purpose
- PECR position for any marketing channel
- Suppression against your own and the TPS lists