Is it legal to buy B2B email lists in the UK?
The answer for corporate subscribers, the rules that still apply under UK GDPR and a checklist you can use before your first send, from the team behind MyDataHub by Emailmovers.
Yes. It is legal to buy a B2B email list in the UK, and to email the people on it, when they are corporate subscribers and you meet UK GDPR. PECR regulation 22 requires consent only for individual subscribers, meaning sole traders and ordinary partnerships.
A named work email is still personal data, so you need a lawful basis, normally legitimate interests, privacy information within one month, a working opt-out and due diligence on your supplier.
This guide is general information, not legal advice. It has not yet had an independent legal review, and the reviewer will be named here once confirmed. Where we state the law, we link the source so you can read it yourself.
What does PECR say about B2B email?
The Privacy and Electronic Communications Regulations (PECR) control electronic marketing. Regulation 22 requires prior consent for marketing email sent to an individual subscriber, and it does not apply to corporate subscribers. See regulation 22 and the ICO's business-to-business marketing guidance.
So the first question is not "how did you get the list?" but "who is the subscriber?". The answer decides whether PECR asks for consent at all.
Who counts as a corporate subscriber?
A corporate subscriber is a company, a limited liability partnership, a Scottish partnership or a public body. An individual subscriber is a sole trader or an ordinary partnership.
| Organisation type | Class in MyDataHub | PECR class | Marketing email |
|---|---|---|---|
| Private limited company | ltd | Corporate subscriber | Email without consent under PECR |
| Public limited company | plc | Corporate subscriber | Email without consent under PECR |
| Limited liability partnership | llp | Corporate subscriber | Email without consent under PECR |
| Scottish partnership | scottish_partnership | Corporate subscriber | Email without consent under PECR |
| Public body | public_body | Corporate subscriber | Email without consent under PECR |
| Sole trader | sole_trader | Individual subscriber | Consent needed for email |
| Ordinary partnership | ordinary_partnership | Individual subscriber | Consent needed for email |
MyDataHub by Emailmovers stores a subscriber class on every record and a field called email_marketing_basis that reads pecr_corporate_subscriber or consent_required. Individual subscribers are left out of email audiences by default.
What about sole traders and ordinary partnerships?
These are individual subscribers, so a marketing email to them needs consent. The safest handling is to leave them out of email audiences unless you hold consent. MyDataHub does that by default, and every count shows how many individual subscribers it left out.
Post and screened telephone calls to these businesses remain open. The UK GDPR rules still apply: you need a lawful basis, privacy information and a way to object.
Does UK GDPR still apply to a B2B list?
Yes. A work email address that names a person, such as a first name and surname at a company domain, is personal data. So when you email that person you are processing personal data, and you need a lawful basis for it under UK GDPR.
You need a lawful basis of your own for your own emails. The basis MyDataHub uses for holding and supplying the data is legitimate interests under Article 6(1)(f), and direct marketing is an example of a legitimate interest in that Article.
What are legitimate interests?
Legitimate interests is a lawful basis that needs a documented balance: your interest in marketing, set against the person's reasonable expectations and rights. The ICO describes a three-part test covering purpose, necessity and balancing, in its legitimate interests guidance.
The Data (Use and Access) Act 2025 changed the text from 5 February 2026. Direct marketing is now an example of a legitimate interest in Article 6(1)(f), under section 70. It is not a "recognised legitimate interest", which is a separate list, so you still carry out the balancing test. See the ICO's page on recognised legitimate interests.
Is there a template for a legitimate interests assessment?
Yes, a framework you can copy. Fill each part in your own words, keep the result, and review it when your campaign changes. This is a template to edit, not legal advice, and you remain responsible for your own assessment.
| Part | Questions to answer |
|---|---|
| 1. Purpose | What are you trying to achieve? Who benefits? Is the interest lawful and clearly stated, such as telling finance directors about a relevant service? |
| 2. Necessity | Do you need to process this data to reach that aim? Could you reach it with less data, a smaller audience or a different channel? |
| 3. Balancing | What would a person at this company reasonably expect? Is the message about their job? Could it cause them harm or distress? Are they likely to object? |
| 4. Safeguards | What reduces the impact: a clear opt-out, suppression of objections, a limit on frequency, accurate data and a short retention period? |
| 5. Decision and review | What did you decide, who signed it and when will you review it? |
Every MyDataHub order includes a draft assessment with your purpose, audience, channel, volume and safeguards pre-filled, for you to edit and sign.
What must you tell the people on the list?
Because the details did not come from the person, Article 14 UK GDPR requires you to give them privacy information. You must do so within one month of obtaining the data, or at your first communication with them if that comes sooner. The ICO explains the timing on its page about when to provide privacy information.
In practice your first email can carry the key points. Say who you are, why you are writing and that you obtained their details from your supplier. Add a link to your privacy notice, how to opt out and how to complain.
How do you honour an objection?
Everyone has an absolute right to object to direct marketing. You must honour it within one month. The ICO covers it in its guidance on the right to object.
Keep a suppression record rather than deleting the person, so that you remember not to contact them again. A good supplier passes the objection to every other buyer, which is how MyDataHub works: an objection reaches every licensee through a signed webhook and a suppression feed.
What about telephone calls?
Live marketing calls must not go to numbers on the TPS or CTPS without consent. A screen is valid for 28 days, so screen again if your list is older. The ICO's telephone marketing guidance has the detail.
How do the rules differ by channel?
| Channel | Corporate subscribers | Individual subscribers |
|---|---|---|
| No consent needed under PECR regulation 22 | Consent needed | |
| Telephone | Live calls must not go to TPS or CTPS numbers without consent; a screen is valid for 28 days | The same rule applies |
| Post | Remains open | Remains open |
Whatever the channel, UK GDPR applies to named individuals, so the lawful basis, the privacy information and the right to object do not change.
What changed in 2026?
| Date | What changed |
|---|---|
| 5 February 2026 | Direct marketing became an example of a legitimate interest in Article 6(1)(f) UK GDPR, and the PECR fine ceiling rose to the greater of £17.5 million or 4 percent of worldwide turnover |
| 19 June 2026 | The statutory procedure for handling data protection complaints began to apply |
The higher fine ceiling comes from the Data (Use and Access) Act 2025 commencing on 5 February 2026. See the Clifford Chance summary.
How do you check a data supplier?
The ICO says that accepting a broker's assurances is not enough. Its guidance for organisations using data brokers sets out what to check. We have summarised it as seven due diligence areas, in our own words, and a supplier worth buying from can answer each with evidence.
| Due diligence area | What good evidence looks like | ICO source |
|---|---|---|
| Who compiled the data? | A named company that can explain how it collects data. | ICO guidance |
| Where was it obtained from? | A source for each field, with the date. | ICO guidance |
| What privacy information was used? | Evidence the people were told, or a documented reason they could not be. | ICO guidance |
| When was it compiled, and how old is it? | A compile date and a last verified date per record. | ICO guidance |
| How was it collected? | The method, such as telephone research or web research. | ICO guidance |
| What consent records exist? | Either records of consent, or a clear statement that the basis is legitimate interests. | ICO guidance |
| Was it screened against opt-out and suppression lists? | TPS and CTPS dates, and a suppression process that reaches every buyer. | ICO guidance |
Read the ICO guidance itself, and keep the answers on file.
What happens to buyers who skip due diligence?
In January 2026 the ICO fined ZMLUK £105,000 for emails sent on bought-in data without due diligence. The ICO announced the fine in a news item on nuisance marketing.
The lesson is practical: keep evidence that you checked where the data came from before you send.
Which records should you keep?
If the ICO or a customer asks how you came to email someone, you want the answer on file. Keep these five records for each list you use.
- The legitimate interests assessment, with the date you signed it and when you will review it.
- The supplier's due diligence file: provenance, dates, subscriber class, phone screening status and the licence.
- The compliance receipt for the order, if the supplier issues one.
- Your record of processing, which describes the data, the source, the recipients, the retention period and any transfers.
- Your suppression list, with the date each objection was received and acted on.
What if someone complains?
A statutory procedure for handling data protection complaints has applied since 19 June 2026, so you need a route for people to complain and a way to respond. Acknowledge the complaint, look into it, tell the person the outcome and keep a log.
An objection reported through MyDataHub reaches every licensee holding the record.
What is your checklist before the first send?
- You are emailing corporate subscribers, or you hold consent for individual subscribers.
- You have written a legitimate interests assessment and kept it.
- Your privacy notice is live, and your first email links to it.
- Your first email says who you are, why you are writing and where you obtained the person's details.
- Every email carries a simple opt-out, and you can act on one within one month.
- You have a suppression list, and you apply it before every send.
- For calls, you have screened numbers against TPS and CTPS within the last 28 days.
- Your record of processing describes the data, the source and how long you keep it.
- You have the supplier's evidence on file: provenance, dates, receipt and licence.
- You know how a person can complain, and you can answer within the time the law allows.
How does MyDataHub help?
MyDataHub records the evidence the ICO asks about on every record, and it adds a signed compliance receipt and a buyer kit to every order. The kit holds a draft legitimate interests assessment, the first-email wording, a stub for your Article 30 record and a due diligence file.
It does not make the decision for you. You remain responsible for your own use of the data, and this guide does not replace advice from a lawyer who knows your campaign. The trust page shows what we hold and what is planned.
Frequently asked questions
Is it legal to buy B2B email lists in the UK?
Yes, when the people on the list are corporate subscribers and you meet UK GDPR. You need a lawful basis, normally legitimate interests, privacy information within one month, a working opt-out and due diligence on the supplier.
Is a bought B2B list accurate enough to use?
Accuracy is a quality question more than a legal test of whether you can buy. Ask the supplier for a verification date per record and a written replacement policy, and suppress anyone who objects.
Which industries and roles can I email without consent?
Any industry, if the person works at a corporate subscriber such as a limited company, LLP, Scottish partnership or public body. Industry and role do not change the PECR rule. Sole traders and ordinary partnerships need consent, whatever the industry.
How many UK businesses are corporate subscribers?
The ICO does not publish a single count, and this guide does not estimate one. In MyDataHub every record states its subscriber class, and every count shows how many records are individual subscribers and left out of email by default.
Do I need the contact's consent to send a B2B email?
Not for a corporate subscriber under PECR regulation 22. You still need a lawful basis under UK GDPR, such as legitimate interests, and you must tell people where you got their details and honour objections.