Quick answer
In the UK you can rent a mailing list (usually licensed for one use, with the broker or a mailing house handling the data), buy one outright (you own the records and become fully responsible for them), or build your own from customers and enquirers. Whichever you choose, the ICO says you must carry out proportionate due diligence: it is "not enough to simply accept a third party's assurances". Check where the data came from, what people were told, how recent it is and whether it has been screened. You must also send your own privacy information to the people on the list within one month of obtaining their details. Postal marketing is not covered by PECR, so a well-sourced list can be mailed on legitimate interests, but the same list cannot simply be used for email or text marketing.
Key takeaways
- Renting is usually the safer starting point: you pay to mail a list once and can test it before committing to more.
- Ask every supplier where the data came from, when and how it was collected, what people were told, and how recently it was screened. The ICO says you should not use data a seller cannot vouch for.
- Under UK GDPR, you must give the people on a bought-in list your own privacy information within one month of obtaining their details.
- Direct marketing by post is not covered by PECR, but bought-in lists are very hard to use for email or text, which need specific consent naming your organisation.
- Before mailing, suppress your own customers and objectors, run the file against the Mailing Preference Service and clean the addresses. It protects your reputation and your postage budget.
Rent, buy or build: the three options
"Buying a mailing list" usually means one of three things. The right one depends on how often you plan to mail, how much control you need over the data and how much responsibility you want to take on.
| Option | How it works | Best for | Watch out for |
|---|---|---|---|
| Rent | You license the list for an agreed number of uses, often one. The data is usually sent direct to your mailing house, not to you. | Testing a new audience; one-off acquisition campaigns | Licence terms. Responders become your data; non-responders do not. |
| Buy | You pay once and own the records, usually for unlimited use within the licence. | Regular mailings to a stable audience, such as B2B sectors | You take on full responsibility for accuracy, privacy notices and keeping the data up to date. |
| Build | You grow your own list from customers, enquirers, donors and event sign-ups. | Long-term retention and repeat business | Takes time. Collect the right permissions and privacy information at the point of capture. |
Most organisations start by renting a selection to test response, then build their own list from the people who reply. If you want to reach new households without a named list at all, partially addressed mail and door drops are alternatives that avoid buying personal data altogether.
Types of mailing list
| List type | What it is | Typical use |
|---|---|---|
| Compiled (consumer) | Names and addresses gathered from sources such as surveys, registrations and published data, then selected by area or demographics. | Broad consumer acquisition |
| Lifestyle | Consumer records with self-declared interests, such as gardening, travel or pets, usually from questionnaires. | Targeted consumer offers |
| Response (responsive) | People who have bought, enquired or donated by mail from another organisation and agreed to hear from others. | Mail-order, catalogues and fundraising |
| B2B | Named contacts at businesses, selected by sector, size, job function or location. | Business services, trade and professional offers |
People on a response list have already shown they act on mail, which is why these lists are popular for mail-order and fundraising. Whatever the type, the questions in the next section matter more than the label on the list.
Questions to ask a list broker
The ICO's direct marketing guidance says you must carry out proportionate checks before using bought-in data, and that a reputable seller should be able to show the data is reliable. If they cannot, you should not use it. These are the questions we suggest asking:
Complaints are a warning sign
The ICO notes that complaints from people whose details came from a particular source "might suggest that the source is unreliable and you should not use it". Track where complaints come from and drop sources that cause them.
Rented lists, cleaned and mailed securely
Rented data can come to us by secure SFTP. We validate addresses against PAF, deduplicate against your customer file, suppress gone-aways and MPS registrations, and mail it from our Keighley site.
Explore the serviceThe rules for mailing a bought-in list
- 1
Have a lawful basis
You must be able to show your lawful basis for using the data. The ICO's guidance notes that direct marketing by post is not covered by PECR, so legitimate interests is often used for postal marketing, with a clear opt-out. Our GDPR and direct mail guide explains the balancing test.
- 2
Send your own privacy information within a month
When you obtain personal data from someone else, you must give people your own privacy information within a reasonable period and at the latest within one month, or at first contact if that comes sooner. In practice this is often included with, or printed on, the first mailing.
- 3
Screen against your suppression list
The right to object to direct marketing is absolute. Check every new list against the people who have already told you to stop.
- 4
Run it against the MPS
The Mailing Preference Service is the official register for people who do not want unsolicited addressed marketing mail. It is run by the DMA and recognised by the ICO. Licensees clean their files against it before mailing.
- 5
Clean the addresses
Validate addresses against Royal Mail's Postcode Address File and remove duplicates and gone-aways. See our mailing data cleansing guide.
- 6
Keep records
Record your due diligence, the source of each list and the date of screening, so you can show your working if a complaint arrives.
Email and text are different
PECR covers electronic marketing. The ICO says consent given via a third party must be valid and specific, and advises against relying on third-party consent given more than six months ago. In practice, most bought-in lists are suitable for post only.
Getting the most from a rented list
Data quality decides whether a rented list pays. Duplicates, gone-aways and badly formatted postcodes all cost money. As an example, on a 100,000-record list with a 10% duplication and suppression failure rate, that is 10,000 wasted pieces. At a combined print and postage cost of 50–80p per item, that is £5,000–£8,000 in avoidable waste on a single campaign.
- Test small first. Rent a sample of the best-fitting selections and compare response before rolling out.
- Code each list. Print a unique code or URL per source so you can see which lists actually pay.
- Mail a strong offer. Cold audiences need a clear reason to respond. See our direct mail ideas and examples.
- Capture responders properly. Responders become your customers or supporters, so collect their details with the right privacy information.
- Keep the postage down. Sorted, Mailmark-barcoded mail costs less than standard tariff. See how much direct mail costs.
Sources
- ICO – Direct marketing guidance: Collect information and generate leads (bought-in data and due diligence)
- ICO – Direct marketing guidance: Plan direct marketing (post and PECR; consent via third parties)
- ICO – Organisations using marketing services of data brokers: what you need to know
- Mailing Preference Service (MPS) – DMA
