ICO lead generation data and consent rules explained

What to take away

What counts as personal data in a local lead generation pipeline

A lead is personal data the moment it can identify a person. In local lead generation that usually means a name plus a phone number, an email address, a home address, or a combination that singles someone out. Even a postcode with a house number can identify a household.

Work backwards through your pipeline. A web form asking for a boiler repair quote collects personal data. A call recording of a customer booking a locksmith is personal data. A purchased list of homeowners with gas boilers is personal data, and the fact you did not collect it yourself does not reduce your duties.

Some data is special category. If a lead reveals health, religion, trade union membership or similar, UK GDPR Article 9 applies and you need a higher condition to process it. A lead for mobility equipment or addiction services can cross that line, so treat those enquiries carefully.

Business leads are not automatically exempt. Sole traders and partnerships are identifiable people, and many small firms use personal email addresses. Assume personal data unless you can show the contact is a corporate body.

Your pipeline also creates derived data: lead scores, call outcomes, and suppression flags. These are personal data too, because they relate to an identifiable person. Deleting the original record but keeping the score does not remove your obligations.

Keep a simple data map. List each source, what it collects, where it is stored, who can see it, and how long you keep it. Most ICO problems start with a gap in that map rather than a deliberate breach. Our guide to data protection mistakes covers the gaps that appear most often.

Choosing a lawful basis for bought and sold leads

UK GDPR requires a lawful basis for every processing activity. For marketing, the two realistic options are consent under Article 6(1)(a) and legitimate interests under Article 6(1)(f). The ICO's guidance on choosing a lawful basis for direct marketing sets out how to decide.

Any consent has to be given freely, be specific, informed and leave no room for doubt. A pre-ticked box is not consent. Consent does not exist when a stipulation is hidden within the fine print. Silence is not consent. If you buy leads, the consent must cover your use, not just the seller's.

Valid example: “I agree that [business name] may email me about [service].” The business and service must be clearly identified, and the person must take a positive, unticked action. Invalid example: “I agree to hear from selected partners” does not identify who will contact the person or what they will contact them about.

Legitimate interests under UK GDPR Article 6(1)(f) can work for some business-to-business marketing and for existing customer relationships, but you must run a three-part test: identify the interest, show the processing is necessary, and balance it against the individual's rights. Document that test before you start.

Consent and legitimate interests are not interchangeable. You cannot switch basis halfway through a campaign because consent is proving hard to get. Pick one, record why, and stick to it.

The ICO's UK GDPR guidance and resources explain that legitimate interests is not a free pass. If someone objects, you must stop unless you can show compelling grounds that override their objection. In marketing, that is a high bar.

For bought leads, consent is usually the only defensible basis. The seller's legitimate interests do not extend to your business, and the individual never chose to hear from you.

PECR rules for email, SMS, live calls and cookies

UK GDPR is accompanied by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), which also regulates electronic marketing. The ICO's direct marketing and privacy and electronic communications guidance covers email, SMS, live calls and cookies in one place.

Regulation 22 of PECR requires prior consent for email and SMS marketing to individual subscribers. The soft opt-in exception applies only where you obtained the details in the course of a sale or negotiations, you are marketing similar products, and you offered an opt-out at collection and in every message. Bought lists rarely meet those conditions.

Under PECR Regulation 21, live calls need consent if the number is registered with the Telephone Preference Service (TPS) or the Corporate Telephone Preference Service (CTPS), or if the person or organisation has previously objected. Screen individual subscribers against the TPS and corporate subscribers against the CTPS before calling, and keep evidence of that screening. Sole traders can still be individuals.

Under PECR Regulation 19, automated calls need specific consent. Do not use recorded messages for marketing without it, and do not assume a bought list carries the right permission.

Under PECR Regulation 6, cookies and similar tracking need consent before they are set, except for strictly necessary ones. That affects lead generation websites that use analytics, remarketing pixels or chat widgets. A cookie banner that only says "by continuing you accept" is not valid consent.

The Data Protection Act 2018 gives the ICO power to issue monetary penalty notices for breaches of data protection legislation, including PECR. Penalties under PECR can reach £500,000 for serious breaches, separate from UK GDPR fines. The ICO can also issue enforcement notices requiring you to change how you operate.

UK GDPR duties when buying marketing data from brokers

When you buy marketing data, you become a controller for your use of it. The broker may also be a controller, but that does not dilute your responsibility. The ICO's guidance on organisations using marketing services of data brokers is direct about this.

The first duty is to verify the lawful basis. Ask the broker what basis they rely on, and ask for the consent wording the individual actually saw. If they cannot produce it, you cannot rely on it.

You must also give privacy information to the people on the list. That means telling them who you are, why you have their data, and where it came from. If that is impractical, you must publish the information prominently and provide it on request.

Check the broker's registration with the ICO. Most controllers must pay the data protection fee, and a broker that has not registered is a warning sign. You can check the register on the ICO website.

Consider whether the data was obtained lawfully in the first place. Scraped data, data from breached sources, and data collected without a clear privacy notice create risk that transfers to you.

Record your checks. If the ICO asks, you need to show what you asked the broker, what they told you, and why you were satisfied. A verbal assurance is not enough. If you are planning spend across the year, our outlook on local lead generation looks at how demand and data costs move by region.

ICO enforcement examples and what they cost firms

ICO enforcement is public. The enforcement action page lists fines, reprimands and enforcement notices across sectors, and it is worth reading before you buy any list.

One well-known case involved a firm that sent millions of unlawful marketing emails and texts. The ICO fined the company and issued an enforcement notice requiring it to stop. The case turned on consent that was not specific or informed.

Another case concerned a data broker selling marketing lists without proper consent. The ICO took action against the broker, and businesses that had bought the data faced questions about their own due diligence. Buying from a broker that is later found to be non-compliant does not insulate you.

Fines are not the only cost. Enforcement notices force operational change, and the ICO can require you to delete data you have already bought. That can wipe out the value of a campaign and damage relationships with clients.

Reputational damage matters in local markets. A plumber or electrician in the West Midlands whose name appears in an ICO enforcement story loses trust quickly, and the local press often picks it up.

Complaints drive enforcement. A single individual who complains about an unsolicited call can trigger an ICO investigation that uncovers wider problems. Keep your complaint handling clean and your records ready.

Due diligence questions for lead vendors and data brokers

Ask the vendor these questions before you sign or pay:

Run the same questions past any lead generation agency that supplies enquiries. If they cannot show the consent trail, you are the one carrying the risk.

For broader checks on suppliers, our guide to vendor due diligence covers access controls and contract terms that sit alongside these data questions.

Consent records, retention and breach reporting

Good records are your defence. For each consent, record who consented, when, what they were told, and how they gave it. If you rely on legitimate interests, record the balancing test and the date you did it.

Keep records for as long as you process the data, and longer if needed to show compliance. There is no fixed retention period in UK GDPR, but you must be able to justify what you keep.

Set retention periods by purpose. A quote enquiry that did not convert might be kept for a short period, while a customer relationship lasts longer. Delete or anonymise data when the purpose ends.

Honour objections immediately. If someone asks you to stop marketing, stop, and add them to a suppression list. Do not delete the suppression record, or you may contact them again by mistake.

Report personal data breaches to the ICO within 72 hours if they risk people's rights and freedoms. A lost laptop with lead data, a misdirected email, or a ransomware attack all count. Keep an internal log of every breach, even ones you do not report.

Train staff who handle leads. Most breaches are caused by human error, and a short briefing on phishing, forwarding and access control prevents many of them. Review your process annually and after any incident. If you are measuring campaign performance, our guide to measurement mistakes shows which errors cost you the most leads.

Common questions