Email marketing

If you buy (or rent) a mailing list, you need to check with the supplier what rights you must use the list for email marketing purposes.

If you are buying or renting a marketing list from a list broker or other third party you must make rigorous checks to satisfy yourself that the third party obtained the personal data fairly and lawfully and that the individuals understood their details would be passed on for marketing purposes, and that they have the necessary consent and compliance with UK General Data Protection Regulation (UK GDPR). You may consider undertaking a GDPR audit of the seller of the mailing list to ensure GDPR compliance before purchasing the list. This could take the form of a compliance questionnaire.

If the list includes individuals (as opposed to companies), they must have given their consent to receiving unsolicited emails. You must also ensure that you only send emails that match the consent individuals have given. For example, they may have consented to receive emails on a particular subject.

As with other email marketing, when you send marketing emails you must give individuals the right to unsubscribe or opt out from receiving further emails.

Databases without consent

If you buy a database where the individuals have not given consent, or if you wish to use it for a different purpose, you need to get their consent.

If you make your first contact with the people on the database by telephone or email, you should make sure that you comply with the privacy rules for electronic marketing. If someone doesn't respond to your initial contact, you can't assume that this implies that they consent to your using their personal information for unsolicited marketing, or any other purpose.

Data protection

Any personal information held on a database should be adequate, relevant, not excessive and should not be kept for longer than is necessary. If you are the new owner of a database, you should decide how much of the information you need to keep, and then delete any that's unnecessary. You should not retain personal information for future use. GDPR requires that you inform the data subjects of your privacy notice information at the latest upon first contact with them.

Online selling rules

When sending sales messages by email, there are rules covering distance selling and online trading apply. See consumer contracts.