Email Lists and GDPR: What Due Diligence Do You Need?

Update: October 2026

A bought email list is cheap to use and expensive to get wrong. The sender is responsible for the lawfulness of every message, even when someone else collected the addresses.

This guide covers the consent rules for marketing emails, what the ICO found in its 2026 fines on organisations that relied on third-party data, and the due diligence file to build before a campaign. It focuses on the UK rules in PECR and the UK GDPR, with the EU position where it differs.

Key Takeaways

• Under Regulation 22 of PECR, you cannot send marketing emails to individuals without their prior consent, unless the narrow soft opt-in applies. Consent from a long list of unnamed “partners” is not specific or informed, and the ICO treats it as invalid.

• In January 2026, the ICO fined ZMLUK Limited £105,000 for sending over 67 million marketing emails using third-party data, and found it had not carried out sufficient due diligence. The ICO also fined KRA Consultancy £300,000 for sending over 5.5 million marketing texts based on unchecked third-party data, one of its largest nuisance marketing fines.

• The sender must be able to show where the data came from, what people were told, when they agreed and that the consent covers your organisation and the channel you use. A supplier’s warranty alone does not meet that test.

Marketing Emails to Individuals Need Prior Consent Under PECR

Regulation 22 of the Privacy and Electronic Communications Regulations 2003 applies to unsolicited electronic mail sent to individual subscribers for direct marketing. A person may neither send nor instigate such emails unless the recipient has previously notified the sender that they consent to receiving them. Regulation 22 sets out one exception, the soft opt-in, and a separate charity exception added on 5 February 2026 by the Data (Use and Access) Act 2025.

The soft opt-in applies only where the sender obtained the recipient’s contact details during a sale or negotiations for a sale, the marketing relates to the sender’s own similar products or services, and the recipient had a simple way to refuse marketing when the details were collected and in every later message. A bought list fails the first condition, because the buyer made no sale to those people.

The UK GDPR sits alongside PECR. For marketing emails that rely on consent, the UK GDPR standard of consent applies: freely given, specific, informed and unambiguous. Our guide to newsletter compliance covers sign-up forms and unsubscribe links.

In the EU, Article 13 of the ePrivacy Directive 2002/58/EC sets the same basic rule of prior consent for unsolicited email, with national laws implementing it.

Consent Collected by a Third Party Must Still Be Specific to You

The ICO’s January 2026 enforcement round shows how the test works on third-party data. ZMLUK Limited sent 67,772,285 emails between January and July 2023, using data sourced primarily from a third-party website. People who signed up on that site were shown a list of 361 “partner” companies and had no way to choose which of them could contact them. The ICO concluded that this meant individuals could not give informed, specific consent and the consent was invalid.

The ICO also found that ZMLUK relied heavily on third-party data without conducting sufficient due diligence to understand how consent was obtained. ZMLUK sent the emails on behalf of another company, Zuru Jersey Ltd, and the ICO held that ZMLUK was responsible for PECR compliance as the sender. The ICO announcement records a £105,000 fine.

The ICO’s statement on the law is clear: generic or bundled third-party consent, such as “selected partners” or long lists without real choice, doesn’t meet the standard. Pre-ticked boxes and consent buried in privacy policies also don’t count.

Large Campaigns on Bought Data Carry the Largest Fines

The ICO’s £300,000 fine on KRA Consultancy is one of its largest for nuisance marketing. KRA sent over 5.5 million unsolicited marketing texts between 2022 and 2025 and was also given an enforcement notice. According to RPC’s analysis, the ICO found that KRA used third-party data to target people who had been refused loans, made no attempt to check whether the information was accurate or up to date, and made no attempt to ensure the marketing lists could be used lawfully. KRA also hid its identity and did not include an address in its messages.

That case involved text messages, and PECR regulation 22 covers texts and emails together. The lessons apply to email: data quality, consent recency, and a visible sender identity are all inspection points.

The ICO notes the penalty ceiling for breaches of the direct marketing rules at £17.5 million or 4% of global annual turnover, whichever is higher. The ICO can also order a business to stop using a list.

UK GDPR Duties Apply Alongside PECR When You Hold the List

PECR governs the sending. The UK GDPR and the EU GDPR govern what you do with the personal data. When you obtain data from a source other than the person, Article 14 requires you to provide privacy information, including your identity, purposes, legal basis, and the source of the data, generally within a reasonable period and, at the latest, within one month. Article 5(2) makes you responsible for demonstrating compliance, the accountability principle.

If a supplier handles data for you, for example a mailing house or an email service provider, Article 28 requires a written contract with processing instructions, security duties and rules on sub-processors. A list broker that decides its own purposes isn’t your processor, and you need to treat it as a separate data source. Our guide to third-party management systems explains how to run supplier checks across the year.

A Due Diligence File Needs Six Answers Before You Send

The cases show what a regulator expects to find. Before using a bought or rented list, collect written answers to these questions, and keep them with the campaign record.

Where did each record come from, and who collected it? What did the person see when they signed up, including the exact wording and the list of organisations named? When did they agree, and is that recent enough to rely on? Does the wording cover your organisation or a clear category that includes it, and does it cover email? Can the supplier produce a consent record for individual people, with date, source and the notice shown? How will you handle unsubscribes, suppression and complaints, and how will you keep the data accurate?

If the supplier cannot answer any of these, the safer course is to leave the list unused. A warranty in the contract is worth having, and RPC advises renegotiating supplier contracts to obtain one. It does not replace your own checks, because the ICO holds the sender responsible.

Your messages also need a clear sender identity, a valid contact address and a working opt-out. Build the check into a pre-campaign sign-off, with named approvers, so the record exists if the ICO asks.

GDPRLocal helps organisations review marketing data sources, supplier contracts and consent records. See our GDPR consultant services.

Conclusion

Using a bought list safely depends on evidence. The sender needs to know where the data came from, what people agreed to, when and whether that agreement covers the sender and the channel. Third-party assurances that “consent exists” do not meet that standard.

The 2026 ICO fines show how this plays out at scale. A 67-million-email consent campaign from 361 unnamed partners produced a £105,000 fine. A 5.5-million-message campaign on unchecked lists resulted in a £300,000 fine. A short due diligence file, completed before sending, is the cheapest control available.

Frequently Asked Questions

Is It Legal to Email a Bought List in the UK?

Only if each person has given valid consent that covers your organisation and email marketing, or the soft opt-in applies. A bought list rarely meets the soft opt-in, because you made no sale to those people. You must be able to evidence the consent, including wording, date and source.

Who Is Responsible if the List Supplier Collected Consent Badly?

The sender is. In the ZMLUK case, the ICO held that the company sending the emails was responsible for PECR compliance, even though it sent them on behalf of another business and relied on third-party data.

What Due Diligence Should We Do Before Using Third-Party Data?

Ask for the source, the sign-up wording, the date of consent, the organisations named and proof for each record. Check that consent covers your business and the email channel, test data accuracy, and keep the file. If the supplier cannot provide this, do not use the list.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.