Compliance · 6 min read · Updated August 2026
Are bought leads GDPR compliant?
The short answer
Bought leads can be fully compliant with UK GDPR and PECR if the person gave clear, specific consent to be contacted by a business like yours, and that consent is passed to you with the lead. They are not compliant if they were scraped, sold as a cold list, or only ever consented to the original website. Always check the consent trail before you buy.
The rules in plain English
Two things govern this in the UK: UK GDPR, which covers how personal data is handled, and PECR, which covers electronic marketing like calls, texts and emails. Together they mean you generally need the person’s consent, or another lawful basis, to contact them.
This is general guidance, not legal advice. If you work in a regulated area, take your own advice.
What real consent looks like
Consent has to be a positive, informed choice. In practice that means:
- The person actively opted in, for example by ticking an unticked box or submitting an enquiry form.
- They were told who might contact them, including third parties or partners like you.
- The consent was recent and specific to the kind of contact you are making.
First-party versus list-broker leads
First-party leads come from a form the person filled in themselves, with consent captured at that moment. These are the ones worth buying. Cold lists bought from a broker, where nobody asked to hear from you, are the ones that land businesses in trouble.
Questions to ask any provider
Before you buy, ask:
- How was this lead captured, and can you show me the consent wording?
- Did the person agree to be contacted by a business like mine?
- How fresh is the consent, and is the lead first-party?
Ready to put this into practice?
Set your criteria and get matched to verified, ready-to-buy leads. Reserve the ones you want for free, and only pay when one turns into business.
FAQ
Common questions
Can I legally cold-call a bought list?
Usually not for consumers, and you must screen against the TPS and CTPS for phone marketing. This is exactly why first-party, consented leads are safer than cold lists.
How does AceLeads handle consent?
Every lead is first-party and captured with consent under UK GDPR and PECR. Regulated leads, such as claims, are supplied only to appropriately authorised firms.