Buying leads and the GDPR: the checklist

Buying leads and the GDPR meet at a point most buyers discover only at their first inspection: paying for a contact creates no right over it. Seven points can be checked before you sign, and all of them belong in the contract.

The essentials

• Paying for a contact creates no special right over it: the GDPR applies as if you had collected it yourself.
• The supplier answers for the collection, you answer for the use. An invoice is not evidence of lawfulness.
• Proof of consent decides whether the call is lawful at all, and several markets have made it a condition rather than a good practice.
• If the form's notice named one company and another company makes the call, the consent obtained does not cover that call.
• Retention periods are yours to set, to write down and to respect.

What buying leads and the GDPR involve together

A name, a phone number, an address and a stated project are personal data. Buying them does not change their status, and the fact that money changed hands gives you no additional rights over them.

Two misconceptions travel widely. The first holds that responsibility stays with the supplier because the supplier obtained the consent. The second holds that an invoice proves the data was lawfully collected. Neither survives contact with a regulator: whoever uses contacts for their own purposes becomes a controller for that use, and an invoice proves a purchase, nothing more.

One thing has changed for anyone buying leads. As consent requirements tightened, proof of consent stopped being good practice and became the condition of a lawful call. A contact without that proof is no longer usable, whatever it cost.

Controller or processor: who answers for what

The whole allocation of risk turns on this question, and the contract has to settle it explicitly.

In the most common arrangement the supplier collects on its own account, then transfers the contacts. It is a controller for the collection, you become a controller for the use. Each side answers for its own part, and you cannot shelter behind theirs.

In a white label arrangement, where the forms carry your brand, the reading reverses: the supplier acts on your instructions, therefore as a processor. A processing agreement then becomes mandatory, with the clauses that go with it.

The practical consequence is blunt. If the information notice on the form designates one company and the contacts are worked by another, the consent obtained does not cover the call. It is the most frequent defect in this market, and it only shows up when you read the original form.

Proof of consent, the decisive piece

A serious supplier attaches it to every record delivered. It needs four elements, and missing one makes it unusable.

• The exact date and time of collection, timestamped.
• The wording accepted, word for word as it was displayed, not a summary.
• The source, meaning the address of the page where the form appeared.
• The channels covered, because agreeing to a call is not agreeing to receive messages.

That last point deserves insistence. Consent has to be specific: it covers a stated purpose and named channels. A box ticked to "receive information" does not cover a sales call, and a catch-all notice cannot be repaired afterwards.

Ask to see real proof on a real contact before signing. A refusal on this point tells you more than any sales deck.

Information notices: what the form has to say

At the moment of collection, the person must know who is processing their data, for what purpose, for how long, and how to exercise their rights. This duty to inform stands on its own, separately from consent.

The part that concerns you directly is the identity of recipients. If you are a recipient, you must be identifiable, either by name or by a category precise enough for the person to understand where their file is going. "Our partners" does not qualify.

Where several companies receive the same enquiry, what the market calls semi-exclusivity, the notice has to say so. A prospect who discovers they were passed to four installers when the form suggested nothing of the kind has grounds for a complaint, and you will hear about it first, since you are the one calling.

Retention: how long to keep a prospect

No text sets a universal duration. The principle is storage limitation: keep the data as long as the purpose requires, then delete or anonymise. You set the period, you write it down, you apply it.

The third row is the one most often mishandled. Deleting outright someone who objected to prospecting condemns you to call them again as soon as they reappear in a batch of leads. What you keep is the minimum that lets you exclude them, and nothing else.

Data subject rights, and who handles them

Access, rectification, erasure, objection: these rights are exercised against you as soon as you work the contacts. A request rarely arrives in writing, it arrives on the phone, during a call, and it is your sales rep who receives it.

Three things stop that going wrong. Publish a dedicated contact address in your notices. Train the people who call to recognise an objection and log it immediately in the CRM. And answer within one month, a period that starts from the spoken request.

The supplier owes you assistance on whatever relates to its own collection, in particular producing proof of origin. That duty goes in the contract, or it does not exist.

What the contract has to cover

Seven clauses cover the essentials, and their absence tells you something about the supplier.

• The allocation of roles, controller or processor, and for which part of the processing.
• A description of the collection: channels, type of forms, standard consent wording.
• Delivery of the proof with every contact, and in what format.
• The channels authorised by the consent obtained, listed explicitly.
• The retention period at the supplier, and what happens to the data when the relationship ends.
• Assistance in the event of a data subject request or a regulatory inspection.
• Where the processing takes place, in particular if a provider outside the European Union is involved.

A word on the last one. Many call centres and qualification services operate from outside the European Union. That is not prohibited, but it requires transfers to be framed properly. A supplier who cannot answer "where is the data processed" has not mapped its own operation.

Checks to run before signing

Five questions, asked in this order, rule out most risky offers. They work as well for solar panel leads as for health insurance leads, where the data is more sensitive still.

What exactly does the consent wording say? Which channels does it cover? Am I identifiable as a recipient in the notice? Does proof travel with every record? What happens to my database if I stop?

A spoken answer is worth nothing on these five points. Ask for the wording, ask for a sample of the proof, and put the answers in the contract.

What you are exposed to, and what triggers an inspection

Data protection authorities issue formal notices and financial penalties, and consumer protection bodies intervene on canvassing. In practice an inspection almost never falls out of the sky: it starts with a complaint.

The typical complaint comes from someone called who does not remember asking for anything. This is why the share of prospects with no recollection of their enquiry, which you can measure across your first fifty calls, is both a quality indicator and a risk indicator. Above a few per cent the source is at fault, and the problem has stopped being commercial.

Your record of processing activities and your written retention periods are the first two documents you will be asked for. Drafting them takes half a day and changes how an inspection goes.

One point on the chain of responsibility, since it often surprises. If you hand your inbound leads to an outside call centre, that centre becomes your processor and you answer for what it does. Its scripts, its calling hours, the way it logs an objection: all of it is attributable to you. Worth asking for its procedure before handing over a file.

Frequently asked questions

Can you still buy leads lawfully in 2026?

Yes. Buying leads is not restricted as such; what is regulated is how consent is collected and how the data is used. A contact obtained through a clear form, with consent specific to the channels used and proof retained, can be worked without difficulty.

Is the supplier liable instead of me?

No, and this is the most expensive misunderstanding in the market. The supplier answers for its collection, you answer for your use. If the form's notice did not designate you as a recipient, it is your call that is irregular, not merely their collection.

Is a processing agreement always required?

No, only when the supplier acts on your instructions, typically in a white label setup. In a straightforward transfer, where it collected on its own account, what you need is a supply contract with data protection clauses.

What should be done with a record delivered without proof of consent?

Do not call it, and claim it back under the replacement policy. A record without proof is a non conforming record, provided your contract defines it that way, which is precisely why that definition is written before you start.

Which rules apply if my company is based elsewhere?

Those of the country where the people you call are located. The rules follow the person contacted, not the location of the caller, which is why a company based outside a market is subject to the same requirements as a local buyer.

Going further

The wider framework for buying leads is covered in our sector guides. On verticals where the data is more sensitive or the cycle longer, see heat pump leads and real estate leads. Your national data protection authority publishes guidance on commercial prospecting, which is a useful complement to the contract clauses above.