Buying data
Data Sourcing and Resale Permission: What to Ask a Data Vendor
Resale permission and a lawful basis to contact people are different things. The questions to ask a contact-data vendor and what good evidence looks like.
When you buy a contact list from a reseller, two separate permissions matter. The first is whether the reseller is allowed to sell it. The second is whether you are allowed to use it for your campaign. Sellers often answer the first and imply it covers the second. It does not. This guide explains what to ask, what good evidence looks like, and where DataPackHub stands today.
Resale permission is not a lawful basis
A licence or written agreement from the original supplier can establish that a file may be redistributed. It does not establish:
- that the records were collected lawfully in the first place;
- that the people in it agreed to be contacted by you, or by anyone;
- that the data may be used for direct marketing in your country, or in theirs;
- that the numbers have been screened against do-not-call registers.
In the UK and EU, a business that receives personal data from a third party usually becomes responsible for it. That includes having a lawful basis, telling people where their details came from (GDPR Article 14), and honouring objections to direct marketing. See the ICO's direct marketing guidance.
Questions to ask any data vendor
About the source
- Who originally collected the records, how, and when?
- What were people told at the point of collection? Can you see the privacy notice or consent wording?
- If consent is claimed: who was named in it, and can it be evidenced per record?
About the resale
- Is there a written agreement allowing resale or redistribution? For which datasets and which countries?
- Does it expire? What happens to files already sold if it ends?
- Are there use restrictions, such as no SMS, no automated calls, or particular sectors?
About ongoing obligations
- Which do-not-call or preference registers were applied, and on what date?
- How are removal requests handled, and are removed people kept out of future files?
- Who do you contact if a person complains about how their data was obtained?
Vague answers to questions 1, 4 and 8 are the strongest warning signs.
What good evidence looks like
| Claim | Weak evidence | Stronger evidence |
|---|---|---|
| "We may resell this" | A chat message or a verbal assurance | A signed agreement naming the datasets, territories and expiry |
| "It's opted in" | The word "opted-in" on a website | Consent wording, the date, and the named recipients, available per record |
| "It's screened" | "TPS clean" | The register used, the screening date, and who screened it |
| "It's lawfully sourced" | "Proprietary sources" | A named collection method and a privacy notice you can read |
Where DataPackHub stands
We record each dataset's sourcing, permitted-use and lawful-basis statements on its dataset page, and we attribute owner and supplier statements rather than presenting them as verified facts. We are collecting written resale terms from our suppliers. Until a dataset's written terms have been reviewed, its page says so. We do not hold consent records for any dataset, and buyers must establish their own lawful basis before contacting anyone.
Read data sourcing, compliance & lawful use and how to evaluate a B2C data provider. To ask about a specific dataset, contact us.
This guide is general information, not legal advice. Take advice from a qualified lawyer for your specific campaign and jurisdiction.
Updated 2026-10-22