Is buying an email list legal in the UK?

What the rules actually say

The Privacy and Electronic Communications Regulations govern marketing messages. They treat individuals, sole traders and most partnerships as protected subscribers, who need to have consented or to be existing customers of yours for similar products. Corporate bodies sit outside that consent rule, but you must still identify yourself and offer an opt out.

UK GDPR sits alongside it. Even where PECR permits the message, you need a lawful basis for holding the data, you must tell people where you got it within a month of first use, and you must honour objections. A seller's assurance that the list is compliant does not transfer that responsibility to them.

The practical risk

• Fines under PECR can reach £500,000, and the Information Commissioner publishes enforcement notices by name.
• Complaint rates from bought lists damage your sending domain, which then affects the mail your customers expect.
• Recipients increasingly ask where you got their address, and there is rarely a good answer.

A cleaner way to make first contact

Pryorify removes the data question entirely. You never receive anyone's email address, and nobody's details are stored for you to reuse. You send one enquiry to a person who has chosen to be reachable and set a price for it, and you pay only when they answer properly.

Please note

This is a plain summary, not legal advice. The Information Commissioner's Office publishes guidance on direct marketing, and a solicitor should review anything you intend to do at scale.