Consent and lawful basis
Can I buy a marketing list?
- Short answer
- Almost never safely. If you process personal data on consent, you must be able to prove that consent was given, and a purchased list gives you no such evidence. The burden sits on you, not on the seller who assured you the data was opt in.
The problem is evidential as much as legal. You cannot show that each person on a bought list gave free, specific and informed consent for your marketing, because you were not there when they did or did not.
Acquiring data from a third party or a public source therefore requires you to satisfy yourself about the basis behind it and to keep evidence of the chain. In practice most list vendors cannot supply that.
Scraped data carries the same problem. Public availability is not consent, and the fact that a phone number can be found does not mean its owner agreed to be contacted about your product.
Where this comes from
- Section 6(10), DPDP Act 2023
The mistake people make
Relying on a vendor's assurance that a list is opt in, without any per person evidence you could produce later.