Sooner or later an advertiser asks the question. "Can we have your list?"
It's a fair thing to ask. Your readers are exactly the people they want to reach, and a specialist B2B file is worth a lot more than a bought-in one. But "have your list" can mean three quite different things, and the rules for each are different. Get clear on which one you're selling and the rest falls into place.
This is a practical guide, not legal advice. The ICO's guidance is linked throughout, and it's worth knowing the ICO says its direct marketing guidance is under review following the Data (Use and Access) Act, so check it before a big campaign.
Three ways to say yes
Counts and profiles. The advertiser gets numbers, not names. How many purchasing managers in food manufacturing, split by company size and region. No personal data leaves the building.
Sponsored mailings. You send the advertiser's message to your own readers, by email or post. The advertiser never sees the file.
List rental. Names and addresses go to someone else, usually a mailing house acting for the advertiser, for an agreed use.
Most of the risk sits in the third. Most of the value often sits in the first two.
Counts and profiles first
A good count answers most advertiser questions before anyone needs a list. It also helps you sell the mailing itself, because "4,200 readers in your target sectors, 3,100 with a postal address" is a much easier conversation than a vague promise.
Two things make counts trustworthy. Count people, not records, so a reader on the file twice isn't sold twice. And use the same definitions you use in your media pack, so the advertiser's numbers match what they've already seen. If they don't match, someone will ask why.
Sponsored mailings
This is the one most publishers already do: a sponsored email, a solus mailing, an insert in a postal pack. Because you're sending it, you control the data. But you're still sending marketing, and the advertiser's product isn't yours.
For email, that matters. The soft opt-in, which lets you email existing customers without fresh consent, only covers your own similar products. The ICO's guidance on planning direct marketing is plain about it: "you can't send the marketing of other organisations". So for individuals, including sole traders and some partnerships, you need their consent to hear about third-party offers from you.
Readers at limited companies and similar bodies are different. They're corporate subscribers, so PECR's email consent rule doesn't apply to them, though UK GDPR still does. Our post on consent and legitimate interest for B2B readers goes through that split in detail.
Responsibility is shared, too. The ICO's electronic and telephone marketing guidance says of the sender and the organisation behind the message: "You are both responsible for complying with PECR." So a sponsor's request to "just send it to everyone" isn't a defence for either of you.
List rental
Renting the list means disclosing personal data to another organisation, so there's more to get right.
Tell people first. The ICO's guidance on collecting information and generating leads says to tell people "if you intend to share their information with other organisations", at the time you collect it. If your registration form and privacy notice have never mentioned it, readers wouldn't expect it, and you're not in a good place to start now.
Have a lawful basis for the sharing. Consent or legitimate interests are the usual candidates. The ICO's planning guidance asks "whether people would reasonably expect you to share their information". Write the assessment down.
Email rental to individuals needs specific consent. The ICO's guidance on using marketing lists says "Generic consent covering any third party will not be enough." The consent has to identify who will be sending, so the reader needs to be able to tell which organisations they've agreed to. A tick box for "selected partners" won't carry an email rental.
Post is simpler, but not a free-for-all. PECR doesn't cover post. The same ICO page says that if you're mailing named individuals, you must still comply with UK GDPR. The ICO also suggests checking names against the Mailing Preference Service, which isn't a legal requirement but is expected under some industry codes.
The renter has homework too. The ICO tells organisations using bought-in data not to rely on the supplier's word. Its guidance on using data brokers lists checks such as consent records and TPS or CTPS screening. Expect a careful advertiser to ask you for those, and have the answers ready.
Protect the file
Once a list has left the building, you can't get it back. A few habits keep that risk small.
- Send it to a mailing house, not the advertiser. The fewer people who see raw data, the better.
- Agree the terms in writing. One use, one date, one campaign, deleted afterwards.
- Add seed names. A handful of addresses you control will show you if the list is used again.
- Send only what's needed. Name, job title and address for a postal mailing. Not phone numbers, not qualification answers.
- Apply suppressions at the point of selection. Anyone who has objected to marketing, opted out of third-party use, gone away or been marked "do not rent" stays out every time.
- Keep a record. Which selection, which records, which advertiser, which date. If a reader asks how a company got their address, you want to be able to answer in one go.
That last point matters more than it looks. Under UK GDPR, a subject access request covers who you've disclosed someone's data to (or at least the kinds of recipient), and an objection to direct marketing is absolute. If you can't see who went where, you can't answer either properly.
Where we fit in
In Avio, our subscription platform for larger publishers, selections give live counts by contacts, subscriptions or copies, and workflows can export a saved audience with recently contacted readers suppressed. The run history shows exactly who was in each audience and keeps the output files.
In Adeptis, our all-in-one platform for smaller publishers, selections show a live count as you build, can drop anyone without a postal address, and export to CSV for your mailing house. Consent is recorded separately for your own use and for third-party use, by channel, so the people you can rent to are easy to pick out.
If an advertiser has just asked for your list and you'd like to talk it through, get in touch.
Rob Sherwood is Managing Director of Adept Data Services. He has spent his career in subscriptions and circulation, at WDIS, Optima and CDS Global before founding Adept.