B2B data providers: a practical UK buyer guide

B2B data providers supply company and professional contact information for sales, marketing, research and account planning. A useful provider does more than return names. It must help a UK buyer define the market, explain where each field came from, show when it was checked, preserve uncertainty and support a lawful, controlled use.

Choosing B2B data providers is rarely a simple search for more records. Your team may already have several lists and a partly populated CRM, yet still struggle to identify suitable accounts, relevant people and details it can trust.

Provider websites lead with database size, verification claims and coverage percentages. These measures can describe different markets, fields and checking methods. Comparing headline totals does not tell you whether a supplier can support your campaign.

This guide covers market definition, sampling, UK privacy rules, CRM structure, costs and contracts. Legal guidance was checked on 9 November 2026. Several ICO pages say their wording is under review following the Data (Use and Access) Act, so confirm the current position for your activity before acting.

Understand what B2B data providers actually supply

A B2B data provider can describe several different businesses. A register based source supplies company facts. List brokers assemble files to a specification. A sales intelligence platform gives users search and export access. An enrichment service adds fields to existing records. A research service investigates a smaller set of accounts against a detailed brief. Each model solves a different problem and creates different responsibilities.

Start by separating company information from personal data. A company number, legal name, status and registered office describe an organisation. A named director, work email address, mobile number or professional profile relates to a person, even when it appears in a business context. The distinction affects sourcing, transparency, accuracy, retention and the contact methods that may be appropriate.

The Companies House API provides live access to public information about limited companies and other entities within its scope. That makes it a useful identity layer. It does not provide a complete market view, operating site map or current sales contact for every organisation. Registered office details may differ from the location where work takes place, and an official industry code may be too broad for a commercial decision.

Commercial providers commonly combine public registers, licensed sources, company websites, contributions, customer corrections and their own research. Some calculate inferred fields such as employee bands, technologies or likely functions. An inference can be useful, but it should not be presented like a filed fact. Ask the supplier to keep source, observation, inference and verification status distinct.

A large contact database is not the same as a defined audience. If a provider exposes 500,000 people in manufacturing, that total says little about a supplier seeking UK factories with a particular production process, buying structure and service radius. The buyer still needs account criteria, exclusions and evidence. Otherwise the search filter becomes a substitute for commercial judgement.

Coverage also has several meanings. A provider may count every company it has identified, every company with one contact, every contact with an email pattern or every contact whose address passed a recent technical check. These are not comparable measures. Ask for denominators and field level definitions rather than one accuracy or coverage percentage.

Verification describes a method, not a permanent property. An email check may show that a server accepted a query at a point in time. It cannot prove that the person remains in the role, expects the message or will reply. Telephone checks may confirm a line but not its current owner. Company records can change after a provider refresh. Treat dates and statuses as evidence for a decision, not as guarantees.

Licence terms can be as important as record quality. Some platforms permit access while the subscription is active but restrict retention after cancellation. Some allow CRM export but prohibit resale, shared access or certain automated uses. A list purchase may grant broader possession but less frequent updating. Ask what the business can keep, update, share internally and use after the contract ends.

The provider may be a controller, processor or another controller for different parts of the service. The label should follow the real activity rather than a standard contract heading. If a supplier chooses sources and purposes for its own database, it is not made a processor simply because a customer pays for access. Your privacy or legal adviser should assess the roles and agreement against the intended use.

GRO's B2B data sourcing service starts with account fit, fields and intended use before record collection. That order is useful even when you buy a platform directly. The first deliverable should explain the market and evidence you need. The database comes after that definition.

Write a one paragraph description of the job before comparing vendors. State whether you need a strategic market map, an outbound prospect file, CRM enrichment, event invitations, account based advertising preparation or supplier research. Name the geography, company type, relevant people, required evidence, refresh need and destination system. That short description will expose products that are impressive but wrong for the work.

Define the market and intended use before you buy data

A provider cannot fix an undefined market. Broad terms such as SMEs, manufacturers or professional services hide the characteristics that determine whether an account can buy, use and benefit from your offer. The sourcing brief needs to translate commercial experience into criteria that someone else can apply consistently.

Begin with recent customers, rejected enquiries and lost opportunities. Look for operating conditions rather than flattering similarities. A customer may fit because it has several sites, a regulated process, a recurring requirement or a particular decision structure. A rejected enquiry may reveal an exclusion such as geography, minimum scale, asset type or procurement route. Record the evidence and sample size so a small history does not become a false universal rule.

Separate mandatory criteria from useful signals. A supplier of on site maintenance may require an operating location inside its coverage area. Employee count might help prioritise research but may not determine fit. If every filter is treated as mandatory, the search can remove promising accounts because a commercial database lacks one optional field.

Define the account unit. A corporate group, legal entity, trading brand and operating site can all be valid units for different offers. Central software sales may be decided at group level. A facilities service may be purchased site by site. If the provider returns one row per company while sales works per location, the imported data will not match the buying process.

Describe the contact role as a business responsibility, not merely a title. Titles vary across sectors and company sizes. A person responsible for fleet compliance may sit in operations, transport, finance or ownership. Ask the provider how it maps role concepts to titles and how uncertain matches are labelled. Do not insist on a seniority word if the actual responsibility sits elsewhere.

State the intended contact methods before sourcing personal data. Email, telephone, LinkedIn, post and custom audiences involve different platform terms, expectations and legal questions. Data suitable for account research may not be suitable for an email sequence. A technically available mobile number should not enter the file if the campaign has no assessed reason to use it.

The ICO guidance on collecting information and generating leads says public availability does not remove the need to consider fairness, lawful basis, transparency and PECR. Put those questions into the brief. Leaving them until upload can result in a paid dataset that the responsible team will not approve for the intended activity.

Create inclusion examples. Pick five organisations that clearly belong and explain why. Add five borderline cases and five exclusions. Use only organisations you can discuss appropriately within the buying team. The examples help suppliers interpret criteria and let you see whether their search behaves as promised.

Build an exclusion hierarchy. Existing customers, active opportunities, named competitors, suppliers, previous objectors and unsuitable sectors may need different treatments. An existing customer might be reserved for its account owner rather than removed. A previous objection needs suppression across future imports. A competitor may remain in a market map but stay outside outreach.

Specify geography precisely. Registered office, headquarters, operating location and service address answer different questions. A company registered in London may run a relevant site in Leeds. A UK subsidiary may be controlled abroad. State whether the criterion concerns legal registration, decision location, delivery location or every place the company operates.

Define freshness according to the field. Company status may be checked against the public register. A website technology observation can change after a redesign. A contact role may change without any formal filing. One global last updated date conceals these differences. Request source and checked dates at field or logical group level where they affect use.

Decide what uncertainty is acceptable. A strategic market estimate can include probable fits with confidence labels. A file prepared for immediate contact may require stronger evidence. Do not force uncertain values into yes or no fields merely because the CRM lacks a third state. Preserve unknown as a valid result.

The final brief should be testable. Two reviewers should be able to assess the same sample and reach broadly consistent decisions. Where they disagree, refine the wording before asking a provider to scale. This step reduces wasted credits, avoids a large clean up and gives procurement a clear basis for comparing offers.

Turn commercial experience into reviewable rules

Teams often describe their best customers through stories. One account was easy to serve, another bought quickly and a third expanded after the first project. These observations are useful starting points, but the sourcing brief needs to separate the observable condition from the result. Fast purchase cannot be known before contact. A particular operating model, public requirement or service area might be observable.

Ask why each example succeeded. The answer may concern problem severity, internal capability, timing, budget, access or a decision maker. Mark which factors a data provider could reasonably evidence before engagement. Put the remaining factors into qualification or discovery rather than asking a database to predict them.

Use positive and negative rules together. A positive rule might include organisations operating several food production sites. A negative rule might exclude hospitality venues that share the same broad industry category. This prevents a provider from meeting the inclusion filter while returning the wrong business model.

Write exceptions. A small company could fit because it owns an unusually complex asset. A large company could be unsuitable because procurement is controlled by a parent outside the service area. Exception handling stops the team treating every band as an absolute truth. It also identifies cases for manual review rather than automatic rejection.

Assign evidence strength. A company website that lists operating sites may support a location conclusion. A directory category may be a weaker signal. An inferred technology field may justify research but not a sales claim. Give reviewers a short hierarchy so they do not accept the first populated source.

Test the rule on recent cases that were not used to create it. If it accepts obvious mismatches or rejects known good accounts, revise it. This is not a statistical model, but holding back examples reduces the temptation to write criteria that merely explain the past customers already in view.

Version the brief. Record the date, owners and reason for each material change. If a pilot rejects many companies because of a new location rule, the team should be able to see whether the provider changed or the brief did. Versioning also lets you compare sourcing cohorts fairly.

Decide how sales feedback changes a rule. One salesperson's objection may reveal a genuine pattern or a personal preference. Require a reason and enough examples before changing the whole market definition. Keep the rejected records available for analysis without continuing an unsuitable contact plan.

Review incentives. A provider paid per delivered row may favour broad criteria. A sales team measured by activity may accept too many records. Procurement may prefer a low unit price that ignores clean up. A shared acceptance test aligns the decision around usable evidence rather than volume.

The result is a market hypothesis the team can challenge. It does not need to claim certainty. It needs to make selection consistent enough for a provider to demonstrate fit and for sales to return meaningful corrections.

Choose the right source model for the job

No single sourcing model is right for every campaign. The decision depends on the unit of analysis, number of records, field difficulty, refresh rate, workflow and level of evidence needed. Buyers often compare products from different categories as though each were a larger or smaller version of the same database.

Public registers are useful for stable company identity. Companies House can supply legal name, number, status, registered office, filing history and other public records within its scope. Its register search guidance says the service is not intended to be comprehensive and warns about possible errors or omissions. Use it as an authoritative source for filed information, then check whether the filed fact answers the commercial question.

Open datasets can support sector or location research. They may use statistical classifications, reporting periods and geographic units that differ from your sales model. Read the metadata before joining a dataset to company records. A count of establishments is not automatically a list of reachable accounts, and an industry total does not provide contact permission.

A list broker is suited to a defined, bounded file when the buyer can specify the selection and delivery format. Ask whether the broker owns the source, licenses it or buys through another party. The chain matters because each handover can change field meaning, freshness and the evidence available for due diligence.

A subscription platform may suit ongoing prospecting across several segments. Users can search, reveal, export and refresh records as needs change. The risks are uncontrolled credit use, private lists outside the CRM and dependence on a proprietary interface. The operating plan needs named users, export rules, audit expectations and a route for corrections.

An enrichment service starts with records you already hold. It can append company identifiers, firmographic fields or contact details. This model is valuable when the CRM has known entities but incomplete attributes. It is a poor substitute for deciding which records belong there. Match rates should be reported separately from field accuracy and commercial usefulness.

A research service is suited to narrow markets, complex account structures or fields that require judgement. Researchers can inspect websites, documents and sources against a written evidence hierarchy. The output may be smaller and costlier per row, but more useful when a generic category cannot express the need. Ask how decisions are reviewed and how sources are retained.

Many teams need a combination. A public register can establish legal identity, a commercial platform can suggest contacts, an email verifier can add a technical status, and human research can resolve high value uncertainties. Combining tools does not make the result correct by default. The workflow still needs a source order, conflict rule and status for unresolved differences.

Choose the model around the decision cadence. An annual market map does not need continuous contact credits. A daily sales queue may need frequent refresh and CRM write back. An event campaign needs a cut off date, suppression check and short operational window. Paying for real time access creates no value if the team reviews accounts quarterly.

Consider vendor dependence. A platform may use identifiers that do not map cleanly to your CRM or public registers. If the subscription ends, the team might lose saved filters, notes and update signals. Ask for an export sample early and identify which business decisions must remain intelligible without the provider interface.

Do not compare price until the models are aligned. A low cost file, an annual seat and a research project allocate cost differently. Bring them to a common unit such as cost per accepted account for the pilot, then add internal review, CRM preparation and maintenance. A cheap record that cannot be used is not a saving.

Document why the selected model fits. This decision record helps when a new tool promises more data later. It also prevents a temporary campaign purchase from becoming an ungoverned permanent database. Review the model when the offer, market, team capacity or intended channels change.

Specify fields, sources and evidence before delivery

A field list is the contract between the commercial brief and the delivered data. Vague requests such as full company details invite suppliers to include what is easy to populate. A useful specification names the question each field answers, its definition, format, source expectation, freshness need and treatment when unknown.

Start with stable identity. For a UK limited company, legal name and company number can anchor matching. Add trading name, website domain and the account unit used by sales. Keep each identifier in its own field and record the system that issued it. Do not treat a domain as a universal company key because groups, brands and subsidiaries may share or change domains.

Define location fields by purpose. Registered office, headquarters, branch, trading site and service location should not share one address column. Include the source and type. If a team needs sites with a particular facility, ask for evidence of the operating location rather than accepting a registered office postcode.

Industry classifications need provenance. A SIC code filed at Companies House, a provider taxonomy and a researcher's description can all be useful, but they are not interchangeable. Retain the original code and system, then map it to your commercial segment in a separate field. This lets the mapping change without rewriting the source.

Size measures also need definitions. Employee count may refer to a legal entity, UK operation, group or an estimate from online profiles. Turnover may come from accounts for a period that ended many months earlier. Store the period, scope and source beside the number. Use bands where exact figures would imply false precision.

For contacts, specify responsibility, title, organisation relationship and source date. A name and email address alone cannot show why the person is relevant. Ask whether the role is observed, inferred or provider categorised. If a person appears linked to two entities, preserve the relationship and dates rather than overwriting one employer.

Email fields should distinguish address, source, verification service, result and check time. Valid, invalid, accept all and unknown can have provider specific meanings. Never collapse every noninvalid status into verified. Keep the raw status where possible and map it to an operational treatment in a separate controlled field.

Telephone data needs type, country format, source and screening status. A switchboard, office direct line and mobile number support different uses and risks. Store CTPS or TPS screening evidence with its date when calling is part of the assessed plan. A provider claiming screened data should explain which register, when and how objections are returned.

Source evidence can be compact. A URL, public register reference, provider source label, retrieved date and short evidence note may be enough. The goal is not to copy whole websites into the CRM. It is to let a reviewer understand why a value was accepted and recheck it when the field matters.

Design status fields for uncertainty. Confirmed, probable, conflicting, not found and not applicable support better decisions than a blank value. Define each status. A blank can otherwise mean the provider did not search, the information does not exist, access failed or the result was deliberately excluded.

Keep facts separate from workflow decisions. Account fit, sales priority and permitted campaign use are decisions made by your organisation. A provider may supply evidence, but should not silently convert that evidence into an approval. Store the rule version or reviewer where a consequential decision is recorded.

Agree a data dictionary before the sample. It should cover names, types, allowed values, examples and prohibited content. Prevent free text from receiving unnecessary personal data or copied profile biographies. A concise evidence note is safer and more useful than an unrestricted research dump.

Finish with a delivery schema that your systems can accept. Confirm character encoding, dates, multi value fields, parent relationships and unique identifiers. The same schema should be used for the pilot and production file. Changing column meaning after acceptance makes reconciliation difficult and can contaminate existing CRM records.

Compare coverage with a controlled sample

A controlled sample turns vendor claims into evidence about your market. It should contain records chosen by the buyer, include known difficult cases and use the same acceptance rules for every provider. A demonstration built from the vendor's strongest segment cannot answer how the product will perform on your accounts.

Create a reference set before asking for results. Include organisations that clearly fit, organisations that clearly do not and cases where the answer requires care. Add varied company sizes, legal structures, regions and group relationships. Keep a known answer for the facts you intend to score, or mark where a reviewer must investigate.

Use enough records to expose patterns without turning the pilot into the whole purchase. A narrow specialist market may need fewer carefully chosen cases. A broad database may need a larger stratified sample. The useful number depends on the decisions and expected variation, so avoid a universal pilot size.

Give each provider the same brief and cut off time. Ask them to return the agreed fields, statuses and sources. Do not let one provider manually research every difficult case while another is evaluated through its standard export unless the manual work is part of the offered service and price.

Score account coverage first. How many reference organisations can the provider identify and match to the correct entity? Report unmatched, ambiguous and duplicate results separately. A high match rate that joins records to the wrong subsidiary is worse than a lower rate with visible uncertainty.

Score required fields field by field. Company number coverage, operating location, website, role contact and verified email need separate denominators. A provider may be strong on company identity and weak on named contacts. One overall completeness percentage hides the combination you are actually buying.

Assess commercial fit independently of population. A record can be accurate and still fail the brief. Ask reviewers to accept, reject or query each account using the written criteria. Record the reason. If many technically complete records are rejected, the search logic or market definition needs work before more data is acquired.

Check contact relevance. A named person may exist at the company but have no relationship to the buying task. Review the evidence behind the role, its recency and its scope. Seniority alone is not relevance. In a multi site organisation, a director may be too remote while a regional manager owns the practical decision.

Measure conflicts, not just correct answers. Two providers may disagree on employee count, parent company, trading status or contact role. Record which source each used and whether the difference can be explained by period or scope. A provider that exposes the conflict may be safer than one that returns a confident but unsupported value.

Time the reviewer effort. Some exports require extensive cleaning, identity resolution and field interpretation. That work belongs in the cost comparison. Record minutes spent resolving a representative batch and the skills required. A platform that saves purchase cost but creates constant manual repair may not suit a small team.

Test the real export path. Use the same permissions and credit rules that ordinary users will have. Export the sample in the proposed format, move it through the staging process and inspect the result. A polished dashboard is not evidence that company and contact relationships survive CSV delivery or CRM mapping.

Protect the sample. Use business records and personal data only for the assessed purpose, limit access and agree deletion or return after the evaluation. Do not send a full customer database to every vendor simply because matching is available. Minimise the fields to what the test needs.

Finish with a scorecard that shows accepted accounts, required field coverage, contact relevance, conflicts, review effort, permitted use and cost. Do not weight every category equally by default. A missing optional field may be tolerable. Unclear sourcing, broken suppression or wrong entity matches may disqualify the provider.

Interpret pilot disagreements before ranking suppliers

A pilot can produce a neat table and still support the wrong conclusion. Reviewers may disagree because the brief is vague, the evidence is incomplete or the commercial question has more than one valid answer. Resolve the reason before converting the score into a supplier ranking.

For every disagreement, ask whether it concerns fact, scope or judgement. A wrong company number is a factual defect. Headcount covering the global group rather than the UK entity is a scope mismatch. A decision about whether a borderline account fits is commercial judgement. Each category needs a different response.

Factual defects should be checked against the agreed source hierarchy and returned to the provider. Measure correction speed and whether the shared record changes. Repeated errors from one source may justify excluding that field or supplier even if the overall average remains high.

Scope mismatches usually point to definitions. Add period, geography and organisational unit to the field dictionary. Recalculate the affected measure only after every provider is evaluated against the same definition. Do not penalise one vendor for answering a different but reasonable interpretation you did not specify.

Judgement differences require reviewer calibration. Discuss the evidence without showing who supplied the record where practical. Update examples and rules, then have both reviewers reassess a small set. If disagreement remains, create a query status rather than forcing a majority decision into the data.

Inspect missing values. A provider that returns unknown may be more honest than one that fills a field with a weak estimate. Score evidence quality and population separately. If your workflow requires a value, decide whether a research step can resolve it or whether the record should stay outside the campaign.

Check for correlated errors. Several fields may come from one mistaken entity match. Counting each field as an independent failure can exaggerate the problem, but the root defect is serious because it affects the whole record. Track both field errors and affected entities.

Use confidence intervals cautiously if the team applies statistical methods. A sample can estimate a rate only for the population and selection design it represents. A convenience sample of known companies cannot prove database wide accuracy. Record the sampling method beside any percentage.

Revisit business impact. An incorrect optional sector tag may cost minutes. A wrong suppression decision can create a rights or relationship problem. Weight defects by the decision they affect, and set zero tolerance only where the business can genuinely operate it.

Finally, look for repair behaviour. A credible supplier should explain the source, acknowledge uncertainty and show how corrections enter its process. Deflection, unexplained replacement rows or a changing definition can be more concerning than a visible initial error. The pilot evaluates the provider's operating discipline as well as its file.

Test accuracy, freshness and verification claims

Accuracy is specific to a fact, time and purpose. A company address can be accurately copied from a register yet be unsuitable as a service location. An email address can accept a technical test but belong to a person who changed jobs. Ask what was checked and against which question rather than asking whether the database is accurate.

Define a truth source for each sampled field. Companies House may anchor legal identity and status. The organisation's own website may support current trading activity and published locations. A direct correction from the person may supersede an older provider record. No source answers every field, so the hierarchy needs to be explicit.

The ICO accuracy guidance says organisations should take reasonable steps to ensure personal data is not incorrect or misleading, keep source and status clear and consider when updates are needed. Build those controls into the product evaluation rather than treating them as a later cleansing job.

Ask how the provider identifies change. Some refresh sources on a schedule. Others update when customers report a correction. Some infer a job change from profiles or email failure. Ask what triggers a review, which fields are refreshed together and what happens to previous values. A latest value without history can hide an incorrect overwrite.

Inspect field age distribution, not one average. A database can claim monthly refresh while many records have not been observed for a year. Request the proportion of the pilot checked within relevant periods, split by field. The suitable period depends on the use. A company status can tolerate a different cadence from a named contact for next week's event.

Test email verification with the provider's exact result definitions. Understand syntax checks, domain checks, mailbox responses, accept all treatment and unknown outcomes. Do not send live marketing merely to test deliverability. Use controlled technical evidence and your normal lawful campaign process if the supplier progresses beyond evaluation.

Review replacements and credits. A guarantee may cover only hard bounces reported within a short window, not wrong roles, catch all domains or departed staff. Ask what evidence is required, whether the replacement comes from the same segment and whether reporting an error also corrects the shared database.

Sample company groups carefully. Confirm that parent, subsidiary, brand and site relationships reflect the unit your team needs. Duplicate counts can look impressive when one group appears under several names. Aggressive merging can remove separate operating sites that make independent decisions.

Check titles and functions. Provider taxonomies may map a broad range of roles into one department. Review the raw title and the normalised category together. If a role was inferred from a biography or previous position, label that inference. A function tag is a search aid, not proof of authority.

Look for systematic missingness. Small firms, charities, public bodies, new companies or particular regions may have lower coverage. An overall result may be acceptable while the exact segment you care about is weak. Break pilot scores down by the characteristics that affect your market.

Create a correction route. Sales users need a simple way to mark wrong company, wrong person, changed role, duplicate, objection and unsupported inference. Decide which corrections update the CRM, which go back to the vendor and which require review. Private notes are not a maintenance system.

Do not turn quality into a permanent promise. Record the pilot date, sample and method. State what the result supports and what it does not. The finding may justify a bounded purchase, a second test or rejection. Repeat a smaller quality sample at agreed intervals after launch because a changing dataset can drift from the original evidence.

Apply UK privacy and direct marketing rules to the real plan

Buying access to data does not transfer responsibility for using it. The buyer must assess the information, purpose, lawful basis, transparency, contact channel, recipient type, rights handling and retention. A contract statement that a list is compliant cannot make every customer campaign lawful.

Start by describing the processing in ordinary language. Name the data collected, sources, people affected, reason, planned analysis, contact methods, recipients, retention and systems. This description gives the privacy adviser something concrete to assess. A vague request to approve B2B data cannot reveal where the risks sit.

The ICO guidance for organisations using data brokers says buyers must carry out appropriate due diligence and cannot simply accept the broker's assurances. It recommends checking who compiled the data, where it came from, what people were told, when and how it was collected, relevant consent evidence and screening records.

Determine whether each field is personal data. Generic company facts may fall outside that category, while a named business email, direct dial or professional profile can identify a person. Pseudonymisation or hashing does not automatically remove the data from UK GDPR if the person remains identifiable within the processing.

Select a lawful basis for each real purpose. Consent and legitimate interests are often considered for direct marketing, but neither is a blanket answer. If relying on legitimate interests, document the purpose, necessity and balancing assessment. The result must fit the specific audience, data and activity.

PECR rules depend on channel and subscriber type. The ICO B2B marketing guidance distinguishes corporate subscribers from individual subscribers such as sole traders and some partnerships. Electronic mail to corporate subscribers is treated differently from email to individual subscribers, while UK GDPR can still apply to a named person at a company.

Do not infer legal status from an email domain. A person using a business address may be a sole trader, a company employee or part of a partnership. If status changes the proposed rule, capture reliable evidence or use the more cautious treatment. Keep the reasoning with the campaign specification.

Telephone activity needs separate screening. The Corporate Telephone Preference Service guidance explains that marketing call lists may need checks against CTPS, TPS and internal do not call records. Record the screening date and preserve objections when new files arrive.

Transparency begins before the first message. Where personal data comes from another source, the ICO right to be informed guidance describes what people should be told and the timing rules, including no later than one month in normal circumstances and at the first communication when that happens sooner. Ask how the provider supports source disclosure and how your notice will be presented.

Handle objections across every tool. The latest valid preference should stop new marketing use even when another provider supplies the same person. Keep enough information on a suppression list to prevent reintroduction. Do not delete the objection marker and then buy the contact again.

Review international transfers and supplier locations. A platform may store data, run support or engage subprocessors outside the UK. Ask where customer uploads, exports, usage logs and support copies go. The data processing terms and transfer safeguards need to reflect the service rather than a generic assumption about the vendor's headquarters.

Minimise collection. A sales campaign rarely needs birthdays, personal addresses, copied biographies or sensitive information. Restrict exports and CRM fields to the evidence the team needs. Prevent researchers from placing speculative personal comments in free text. Access should follow roles and be removed when a user or supplier leaves.

Review retention by purpose. A strategic company map may remain useful longer than a named contact list. Set review and deletion points, then preserve objections as required. If the purpose changes, assess the new use instead of assuming the original purchase authorises it.

This section is operational guidance, not legal advice. The ICO pages checked on 9 November 2026 note that parts of the guidance are under review after legislative changes. Give the responsible adviser the actual data flow, sample fields, provider terms and proposed communication so they can reach a current decision.

Build a channel decision record before activation

One dataset can support several activities, but approval for one does not approve the others. Create a short decision record for each channel. This makes the assumptions inspectable and prevents a user from exporting an audience for a purpose nobody assessed.

For email, record subscriber type, address source, named sender, message purpose, lawful basis, PECR position, transparency route, opt out and suppression process. Separate corporate addresses from sole traders and uncertain cases. Confirm that the sending platform's rules also permit the planned activity.

For live calls, record number type, TPS and CTPS screening, internal objections, caller identity and monitoring. Decide how staff handle a person who says the number is private, wrong or no longer associated with the company. A script should support respectful correction rather than pressure the recipient to continue.

For LinkedIn or other professional networks, treat direct messages as electronic mail for the ICO assessment and check platform terms. A public profile does not create a marketing permission. Avoid tools or methods that require shared credentials, imitate human use at scale or hide the real sender.

For advertising audiences, document the data fields uploaded, hashing, customer list source, platform customer terms, consent or lawful assessment and deletion. Hashing changes the representation used for matching. It does not erase the source obligation or make an unexpected upload fair.

For postal marketing, PECR electronic message rules do not apply, but named personal data can still engage UK GDPR. Record source, lawful basis, notice, objection and suppression. Check that address selection does not expose sensitive inferences or create disproportionate intrusion.

For account research with no communication, identify who can see the data, why each personal field is needed and when it will be reviewed or deleted. Research use can still affect people if it produces scoring, profiling or decisions. Restrict generated inferences and make their status clear.

Add an approval owner and date to each record. State the data provider, campaign scope and rule version. If the audience, offer, country, source or channel changes, review the decision again. Do not copy an approval from one campaign into another because both use the same platform.

Connect operational controls to the record. A CRM list can enforce subscriber type and suppression. Workflows can prevent unreviewed records from entering a sequence. A campaign checklist can require a current screening date. Technical controls should implement the decision, not invent it.

Sample the live process after activation. Check the sender identity, notice link, opt out, suppression update and CRM status. Review complaints and wrong person reports by source. If a pattern appears, pause the affected segment while the team investigates.

Keep the record concise enough to use. A long legal memo that nobody can connect to a campaign will not control behaviour. Link to fuller advice where needed, but show the approved audience, channel, exclusions and owner in the tools people use.

Design company, contact and group records before import

Purchased data can damage a CRM that lacks a clear record model. A large import may create duplicate companies, overwrite trusted customer fields and attach contacts to the wrong entity. Design the objects, keys, ownership and field precedence before any production file is loaded.

Separate company and contact records. A company can have several contacts, and one person can have relationships with more than one organisation over time. Do not repeat all company fields on each contact row and then treat conflicting copies as separate truths. Use stable links and preserve relationship dates where the system allows.

Choose identifiers per object. Company number can help with UK registered entities, but not every target is a limited company and one commercial group can contain several numbers. Domain can help match brands, but shared or changed domains create ambiguity. Use a composite identity process rather than one magic key.

Model groups and sites. Parent company, subsidiary, trading brand and operating location may need separate records or relationships. Decide which unit receives ownership, activity and opportunity history. A service sold per site should not collapse every location into the registered parent, while a group contract should not be reported as unrelated site wins.

Protect first party values. A customer supplied address, confirmed role or account owner's correction should not be replaced automatically by a purchased field. Create field precedence rules and store suggested enrichment separately when confidence is lower. Make the merge decision visible to an accountable user for important conflicts.

Use staging. Load the pilot into a controlled area, validate types, compare matches and inspect proposed changes. Report create, update, skip, conflict and error counts before applying them. A successful import job only proves the file was processed. It does not prove the records were matched correctly.

Test duplicate rules against awkward cases. Include shared domains, trading names, renamed businesses, franchisees, subsidiaries, generic inboxes and people who moved company. The CRM data cleansing guide explains how candidate matching should remain separate from an authorised merge. Use the same distinction here.

Preserve source and status. Every imported field that affects a decision should carry enough provenance to be reviewed. The exact implementation may use field groups, an evidence object or an audit table. Avoid filling the visible CRM with long URLs if a related evidence record can keep the detail cleanly.

Define ownership before assignment. A new account may belong to a territory, specialist or existing relationship owner. Automated routing should check exclusions and current opportunities first. If the rule cannot choose safely, create a review queue with a named owner instead of assigning at random.

Keep suppression independent of the provider. Match imported emails, domains, telephone numbers and internal IDs against customer, opportunity and do not contact records. Account for normalisation without making the match overly broad. A new spelling or format should not defeat an established objection.

Control update rights. Users who research accounts may suggest changes without permission to merge customers or launch campaigns. Integration accounts should have the least access required. Keep vendor credentials and personal exports out of shared spreadsheets where access and deletion cannot be managed.

Plan for deletion and exit. If the licence ends, identify which imported fields must be removed, retained or frozen. Deletion should not erase sales history, lawful suppression or customer supplied information that has another basis. Tag licensed fields so the exit process can distinguish them.

Reconcile after import. Count the delivered rows, staged entities, created records, updated records, conflicts, exclusions and failures. Sample every outcome type. Then ask sales users to find a known company, understand why it was included and see the evidence without opening a private working file.

A clean import is a beginning. Define how new corrections, role changes, objections and provider refreshes enter the model. The data should become part of an accountable operating process, not a one time file that slowly loses meaning.

Connect the data to a controlled sales workflow

Data creates value only when it supports a clear decision and reaches a person who can act. A provider search that ends in a private list creates another queue beside the CRM. The operating design should connect research, review, ownership and follow up without letting an import trigger uncontrolled communication.

Define the first action for each accepted account. It may be deeper research, account assignment, a call preparation task, an approved outreach sequence or exclusion. Do not send every record directly into the same cadence. Evidence strength, account value, relationship history and recipient type can justify different routes.

Separate research completion from campaign eligibility. A record can be complete enough for market analysis but not approved for contact. Use distinct statuses and permissions. This prevents a marketer from assuming that a populated email field has already passed the organisation's legal, relevance and suppression checks.

Build a review queue around exceptions. Wrong entities, uncertain roles, shared inboxes, existing relationships and legal status questions need a place to go. Name who resolves each type and what evidence closes it. A general error label encourages people to bypass the process when work becomes busy.

Give sales the reason, not the whole research archive. The working view should show why the account fits, what is known, what remains uncertain and the next appropriate action. Link to supporting evidence where needed. Long copied biographies and generic AI summaries make it harder to identify the useful point.

Connect the proposition to the selection. If an account was included because it operates several regulated sites, the approach should concern the relevant problem, not a generic introduction. The AI sales prospecting guide explains how account research, message drafting and sending need separate checks. Data sourcing should feed that process without pretending to complete it.

Control automation boundaries. A new record may create a review task, but should not automatically enrol in email or trigger a call without the required approvals. Use lists or workflow criteria that are understandable to the business. Record the rule version so a later change can explain why similar contacts took different routes.

Preserve replies and corrections. A salesperson who learns that a person left, a group buys centrally or a company is unsuitable should update a structured field or return a correction. The provider may need the feedback, but the CRM remains responsible for the team's current view and suppression.

Plan capacity. A list of 5,000 accepted accounts creates no benefit if two salespeople can review only 40 a week. Match acquisition to the team's ability to investigate, contact and handle replies. Staged releases also expose quality issues before they affect the full dataset.

Measure handover health. Track accepted records with an owner, time to first review, records returned for correction, duplicate discoveries and outcomes by rejection reason. Activity counts alone reward volume. A high number of automated touches can conceal weak selection or poor ownership.

Keep campaign evidence distinct from source evidence. Provider data explains why a record entered the process. Sales activity, reply and opportunity outcomes show what happened later. Do not overwrite the original fields to make the campaign look better. Retain both layers so sourcing rules can be refined honestly.

Design the pause route. If complaints, bounce patterns, wrong roles or unexpected records appear, the team should be able to stop the affected source or segment without disabling every sales process. Define thresholds for investigation and who can authorise resumption.

The handover is complete when an ordinary user can understand the record, make the intended decision, record a correction and respect an objection. A technically connected platform that requires one specialist to explain every field remains fragile.

Measure cost per accepted and usable record

Headline price rarely reflects the economic result. Providers charge per seat, credit, export, matched record, enrichment call, research hour or delivered file. Compare them using a unit tied to the job, then include internal review, integration and maintenance.

Start with total pilot cost. Include subscription or project fee, setup, data credits, verification, implementation and staff review. Separate reusable system work from campaign specific cost. A CRM mapping built once should not be charged entirely to the first small list if it will support later sourcing.

Calculate cost per delivered record only as a diagnostic. Suppose a pilot costs £2,400 and returns 1,000 rows. The delivery cost is £2.40 per row. If 250 rows fail mandatory criteria and 150 require unresolved research, the useful denominator is smaller.

If 600 accounts pass the agreed acceptance test, the cost per accepted account is £4.00 before internal time. Add 40 hours of review valued at an agreed internal cost of £35 per hour, or £1,400. Total assessed cost becomes £3,800 and cost per accepted account becomes about £6.33. This hypothetical arithmetic is a comparison method, not a market benchmark or GRO result.

Now examine contacts. The 600 accepted accounts may include 420 relevant named contacts, 90 generic routes and 90 with no suitable person found. If the campaign needs a relevant named role, cost per accepted contact is about £9.05 using the £3,800 total. Do not count several contacts at one company as several independent opportunities unless the sales process treats them that way.

Report rejection reasons. Wrong sector, unsupported geography, duplicate group, existing customer, irrelevant role, missing mandatory evidence and suppression each point to a different fix. A high rejection rate may reflect the provider, the brief or an intentional cautious rule. The reason distribution matters more than one pass percentage.

Include time to useful record. A low cost platform can be expensive if users spend hours resolving identities and exporting fields. A research service can appear costly per row while saving senior sales time. Measure the work actually displaced and avoid assuming every saved minute becomes productive capacity.

Consider credit waste. Search interfaces may charge for reveals that later prove out of market, duplicates or already present in the CRM. Ask whether credits can be estimated before reveal and whether failed fields are refunded. Build a search and suppression step before users spend credits record by record.

Price freshness. An annual file may require revalidation before each campaign. A subscription may include updates but still need review of significant changes. Estimate the maintenance cost across the intended period. A one time purchase is not cheaper if the team repeatedly buys replacements for the same uncertain segment.

Keep campaign results separate from data quality. Replies and opportunities depend on proposition, timing, channel, execution and follow up as well as the list. Compare sourcing cohorts where practical, but do not claim the provider caused every later sale. Use rejection and correction evidence to improve the brief before making causal claims.

Define the renewal decision in advance. State the minimum accepted coverage, maximum review burden, correction responsiveness and operating fit required. Review performance against the pilot method, not against a new vendor dashboard. If the market or campaign changed, document that difference.

A commercial scorecard should show total cost, delivered and accepted units, critical field coverage, review hours, unresolved conflicts, licence limits and ongoing cost. This gives finance, sales and privacy owners a shared view. It also stops the largest nominal database from winning a decision it was never designed to answer.

Compare contracts, security, licensing and exit terms

Data contracts govern what the business can do after procurement has finished. A provider can pass a quality pilot and still create unacceptable dependence, unclear rights or weak security. Review commercial, privacy and operational terms together before production access begins.

Describe the service precisely. Name the provider model, datasets, fields, regions, users, export rights, APIs, support and refresh commitments. Marketing pages may change. The order form or schedule should identify the product and limits that were evaluated.

Confirm licence scope. Ask whether records can be exported, stored in the CRM, shared with contractors, used for advertising audiences, enriched, retained after cancellation and reused for other purposes. Do not assume a data purchase transfers ownership. Separate your first party corrections and campaign history from licensed values.

Check sourcing warranties carefully. A broad statement of compliance may offer little operational evidence. Request the provenance and due diligence information needed for your assessment, with a commitment to notify the customer of material source or process changes. Define what happens if a source is withdrawn or challenged.

Set quality remedies that match the pilot. Replacement credits for invalid emails do not address wrong companies, unsupported roles or group duplicates. Define measurable acceptance categories, reporting windows and the treatment of disputed records. A remedy should not force the buyer to use more of the same unsuitable data.

Review security around both provider data and customer uploads. Ask about access controls, authentication, encryption, audit logs, incident handling, backup, deletion and support access. If the platform integrates with the CRM, scope its permissions to the required objects and actions. Do not grant broad write access for a read only evaluation.

Map subprocessors and international transfers. Understand where data is hosted and which organisations support matching, verification, analytics or customer service. Contract terms should explain material changes and the safeguards used. Your adviser can assess the position against the data and risk.

Define service continuity. An API may have rate limits, planned changes and availability commitments. A platform can remove fields or change its credit model. Identify which workflow depends on the provider and how the business continues when the service is unavailable. Keep stable internal identifiers and do not make the vendor key the only link between CRM objects.

Protect human review. If the product uses automated enrichment or generated summaries, ask what source evidence remains available and whether users can challenge a field. The contract should not require the customer to accept an inferred value as fact. Record model or process changes that alter output meaning.

Agree correction and rights handling. The provider should explain how it receives accuracy challenges, objections and deletion requests, and how relevant changes reach customers. Your organisation still needs its own process. A vendor correction does not replace the buyer's duty to handle the person who contacted it.

Plan termination before signing. Export needed records, evidence, suppression and usage logs in an agreed format. Remove fields that cannot be retained while preserving independently obtained customer history and minimum suppression data. Revoke integration credentials and confirm deletion of customer uploads.

Assign internal ownership. Procurement manages the commercial commitment, but a sales operations owner should manage use, a privacy owner should manage assessed purposes and rights, and a technical owner should manage connections. Name a first responder for quality and security incidents.

Compare proposals in a common table. Include accepted record economics, source transparency, legal evidence, field controls, integration, security, licence, exit and supplier support. Record exceptions rather than burying them in notes. A more expensive provider may be proportionate when it reduces uncertainty the business otherwise has to carry.

Turn security promises into an acceptance test

Security questionnaires help procurement compare suppliers, but implementation evidence shows what the customer will experience. Build a small acceptance test around account access, exports, integrations, deletion and incident routes. Use test data designed for the evaluation, not a copy of the production CRM.

Create users with the roles you expect to operate. Confirm that a researcher cannot manage billing or change integrations, and that an administrator does not need to share a personal login. Test multifactor authentication, session controls and the process for removing a user promptly.

Review export permissions. Check who can download personal data, whether the event is logged and whether large exports can be restricted. If a salesperson can export the whole database to a local device without visibility, the CRM controls stop at the browser.

Connect a sandbox or constrained CRM account. Inspect the requested permissions and reduce them to the objects and actions required. Test how the integration handles a revoked token, deleted record, API limit and conflicting update. It should fail visibly rather than silently retrying harmful changes.

Check customer uploads. Identify where the file appears, who at the supplier can access it, how long it remains after matching and how deletion is requested. Ask whether uploaded records contribute to the provider's own database or product development. The contract and interface should tell the same story.

Test audit evidence. Create, view, export, change and delete a test record, then ask the system to show the events. Confirm timestamps, user identity and affected objects. Logs that record only successful logins may not support an investigation into bulk export or unexpected overwrite.

Walk through a rights or correction request. The provider should know which team receives it, how customer records are located and how changes reach downstream systems. Your own team needs a route that does not depend on the individual identifying the original data vendor.

Request the incident contact and notification route. Simulate an expired credential or suspicious export through the agreed support channel. Do not create a real security incident. The exercise checks whether the named route exists and whether responsibilities are clear.

Test exit on the sample. Export allowed business records and evidence, remove the integration, delete customer uploads and verify access removal. Record anything the business cannot retrieve or erase. Resolve those limitations before the data becomes operationally important.

The acceptance test does not prove the supplier's entire security programme. It confirms that customer facing controls match the proposed workflow and provides evidence for the risk owner. Repeat affected checks after material integration or product changes.

Questions UK buyers ask about B2B data providers

Is it legal to buy B2B data in the UK?

Buying business data is not automatically prohibited, but the buyer must assess how personal data was obtained and how it will be used. Public or paid availability does not remove UK GDPR duties. PECR may apply according to the contact channel and subscriber type.

Carry out provider due diligence, identify a lawful basis, give appropriate privacy information, respect objections and assess the planned communication. A list described as compliant does not approve every campaign. Use current ICO guidance and suitable advice for the exact data flow.

What is the difference between B2B company data and contact data?

Company data describes an organisation, such as legal name, company number, status, sector and locations. Contact data identifies or relates to a person, such as name, role, work email or direct telephone number. A company record may contain no personal data, but named professional details usually require a UK GDPR assessment.

Keep the two layers linked but distinct. This makes sourcing, updating, suppression and deletion easier to control. It also prevents a current company fact from making an old contact record look current.

How accurate should a B2B database be?

There is no useful universal percentage. Accuracy must be measured by field, segment, time and purpose. Legal identity, operating location, role and email status have different sources and update rates. Ask for a controlled sample from your market and score the mandatory fields separately.

Record conflicts and unknowns as well as correct values. Separate missing fields from values shown to be wrong. A provider that shows uncertainty can be safer than one that fills every cell. Continue sampling after purchase because people, companies and systems change.

Should we buy a list or use a subscription platform?

A bounded file can suit a defined campaign or market map when selection, evidence and handover are clear. A subscription can suit ongoing research across changing segments, especially when users need search and refresh access. The better option depends on volume, cadence, fields, internal capacity and licence terms.

Compare total cost per accepted record, review time, CRM fit and exit rights. A platform with more contacts is not better if users cannot apply the search consistently or retain the evidence they need.

How often should B2B contact data be refreshed?

Set cadence by field and use. A company status, site detail, named role and email check can age at different speeds. Review data before a live campaign, after meaningful feedback and at a planned interval that fits the decision risk. Avoid claiming that every row stays current for a standard period.

Store sourced, checked and corrected dates. Keep objections and suppression active through refreshes. A replacement file should never reintroduce someone who has already asked your organisation not to use their data for direct marketing.

Run a controlled pilot and keep the dataset accountable

A sound B2B data purchase begins with a business question and ends with an operating owner. The provider sits between those points. Its database, research and verification can help, but they cannot define your market, approve your legal position or maintain your CRM without clear instructions.

Start with one segment and one intended use. Write the account criteria, contact responsibilities, fields, sources, exclusions and acceptance rules. Review the plan with sales, operations and the person responsible for privacy. Then give the same bounded sample to shortlisted suppliers.

Score the pilot using evidence the team can repeat:

• accepted accounts against the written brief;
• required field coverage and source quality;
• relevant contacts rather than populated names;
• conflicts, unknowns and correction effort;
• suppression, licence and intended use controls;
• total cost per accepted and usable record.

Move accepted records through staging before production. Protect trusted fields, review duplicate candidates, preserve group relationships and test suppression. Let a new record create a review task before it creates a communication. Release work in volumes the team can investigate and handle properly.

Operate the dataset as a maintained evidence set. Record provider updates, sales corrections, objections, role changes and rejected accounts. Sample quality at renewal and after material source changes. Retire fields that no longer support a decision instead of keeping them because the subscription can populate them.

Use the first 30 days to prove the operating process

Use the opening month as an operating test, not a race to consume credits. In the first week, train the small group who will review, correct and own records. Give them examples of accepted, rejected, uncertain and suppressed cases. Ask each person to process the same few records and resolve differences in the brief.

During the second week, release a bounded cohort into the real CRM. Reconcile delivery, staging, matching, creation and exclusion counts. Sample every path, including records that updated existing companies and records that entered the exception queue. Confirm that no automation contacted them simply because the import succeeded.

In the third week, observe how sales uses the evidence. Can users understand why an account fits, identify the relevant role and return a correction without leaving the workflow? Record time spent, questions and bypasses. If people create private spreadsheets, investigate which needed task the CRM view failed to support.

Use the fourth week to review source quality and governance. Compare accepted records, wrong entities, missing fields, changed roles, objections and unresolved questions. Check that provider corrections were acknowledged and that suppression reached every active route. Review access and remove any temporary evaluation accounts.

Make one controlled improvement at a time. Tighten a criterion, change a field mapping or alter a review step, then observe the next cohort. Simultaneous changes to provider, brief, CRM and campaign make it hard to learn which decision helped.

At the month end, decide whether to continue, repair, narrow or stop. A smaller dependable segment may justify continued work even when broad coverage disappoints. A large file should not continue if the team cannot explain its evidence or keep objections effective. Record the decision and the next review date.

The best buying decision is rarely the provider with the largest headline count. It is the option that can show suitable coverage in your market, explain its evidence, fit your systems and leave your team in control of use and correction.

If you need to turn a target market into a testable sourcing brief, talk to GRO about B2B data sourcing. Bring your offer, current account criteria, intended contact method and a small set of known examples. That is enough to begin a useful evidence based conversation.