The ICO’s position, in their own words.
“It is important to remember that you are responsible for ensuring compliance with the UK GDPR and PECR. Simply accepting a third party’s assurances that the data they are supplying is compliant is not enough. You must be able to demonstrate your compliance and be accountable.
You must be very careful about using these lists and undertake proportionate due diligence.”
The Code sets out the questions a purchaser of third-party data should ask. Our answers to each of those questions are below. Each is written to be defensible on its face — not as a promise to investigate further, but as the standing commercial position you can rely on when your own compliance record is audited.
1. Who compiled the data?
Corpdata Limited. Companies House registration 02690712. ICO registration Z5404661. Founded 1992, registered office Teignmouth, Devon. Both numbers verifiable on the respective public registers.
2. Where was the data obtained from?
Public UK business sources — Companies House filings, corporate websites, published trade directories, and other structured public records — enriched by technical validation and cross-reference. Named decision-maker information is limited to individuals’ professional roles, gathered in a business context, not personal.
3. What privacy information was supplied when the data was collected?
Corpdata processes personal data on the legal basis of legitimate interest, supported by a documented Legitimate Interest Assessment. A Fair Processing Notice (FPN) is issued to data subjects and is available on request. The LIA and an FPN template are supplied as part of every licence, so the licensee can incorporate them into their own compliance documentation.
4. When was the personal data compiled?
Continually, not at a single point in time. Records are re-verified on a rolling basis, with new records added and existing records refreshed as their provenance sources are re-checked. The average age of a record across the database is 94 days.
5. How was the personal data collected?
By technical verification: software-driven validation, cross-referencing against public sources, web analysis, and AI-assisted enrichment. Records are tested for internal consistency and external corroboration before being released for licensing.
Historical note: in its early decades Corpdata used telephone research as the primary collection method. Market preferences shifted toward lower-cost data, and the verification methodology shifted with them. Today’s method is technical, and the 2-for-1 Goneaway Guarantee (see Q8) is the commercial standing behind record accuracy.
6. Records of consent (if the data is ‘consented’ data)?
Not applicable — Corpdata does not process on the basis of consent. The legal basis is legitimate interest, supported by a documented LIA provided on licence. If you are comparing us to a consent-based supplier, the material question is whether their consent scripts specifically named your organisation at the point of collection; generic consent does not transfer.
7. Evidence that the data has been checked against opt-out lists?
All telephone data is screened against the Telephone Preference Service (TPS) and the Corporate Telephone Preference Service (CTPS). Screening records are retained and available on request.
Note on MPS: the Mailing Preference Service is a consumer-only register and does not cover business-to-business postal mail. Screening B2B postal data against MPS would neither reduce your compliance risk nor improve targeting accuracy, so it is not part of our process.
8. How does the seller deal with individuals’ rights?
Rights requests received directly by Corpdata — access, rectification, erasure, or objection to direct marketing — are handled in line with UK GDPR timelines.
On request, Corpdata can supply twice-monthly update files reflecting objections and erasures against your licensed data, so you can propagate them into your own records. In practice, most licensees prefer to manage suppression and rights requests through their own established processes: as the controller for data in your possession, you are responsible for handling rights requests addressed to you and for maintaining your own suppression file. The update-file service is available to any licensee who wants it built into their workflow.
The 2-for-1 Goneaway Guarantee is the standing commercial mechanism for accuracy over time: where a licensed contact has moved on, Corpdata replaces them with two valid contacts in the same segment, at no additional cost.
Corpdata Limited at a glance
- Legal name: Corpdata Limited
- Companies House number: 02690712
- ICO registration: Z5404661
- Incorporated: 1992
- Registered office: Teignmouth, Devon
- Specialism: UK B2B direct marketing data — email, telephone, postal
- Licence model: single use, 12-month multiple use, or eternal use
- Standing commitment: 2-for-1 Goneaway Guarantee (written, unconditional)
Want more than a summary?
If your DPO or procurement team needs to see how the data works in practice, we will build a live sample selection for your sector — with the targeting logic, record freshness, and compliance documentation supplied alongside. No commitment.
Request a live sample for our sector →Or call 01626 777400 to speak to someone directly.