What to ask your data supplier — and how Corpdata answers

Why this page exists

Buying data should not require a forensic audit.

The case for rigour is real. Under UK GDPR, you are accountable for the data you process — including data you licensed from someone else. If the supplier cut corners, the ICO will not ask for their explanation. It will ask for yours.

But there is a difference between due diligence and becoming your supplier's compliance officer. The first is sensible. The second is how commodity suppliers quietly transfer risk to you.

Rather than hand you a twenty-question checklist and wish you luck, we have written out the ten questions that actually matter — and how we answer each one. Read the answers. Compare them to anyone else you are considering. If an answer is vague, undefended, or phrased as a claim without a mechanism, that is what the original checklist was written to find.

Section one

About the company

The basics. If a supplier cannot answer these in a single sentence each, the rest of the conversation is not worth having.

Question 1

What is your ICO registration number?

Any supplier processing personal data must be registered with the Information Commissioner’s Office. Checking the number against the ICO’s public register takes 30 seconds. A supplier who hesitates on this question has already failed it.

Corpdata

Z5404661. Verifiable on the ICO public register at ico.org.uk. Search for Corpdata Limited, Teignmouth.

Question 2

What is your Companies House number?

Confirms the supplier is a real, accountable UK legal entity — not a one-page website with an overseas bank account. Cross-check the filed accounts, the registered office, and the directors.

Corpdata

02690712. Corpdata Limited, incorporated 1992, registered office in Teignmouth, Devon. Accounts filed annually since incorporation.

Question 3

How long have you been in this business?

Longevity in a regulated category is an authority signal. A supplier who has operated through the Data Protection Act 1998, PECR, and UK GDPR has answered a harder version of every one of these questions before.

Corpdata

Thirty-four years. Founded in 1992, before the commercial internet and before the DPA 1998. Our compliance framework has been revised through every change in the UK regime, including the 2018 transition and the post-Brexit UK GDPR settlement.

Section two

About the data

Where it comes from, and under what legal basis. This is where commodity suppliers get vague. Watch for it.

Question 4

Where does your data come from, and how is it built?

The most common red flag in a supplier conversation is vagueness here. “Proprietary research” with no further detail is often code for scraping. Credible suppliers can describe the process in plain terms.

Corpdata

Our heritage as a UK data specialist goes back to 1992, when we built our reputation on telephone-researched contacts. Market preferences shifted over time toward cheaper data, and the commercial reality of verification shifted with it.

Today, verification is technical: software-driven validation, cross-referencing against public sources, web analysis, and AI-assisted enrichment. The average age of a record is 94 days.

Where any commercial dataset’s freshness can reasonably be questioned, we answer with outcomes rather than claims — see the 2-for-1 Goneaway Guarantee in Question 10.

Question 5

What is your legal basis for processing?

Under UK GDPR, every act of processing has a specified legal basis. For B2B marketing data, the two plausible answers are consent and legitimate interest. Either can be defensible. “We are not sure” cannot.

Corpdata

Legitimate interest, supported by a documented Legitimate Interest Assessment. We provide the LIA on licence, together with our Fair Processing Notice guidance. You do not have to write the assessment from scratch — we have done the work, and we stand behind it.

Question 6

If the basis is consent — was my organisation named at collection?

For consent to be a valid basis for passing data on to you specifically, you must have been named at the point of collection. Most generic consent wording does not meet this bar. This single question rules out a surprising proportion of consent-based suppliers.

Corpdata

Our data is licensed under legitimate interest, not consent, so named-at-collection does not apply to us. If you are evaluating a consent-based supplier, ask to see the exact wording used at collection. The absence of a specific script naming your organisation is a hard stop.

Section three

About the relationship

The sale is not the relationship. These two questions reveal whether a supplier is set up to stay useful after the licence begins — or whether, in practice, their job ends at the invoice.

Question 7

How do you know the data is still accurate?

People change jobs. Companies dissolve. Phone numbers are ported. The question is not whether a dataset decays — all do — but how the supplier measures and corrects that decay, and how often.

Corpdata

Verification is continual, not periodic. Records are re-checked on a rolling basis through technical validation against public sources and structured enrichment.

The practical answer is the number: 94 days, the average age of a record across the database. The commercial answer is the 2-for-1 Goneaway Guarantee — we replace a goneaway contact with two valid ones in the same segment. The licence gets sharper with use.

Question 8

What help do I get during the campaign — not just at the point of sale?

Commodity suppliers get paid at hand-off. The CSV is sent, the licence is issued, and the relationship quietly ends there. But targeting questions tend to emerge after the campaign meets real prospects — and a supplier whose incentives ended at delivery is not set up to answer them.

Corpdata

You get a person, not a support portal. Practical targeting help is part of the licence — usually from the same team who helped build the selection.

If a segment needs narrowing, a test cell needs designing, or an early response pattern needs interpreting, there is a phone number and a name. Consultative work, for the life of the licence. It is also the part commodity suppliers cannot credibly replicate.

Section four

Seeing the data before you commit

Data quality is invisible in a spreadsheet. A scraped CSV looks identical to a researched one. The only way to tell is to see a selection that matches your campaign, not a generic sample curated by the supplier.

Question 9

Will you give me a sample I can choose?

A “golden sample” is a curated set the supplier knows will pass review. It tells you how good their best records are, not how good the dataset is. A useful sample is one you specified — ideally one you can sense-check against your own knowledge of the market.

Corpdata

Yes, and we go a step further than a generic sample. Tell us the sector, role, company size, and geography you want to reach. We will build a live selection that matches your actual campaign brief, so you see precision where it matters to you — not where it would matter to us.

No commitment. No payment card. No subsequent sales sequence if you decide the fit is not right.

Question 10

What happens when a contact has moved on?

Every dataset decays. The only real question is who absorbs the cost of that decay — the supplier or you.

Corpdata

The 2-for-1 Goneaway Guarantee. If a licensed contact has moved on, we replace them with two valid contacts in the same segment, at no extra cost. The licence becomes sharper with use, not staler. It is the standing commercial answer to the “accuracy over time” question, and it is unconditional.

What to listen for

The red-flag answers — and what a straight one sounds like.

Four conversations you will have with any data supplier. The left column is the tell. The right column is the answer you should be looking for.

Watch for

“We have millions of records.” Volume without a verification method named. Big numbers are the easiest claim in data marketing — and the least informative.

Corpdata’s position

We publish the average record age (94 days), describe how verification happens, and back freshness with the 2-for-1 Goneaway Guarantee.

Watch for

“All our data is GDPR-compliant.” A claim with no mechanism behind it. Compliance is not a sticker — it is a documented legal basis, a process, and an audit trail.

Corpdata’s position

Named legal basis (legitimate interest). Documented LIA supplied on licence. Fair Processing Notice guidance included. Monthly objection and change notifications as standard.

Watch for

“We can send you a sample.” Usually a golden sample — curated records the supplier already knows will pass scrutiny. Tells you nothing about the data you will actually receive.

Corpdata’s position

We build a live selection to your actual campaign brief. You specify the sector, role, size, and geography. You see precision where it matters to you.

Watch for

“If a contact is wrong, let us know.” Polite, and meaningless. No replacement rate, no remedy, no commitment — just a customer-service pleasantry that leaves you carrying the cost of decay.

Corpdata’s position

The 2-for-1 Goneaway Guarantee. A written, unconditional replacement ratio. The only question is whether the supplier is confident enough in their data to put the guarantee in writing — many are not.

Who is answering the questions

Corpdata. Thirty-four years of UK B2B data specialism.

A UK direct marketing data specialist. Not an advertising network, not a campaign agency, not a generic platform. We supply the one ingredient a direct, sovereign route to market depends on: precise, continually verified identity data for UK decision-makers.

01

Continually verified UK B2B data

Average record age of 94 days. Technical validation, public-source cross-reference, structured enrichment.
02

2-for-1 Goneaway Guarantee

Written, unconditional, standing. Licences that sharpen with use.
03

Compliance documentation supplied as standard

Legitimate Interest Assessment, Fair Processing Notice guidance, monthly change and objection notifications.
04

Targeting we build with you, not for you

Sector, role, size, geography, any combination. Email, telephone, post, or multi-channel. You review and approve the selection before it is licensed.

Skip the audit. See a selection for your market.

Tell us the sector, role, company size, and geography you would want to reach. We will prepare a live selection built to your brief, so you can see the targeting precision before any commitment.

Build a live selection for my sector →

Or call us on 01626 777400 to talk it through.