Last updated: November 6, 2026
Short answer. A lead vendor can’t make your programme GDPR-compliant for you, but the vendor’s process decides how much risk you take on. Before you buy leads in the UK or EU, ask every vendor four things. What is the lawful basis for each contact, where did the data come from, what did the person see before they shared their details, and how fast do opt-outs reach your systems. If a vendor can’t answer in writing, keep looking.
This checklist isn’t legal advice. Your own legal or privacy team should sign off on the final setup.
Why this matters more than price
You pay for every lead you can’t legally contact. If a contact asks how you got their details and your vendor can’t show a record, you are the one who has to answer. In the UK, email marketing also falls under PECR alongside UK GDPR, and EU countries add their own national rules on electronic marketing. Rules for emailing a corporate inbox differ by country, so one blanket policy for “Europe” rarely holds up. Settle the questions below before you compare cost per lead.
Know which lawful basis each lead uses
Most B2B lead programmes rely on one of two bases.
- Consent. The person ticked a box or gave clear permission to be contacted about a named topic or by named companies. Content syndication programmes often work this way, because the contact downloads an asset and agrees to share their details.
- Legitimate interest. Under Article 6(1)(f) of UK and EU GDPR, you have a real business reason to contact the person, you have weighed it against their rights, and you give them an easy way to object. This is common for outbound calling and some B2B email, but it needs a documented legitimate interest assessment (the balancing test) on your side.
Ask the vendor which basis applies to each lead, and check that it appears on every record in the file you receive.
Is B2B cold email legal under GDPR and PECR?
Short version for UK buyers: GDPR covers how you process personal data. PECR covers whether you may send unsolicited marketing email. You need both answers to land cleanly.
Under PECR, marketing email to an individual usually needs consent. For corporate subscribers (a work email at a company), the rules are different from consumer email, but you still need a lawful basis under UK GDPR for holding and using the address, and every message needs a clear unsubscribe. Soft opt-in (prior customer or negotiation, with an opt-out at collection and in every later message) is a UK PECR route that does not apply to cold prospects you have never dealt with.
What that means in practice when you buy or outsource cold email for UK or EU tech buyers:
- Ask whether each address is treated as an individual or a corporate subscriber, and which rule the vendor applies.
- Ask for the lawful basis on the record (consent or legitimate interest) and for a copy of the legitimate interest assessment if that is the claim.
- Refuse lists with no source date, no suppression history and no written opt-out path into your CRM within days, not weeks.
- Confirm the vendor will stop emailing anyone who objects, and will pass that objection to you in the next delivery file.
EU member states layer their own e-privacy rules on top of GDPR, so a programme that is fine for UK corporate inboxes can still be the wrong call for Germany, France or Italy. Scope each country in the brief. This is still not legal advice; get your privacy counsel to sign the final setup.
Ask to see the consent screen
For content syndication leads, the most useful thing a vendor can show you is the form the contact filled in. Look for three details.
- Your company name, or a clear description of who will get the data.
- Wording the person could understand before they clicked.
- A link to a privacy notice.
If the vendor shows you a generic form with no sponsor named, ask how they handle a contact who later says they never agreed to hear from you. A good content syndication programme can tie each lead back to the asset, the date and the form version.
Ask where the data came from
For outbound calling and email marketing, ask how the contact list was built and when it was last checked. You want to know the source, the date of the last verification, and whether the vendor removes people who have objected before. A record that has not been checked in a year is a deliverability problem and a privacy problem at once.
With telemarketing, ask whether the caller tells the prospect who they are calling for, and how the call notes record the prospect’s agreement to a follow-up.
Make opt-outs travel fast
If an opt-out sits in a vendor’s spreadsheet for two weeks, you can still end up emailing that person. Agree on three things in writing.
- How the vendor sends you opt-outs and objections (a field in each delivery, a separate file, or a direct sync).
- How fast they arrive, measured in days.
- That anyone who objects is suppressed for good, in the vendor’s system and yours.
Ask for the suppression list on the first delivery and see whether it matches.
Put the paperwork in place before the first delivery
Before any personal data changes hands, you should have these sorted.
- A data processing agreement that says who is the controller, who is the processor, and what the vendor may do with the data after delivery.
- Transfer terms if the data moves outside the UK or EU, since many vendors work across regions.
- A retention rule. How long the vendor keeps the lead after you receive it, and how they delete it.
- A named contact for privacy questions, so a data request from a prospect doesn’t bounce between inboxes.
Treat a vendor that won’t sign a data processing agreement as a warning sign. The same questions apply when you outsource lead generation rather than buying a one-off list.
Use intent data carefully
Account-level intent signals help you choose which companies to work, and they usually describe accounts rather than individuals. At Kliqwise, intent leads use AISHA as an intent and behavioral intelligence layer on top of telemarketing and syndication. AISHA ranks accounts and topics; the lead programme still delivers the contact. Once a named contact is attached to an account signal, ask the same basis, source and opt-out questions as you would for any other lead.
Questions to put in every quote request
Send the same list to each vendor so the answers line up.
- Which lawful basis applies to each lead, and is it labelled in the delivery file?
- Can we see the exact form or call script the contact saw?
- Where does your contact data come from, and when was each record last verified?
- For cold email into the UK or EU: which PECR / e-privacy rule do you apply, and how do opt-outs reach us?
- How and how fast do opt-outs and objections reach us?
- Will you sign our data processing agreement, and where is the data stored?
- How long do you keep our leads after delivery?
A short shortlist of UK- and EU-ready providers
Use the checklist above on every vendor. The names below are ones UK and EU tech buyers often shortlist for GDPR-aligned outreach; none of them replace your own legal review. Competitor prices are listed as “Not published” unless that vendor publishes a clear public rate on their own site.
| Provider | What they typically sell into UK/EU tech | Pricing (public) | What to check first |
|---|---|---|---|
| Kliqwise | Content syndication, telemarketing, email, BANT, intent leads, appointment setting | From $15 / $30 / $40 per lead; $800/meeting; free 50-lead pilot | Lawful basis labelled per lead; DPA; country scope; published prices |
| Belkins | Multichannel appointment setting and outbound | Not published as a fixed public UK/EU GDPR rate card | Lawful basis for email and calling; opt-out speed; country coverage |
| Martal Group | Outsourced SDR and appointment setting | Not published | List source and verification date; DPA; PECR position on cold email |
| memoryBlue | Outsourced SDR / ADR for tech (EMEA coverage via London) | Not published | Lawful basis per market; suppression handling; transfer terms |
| Air Marketing | UK-based outbound calling and email | Not published | UK PECR process; consent vs legitimate interest paperwork |
Ask each of them the same written questions. Keep the vendor that answers clearly.
Where Kliqwise fits
Kliqwise works with tech marketing teams worldwide, including the UK and EU. Our programmes are GDPR-aligned, and coverage in each country is scoped to your brief and the consent or lawful-basis rules that apply there. Founded in 2023 and based in Bengaluru, we serve Global markets. Your privacy team still makes the final call on lawful basis for your own outreach, so bring the checklist above to the first call and hold us to it.
You can see our starting prices on the pricing page: content syndication from $15 per lead, BANT from $30 per lead, intent from $40 per lead, appointment setting from $800 per meeting, plus a free 50-lead pilot. Or email [email protected] with your target countries and the lawful basis your team uses. We will tell you what we can deliver under it.
For a Medium version of this checklist, see How to Buy GDPR-Aligned B2B Leads for UK and EU Tech Buyers on Medium.
Archana Kamble is VP of Sales & Head of Demand Generation at Kliqwise. Kliqwise is a B2B lead generation company founded in 2023, based in Bengaluru. We help tech marketing teams with content syndication, telemarketing, email, BANT leads, intent leads, appointment setting, and white-label programmes for agencies. Reach us at [email protected].
FAQ
Is B2B cold email legal under GDPR and PECR?
GDPR covers how you process personal data. PECR covers whether you may send unsolicited marketing email. Under PECR, marketing email to an individual usually needs consent. For corporate subscribers the rules differ from consumer email, but you still need a lawful basis under UK GDPR and a clear unsubscribe in every message. Soft opt-in does not apply to cold prospects you have never dealt with. EU member states add their own e-privacy rules, so scope each country. This is not legal advice.
What should I ask a lead vendor before buying UK or EU leads?
Ask four things in writing: the lawful basis for each contact, where the data came from, what the person saw before they shared their details, and how fast opt-outs reach your systems. Also ask for a data processing agreement, transfer terms if data moves outside the UK or EU, a retention rule, and a named privacy contact.
Does AISHA deliver or phone-verify GDPR-aligned leads?
No. At Kliqwise, AISHA is an intent and behavioral intelligence layer on top of telemarketing and syndication. It ranks accounts and topics; the lead programme still delivers the contact. Once a named contact is attached to an account signal, ask the same basis, source and opt-out questions as for any other lead.
What are Kliqwise’s starting prices for GDPR-aligned programmes?
Content syndication from $15 per lead, BANT from $30 per lead, intent from $40 per lead, appointment setting from $800 per meeting, plus a free 50-lead pilot. Coverage in each UK or EU country is scoped to your brief and the consent or lawful-basis rules that apply there.
Can a lead vendor make my programme GDPR-compliant?
No. A vendor cannot make your programme GDPR-compliant for you, but their process decides how much risk you take on. Your own legal or privacy team should sign off on the final setup. Use GDPR-aligned or GDPR-ready wording for vendor processes; this guide is not legal advice.