Key points
- Since the GDPR became applicable in 2018, buying databases containing personal data has been strictly regulated for any processing that identifies a person.
- Every business must check that the data was lawfully obtained in the first place and that the consent covered the intended purpose.
- Two legal bases are mainly relied on when buying lists: consent and legitimate interest.
- Consent must be freely given, specific, informed and unambiguous and, for electronic marketing by partners, must cover the transfer of the data to those partners, identified at the time of collection.
- Legitimate interest requires a balancing of interests; it is not sufficient for electronic marketing to individuals, which in principle requires their prior consent.
- Lack of traceability of consent exposes you to a direct penalty from the CNIL (French data protection authority), even if the list was sold by a third party presented as reliable.
Buying databases continues to attract many businesses that want to boost their sales prospecting. However, since the GDPR came into force, the rules on personal data processing have become considerably stricter. It is therefore essential to understand the legality of these practices, the obligations imposed by the CNIL and the risks involved. Ignorance of the rules on data protection exposes you to significant legal and financial consequences.
The legal framework for buying databases and email lists
Buying a database containing personal data may look like a simple transaction, but it immediately raises the question of its compliance with the GDPR. Since 2018, this European regulation has strictly governed any processing of data that can directly or indirectly identify a natural person. This covers the collection, sale or rental of customer files used as part of a marketing strategy.
Respect for individuals’ rights is a fundamental principle of the GDPR. Any business planning to acquire a database must check that the data was originally obtained in accordance with the regulatory requirements. It is not enough to buy a file presented as “opt-in”: you must make sure that consent was validly obtained for the intended purpose, in particular for marketing messages.
- The lawfulness of the processing depends on your ability to prove consent or the existence of another legal basis provided for by the GDPR.
- Individuals’ rights (access, rectification, objection) must remain protected after any sale of customer files.
- The CNIL regularly checks the compliance of data collection and database trading operations.
What legal basis applies when you buy a database or email list?
The GDPR provides for several legal bases for processing personal data. When buying a database, two grounds are mainly relied on: consent and legitimate interest. Each should be examined to better understand the compliance issues raised by the sale and purchase of customer files.
The choice of legal basis directly affects the validity and legal certainty of your approach, particularly in the event of a CNIL inspection or when data subjects exercise their rights. In this context, using a GDPR lawyer can help you make your approach legally sound and avoid costly mistakes.
Consent: an essential condition?
Consent is the data subject’s freely given, specific, informed and unambiguous agreement to the processing of their data. For electronic marketing to individuals by partners, the organisation transferring the data must obtain the individuals’ consent to that transfer, informing them of the identity of the partners and the purposes, by means of an exhaustive and up-to-date list made available at the time of collection.
A vague wording such as “I agree to be contacted by partners”, without identifying the partners, is not sufficient. If your business acquires a database built under opaque conditions, it will be impossible to show valid consent. The CNIL stresses that whoever uses the data must demonstrate that it was properly collected. Lack of traceability exposes you to a direct penalty, even if the list was sold by a third party presenting itself as reliable.
Legitimate interest: a limited alternative
Apart from consent, the business’s legitimate interest may serve as the basis for processing, in particular for prospecting by post or for B2B electronic marketing related to the person’s profession. This basis requires a prior balancing of interests between those of the business and the fundamental rights of the individual. For electronic marketing to individuals – and, since 11 August 2026, for telephone canvassing of consumers – the CNIL points out that prior consent is in principle required.
If your activities involve large-scale or automated processing, or target people without explicit consent, you are strongly advised against buying a database on this basis. Controllers then risk reprimands, or even penalties for lack of a sound legal basis. In addition, to keep your organisation compliant on all documentation issues, you are advised to ensure the compliance of your terms and conditions and privacy policies and cookie policies, which are frequently checked during regulatory inspections.
Individuals’ rights and the controller’s obligations
Following the purchase or acquisition of a database, the GDPR grants data subjects several rights. The controller, that is the buyer of the file, takes on significant obligations regarding transparency, security and cooperation with the regulator, the CNIL.
Any use requires you to inform the acquired contacts precisely that they have been added to a new file and of their rights: individual information, the ability to withdraw, rectification and objection. Article 14 of the GDPR requires this information to be provided within a reasonable period not exceeding one month, and at the latest at the time of the first communication with the person; otherwise, the processing is not compliant.
- The information given to the contact must set out the identity of the controller, the exact purpose of the collection, the source of the data and how to exercise their rights.
- A mechanism for withdrawing consent must be available at all times, allowing immediate unsubscription.
- The data obtained cannot be kept or used indefinitely and must benefit from appropriate protection measures against accidental disclosure.
Compliance risks when buying databases
Failure to comply with the GDPR when buying a database exposes the business to many risks. Beyond reputational damage, the financial penalty remains the most dissuasive threat. These dangers concern both controllers and unscrupulous sellers of customer files.
Even for a small organisation, the CNIL has a range of enforcement powers designed to ensure data protection and to penalise any compliance failure.
| Type of breach | Potential penalty | Practical example |
|---|---|---|
| Processing without valid consent | Fines of up to 4% of worldwide turnover | Buying B2C contacts without explicit agreement |
| Inadequate information to individuals | Reprimand, periodic penalty payments, publication | Failure to mention the source and purpose |
| Failure to respect withdrawal or objection rights | Temporary/permanent ban on processing | No unsubscribe link |
| Use of non-compliant processors | Fine of up to €10 million or 2% of worldwide turnover | Transfer to a provider outside the EU without safeguards |
The fines and penalties imposed by the CNIL aim as much to educate as to punish, as a reminder that data protection is never negotiable. Often reported in the media, these measures have a lasting effect on the reputation of the business concerned.
The impact is not only financial: a report to the CNIL or media coverage of court proceedings undermines the trust of customers and partners. In some cases, criminal liability may be incurred: collecting data by fraudulent, unfair or unlawful means is punishable by five years’ imprisonment and a €300,000 fine (Article 226-18 of the French Criminal Code (Code pénal) (in French)), including in connection with buying a database.
Alternatives to buying email lists and good GDPR practice
To limit non-compliance risks, it is better to use alternatives to the outright purchase of a database. Several strategies exist to build a qualified file while respecting individuals’ rights and the data protection required by the CNIL.
Choosing a proactive and transparent approach builds a relationship of trust from the first contact, while sparing the business unnecessary inspections or disputes over the use of personal data.
- Running competitions or digital events that encourage voluntary sign-up.
- Including clear forms on websites and apps to obtain consent for each action (newsletters, offers, etc.).
- Adopting a double opt-in policy to confirm and prove the genuine consent of subscribers.
- Regularly updating the database to exclude contacts who have exercised their right to object.
- Consulting the CNIL’s recommendations when in doubt about the lawfulness of a transfer or the intended use.
Building an in-house prospect list is, in the long term, a much safer and more rewarding solution, including commercially. This method ensures control over compliance and prevents disputes over unlawful data processing.
You are also advised to keep a record of processing activities as provided for by Article 30 of the GDPR. This document makes it easier to justify each step before the supervisory authorities, which may request it.
Frequently asked questions on buying databases, the GDPR and the risks
How can you tell whether a purchased database complies with the GDPR?
To ensure GDPR compliance when buying a database, you must obtain proof of the consent given by each individual in the file, where that consent is required. You must also make sure that the seller provides all the mandatory information notices relating to the initial collection and processing. A prior audit should cover:
- The exact origin of the data and the date it was collected.
- The purpose for which each consent was obtained.
- The means in place to ensure that individuals can exercise their rights.
What are the main risks of buying a database unlawfully?
Acquiring a non-compliant file exposes you to various risks: administrative penalties imposed by the CNIL, high fines (up to €20 million or 4% of worldwide turnover), reputational damage and negative publicity. Here is a summary:
| Nature of the risk | Consequence |
|---|---|
| Failure to prove consent | Suspension/ban on use |
| Complaint filed by a data subject | Investigation and compensation for the victim |
| Failure to respect the right to object | Penalties and closer scrutiny |
Can a business buy a B2B database without breaching the GDPR?
The GDPR applies to both B2C and B2B activities, as long as the purchased file contains data that can identify a natural person (surname, first name, named business email address…). Buying a B2B database is therefore not exempt from regulatory constraints. You must inform each prospect of the processing of their data, allow them to exercise their rights (objection, access, rectification) and be able to show a legal basis (consent or a properly balanced legitimate interest). Neglecting these precautions exposes you to the same penalties and risks as in B2C, all the more so if the follow-up marketing targets the contacts concerned by name.
Official sources
- Regulation (EU) 2016/679 of 27 April 2016 (GDPR) – CNIL (in French)
- Article 83 of Regulation (EU) 2016/679 (GDPR), administrative fines – CNIL (in French)
Legal position verified on official websites as at 5 October 2026.
