Are data brokers legal in the UK? What they can do, and how to get out
Yes, data brokers are legal in the UK. No, that doesn't mean they can do what they like with your data. Here's what the law allows, who the brokers are, and how to get out.
- Data brokers operate legally under UK GDPR, the Data Protection Act 2018 and PECR, regulated by the ICO.
- They usually rely on "legitimate interests", which you can challenge by objecting. For direct marketing your objection is absolute.
- There's no central opt-out. You write to each one, or have an agent do it.
What the law requires of a data broker
| Requirement | What it means for you |
|---|---|
| A lawful basis | Usually legitimate interests, which must be balanced against your interests and fails once you object to marketing |
| Transparency | They must tell you they hold your data, normally within a month of getting it, unless that would involve disproportionate effort |
| Your rights | Access, objection, erasure and restriction, free of charge, answered within one month |
| Marketing rules (PECR) | Calls to TPS-registered numbers and unsolicited marketing emails and texts generally need consent |
The main types of UK data broker
| Type | What they hold | Typical source |
|---|---|---|
| People-search sites | Names, addresses, age ranges, co-occupants, sometimes phone numbers | Open electoral register, directories, company records |
| List brokers and data compilers | Consumer marketing lists, segments | Surveys, competitions, purchases, partner sharing |
| Credit reference agencies' marketing arms | Lifestyle and demographic profiles | Open register, other datasets |
| Lifestyle survey companies | Interests, income bands, habits | Questionnaires, often with prize draws |
| Ad-tech and data marketplaces | Online identifiers and audience segments | Websites and apps |
Ceaselist's coverage page lists every broker we write to and which ones only accept their own web forms.
When a data broker crosses the line
The ICO has acted against the industry. Its 2020 investigation found the credit reference agencies' marketing businesses traded and enriched people's data without their knowledge, and ordered changes (how to opt out of those). Common problems include not telling people their data is held, ignoring objections, and re-collecting data after deletion.
How to get out
- Opt out of the open register, the biggest shared source.
- Send each broker an erasure and objection request.
- Chase any that ignore you, and complain to the ICO.
- Repeat every few months, because brokers re-acquire data. Or compare removal services that do it for you.
Questions people ask
Are data brokers legal in the UK?
Yes, but they are regulated. They need a lawful basis to collect and sell your data (usually legitimate interests), must tell you they hold it, and must respect your rights to object, access and erasure under UK GDPR and the Data Protection Act 2018. Electronic marketing is also covered by PECR.
What is a data broker?
A company that collects personal information about people, often from public records, other companies and online activity, combines it, and sells or licenses it: for marketing, people-search, risk scoring or advertising.
Is there a list of data brokers in the UK?
There's no official register of data brokers. They fall into recognisable types: people-search sites, list brokers and data compilers, credit reference agencies' marketing businesses, lifestyle survey companies and ad-tech firms. Our coverage page lists the brokers Ceaselist writes to.
Can I opt out of data brokers in the UK?
Yes. You can object to their processing, which for direct marketing they must obey, and ask them to erase your data. They must reply within one month. There's no single opt-out for all of them, so each needs its own request.
Who regulates data brokers in the UK?
The Information Commissioner's Office. It has investigated and taken action against data brokers, including the credit reference agencies' marketing businesses.
Want this done for you? Ceaselist sends erasure requests to 668 data brokers as your authorised agent, chases the legal deadlines and prepares an ICO complaint when a broker ignores the law. £29 a year or £3.99 a month, full refund within 30 days.
Start with Ceaselist Free do-it-yourself packThis guide is general information, not legal advice. Prices and processes for other services were taken from their public websites and reviews in October 2026 and can change; check before you buy. Ceaselist is our own service, so we have an interest: we have tried to be fair, including about where we fall short.