THE SHORT ANSWER
Buying leads is lawful in the EU when the homeowner gave valid, informed consent to be contacted by a provider like you, the supplier can evidence that consent, and you meet your own information duties on first contact. The risk is rarely the purchase itself, it is buying leads whose consent record you cannot produce if asked. This is general information, not legal advice.
The four checks worth doing before you buy
Consent evidence. Can the supplier produce, per lead, what the person saw and agreed to, when, and from which page? A screenshot of a generic form is not a record.
Purpose scope. Did the wording cover being contacted by a company offering your service? Consent for a comparison site to make contact does not automatically cover onward sale to installers.
Roles in writing. Establish who is controller and who is processor, and make sure the contract says so. Both parties acting as independent controllers is common and needs to be stated.
Your own duties. On first contact you must be able to say where the data came from, and honour objection, access and erasure requests promptly.
The failure modes that cause actual complaints
Complaints almost never begin with a legal analysis. They begin with a homeowner who does not recognise why you are calling. That happens when the consent wording was vague, when the lead is old enough that the person has forgotten, or when the enquiry was for a different service.
Naming the source in your first sentence prevents most of it. Buying fresh, tightly scoped leads prevents the rest.
Practical hygiene that costs nothing
Say where the enquiry came from within the first two sentences of every first call
Keep the supplier's consent reference against the record in your CRM, not in an email thread
Honour a do-not-contact request immediately and suppress it permanently, not just in the current campaign
Delete leads you never worked rather than holding them indefinitely as a someday list
Questions to put to any supplier in writing
Can you provide the consent record for an individual lead on request?
What exact wording did the person agree to?
How old is a lead when it reaches me?
Are we joint controllers or independent controllers, and where does the contract say so?
A supplier who cannot answer all four quickly is transferring risk to you at a discount.
Related answers
Frequently asked questions
Can I call someone who filled in a form on another company's site?
Only if the consent they gave covered contact by a provider such as you, and only if the supplier can evidence it. Ask for the wording before you buy.
How old is too old for a bought lead?
Beyond a few days, both conversion and complaint risk move against you, because the person's recollection of consenting fades with their intent.
Do I need a DPA with my lead supplier?
You need the roles established in writing. Whether that is a processing agreement or a joint-controller arrangement depends on the setup, so have the contract state it explicitly.
Is this legal advice?
No. This is general information about the checks buyers commonly run. Your own counsel should review your contracts and consent flows.
NEED A CLEARER PLAN?
Let’s turn your next move into momentum.
Talk to us →