Reviewing a contract before you buy a business's customer list

A customer list is bought for the right to sell to the people on it, and the law decides whether that right comes with the list. Personal data can be transferred from one business to another, but the buyer needs its own lawful basis to use it, the seller's marketing consents do not transfer, and the individuals must be told. The agreement decides what the seller warrants about the list and when the price is paid. I review the agreement from the buyer's side and return it marked up with a written explanation of what the buyer can lawfully do with the list and the terms worth asking to change, for a fixed fee of £495 in three working days.

Who this is for

Businesses in England and Wales buying a customer list, a subscriber database, a mailing list or the customer records of a closing or retiring business, whether on their own or as part of buying the goodwill, and want to know what they can do with the data and what they are paying for. The buyer and the seller are businesses; the customers on the list are individuals with rights under data protection law.

What to look for in a customer list purchase agreement

Whether the seller can transfer the data and the buyer can use it

The seller is a controller of the customer data and can disclose it to the buyer only where it has a lawful basis under Article 6 of the UK GDPR and the Data Protection Act 2018 and the disclosure is compatible with what the customers were told when their data was collected. The buyer then needs its own lawful basis for its own use. The review checks the seller's privacy information, asks for a warranty that the customers were told their data might be transferred to a successor business, and identifies the uses the buyer can lawfully make of the list and the uses it cannot.

Marketing consents do not transfer

The seller's customers may have consented to marketing from the seller, but consent under regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 is consent to marketing from the named sender and does not carry over to the buyer, and the soft opt-in applies only to a business's own customers. The review checks what consents the seller holds and in whose name, asks for the consent records to be delivered with the list, and sets out how the buyer can lawfully contact the customers: as the successor to the seller's business where the transfer is of the business and the customers are told, or by a fresh permission campaign where it is not.

What you must tell the customers, and when

A buyer that obtains personal data from a third party must give the individuals privacy information under Article 14 of the UK GDPR within a month of obtaining it, at the first communication with them, or when the data is first disclosed to another recipient, unless an exemption applies. The review asks for the seller to notify its customers of the transfer before completion, or for the buyer's first communication to be a notice rather than a sales message, and checks that the agreement allocates responsibility for the notification and its cost.

Warranties about the list: ownership, accuracy and completeness

The seller's agreement will sell the list as seen, and the buyer needs warranties: that the seller owns the list and any database right in it under the Copyright and Rights in Databases Regulations 1997, that the data was collected lawfully, that it is accurate and current to a stated date, that the list contains the number of records represented and no records the seller is not entitled to transfer, and that no customer has objected to marketing. The review asks for the price to be adjusted for records that bounce, duplicate or are found to be unusable within a period, and for a retention of part of the price against the warranties.

The seller's non-compete and the goodwill you are buying

A list is worth little if the seller keeps selling to the people on it. The review asks for a non-compete and non-solicitation covenant from the seller and its principals, limited to the customers on the list and the seller's products for a period a court will enforce, for the seller to cease marketing to the customers on completion, and for the seller's obligations under section 2 of the Misrepresentation Act 1967 for the statements it made about the list's value to be preserved rather than excluded by an entire agreement clause.

Delivery, format, price and the seller's own liability

The agreement should set the format of delivery, the fields included, the delivery date and the seller's obligation to delete its own copy or to keep it only for its legal obligations. The review checks the price, the payment timing and the Late Payment of Commercial Debts (Interest) Act 1998 position, and asks for an indemnity from the seller for claims by customers or the ICO arising from the seller's collection of the data, so that the buyer does not inherit the seller's compliance failures with the list.

What it costs

Standard review, £495. Marked-up document and a written explanation of the changes. Three working days.

Buying online forms the engagement on payment. The scope is what the contract review page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• Your own contract returned with my amendments as tracked changes, plus a clean version with every change accepted, ready to send to the other side
• Comments in the document where a point needs explaining
• A written explanation of what I have changed and why, by email or as an attachment if it is lengthy, marking the points I would hold firm on and the ones that are negotiable
• A view on what is normal market practice and what is the other side pushing their luck
• One round of follow-up questions by email, included

What is not included

• Negotiating directly with the other side, which I quote separately once I know who is on the other side. Where the other side is willing to share a live document, I can work in that document directly
• Drafting a replacement contract from scratch
• Advice on the law of any jurisdiction other than England and Wales
• Tax, accounting or regulatory advice
• Disputes about a contract that is already signed

Questions I am often asked

Can we email the customers on the list once we have bought it?

Only where you have your own lawful basis and either a consent that names you or the soft opt-in as the successor to the business they bought from, and only after they have been told about the transfer. The review sets out what the seller's consents cover and the route to contacting the customers lawfully.

The seller says the list has a stated number of active customers. What if it does not?

Only a warranty makes that enforceable, and sellers' agreements warrant nothing. The review asks for warranties of record count, currency and accuracy, a price adjustment for records that fail within a period, and a retention against the warranties.

Do we have to tell the customers we have bought their details?

You do, within a month of obtaining the data or at your first communication with them, unless an exemption applies. The review asks for the seller to notify them before completion or for your first contact to be a notice, and allocates the cost.

Related guidance and services

• Contract review, £495, the service this page describes
• Data protection agreements and privacy terms, £795
• Reviewing a data licence agreement
• Reviewing heads of terms before a deal

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: September 2026. Email geoffrey@caesar.co.uk.