A prospect asks your outbound team a straightforward question: “Where did you get my details?”

The answer matters. So does what happens when that same person asks you not to contact them again.

When you appoint an outsourced sales provider, you are trusting them to represent your business before your own sales team has entered the conversation. The data they use, the people they approach and the way they handle objections all shape that first impression.

That is why the question I would ask is:

A good provider should be able to explain that clearly, with evidence behind the answer.

---

1 A database is only the starting point

It is easy to compare providers by the number of contacts they can access. Millions of records can sound reassuring, particularly when you are entering a new market or trying to reach a specialist audience.

But access tells you very little about whether those records will support your commercial goals.

Is the person still at the company? Do they have responsibility for the problem you solve? Does the business fit your target market? When were the details last checked?

For me, better data starts with a clear view of the accounts you want to engage and the people involved in buying. It then needs checking and maintaining as the programme develops.

Otherwise, your SDRs spend their time correcting records, navigating irrelevant contacts and having conversations that were unlikely to progress in the first place.

You should expect your provider to explain both where the data comes from and how they decide it is suitable for your programme.

---

2 “GDPR compliant” needs an explanation

A supplier describing its database as “GDPR compliant” does not, on its own, tell you whether your planned outreach is appropriate.

The source of the data is one consideration. How it will be used is another.

The ICO’s guidance on B2B marketing makes clear that UK GDPR still applies when business contact information identifies an individual. Publicly available personal information is also subject to these requirements. Finding someone’s details online does not remove the need for a lawful basis and transparency.

Where a provider relies on legitimate interests, ask how that decision has been assessed. The ICO describes a three-part test covering purpose, necessity and the balance between the organisation’s interests and the individual’s rights. Legitimate interests cannot replace consent where PECR requires it.

The useful answer is one that connects the requirements to your intended audience, channels and campaign.

---

3 The channel changes the checks

A contact record should not be treated as blanket permission to approach someone through every available channel.

For most UK live B2B marketing calls, numbers must be screened against both TPS and CTPS, alongside the organisation’s own do-not-call list. Registered numbers generally require specific consent to call.

For email, the rules distinguish between corporate subscribers and individual subscribers, including sole traders and some partnerships. Corporate B2B emails generally do not require consent under PECR, but identification, opt-out and applicable data protection requirements remain.

You can read more about these distinctions in the ICO’s B2B marketing guidance.

Ask your provider to show how those distinctions affect campaign preparation. Who carries out the checks? How are they kept current? What prevents an unsuitable record from entering a live sequence?

---

4 The real test comes when someone says stop

Imagine a prospect asks an SDR not to contact them again. The SDR records the request, but the contact remains in an email sequence. A week later, another message arrives under your brand.

To the prospect, this is one business failing to listen.

That is why I would ask a provider to demonstrate how an objection moves through its systems. Where is it recorded? Which activity stops? How does your own team receive the update? What prevents a later data import from adding the contact back into outreach?

Where someone objects to the use of their personal data for direct marketing, that use must stop. Keeping enough information on a suppression list helps ensure the objection remains respected. The ICO’s guidance explains these requirements.

---

5 Agree the responsibilities before launch

Outsourcing introduces more people, platforms and data flows. Buyers need a clear understanding of who is responsible for each part.

The ICO advises organisations working together on direct marketing to establish their responsibilities. Depending on the arrangement, both the business commissioning outreach and the provider carrying it out may have obligations under PECR.

Before activity begins, I would want to understand who can access campaign data, which tools receive it, how errors and complaints are escalated, and what happens to records when the engagement ends.

Those answers should be reflected in the working arrangements and relevant agreements.

---

6 Ask for a walkthrough

My advice is to choose one example contact and ask the provider to take you through the process:

• Where did the record originate, and when was it last checked?
• Why is this account and person relevant to the campaign?
• What checks support the proposed outreach?
• How will the person understand who is contacting them and how their data is being used?
• What happens across the programme if they object?

That walkthrough will tell you far more than the size of a database or a broad assurance in a proposal.

In my view, data quality and responsible handling belong in the same commercial conversation. Together, they help your team focus on relevant prospects, reduce avoidable friction and protect the relationships you are trying to build.

---