Sharing your customer list with another business for marketing is one of the riskiest things you can do with personal data. It requires a lawful basis, proper transparency with customers, and a careful fairness analysis. In practice, consent is often the only realistic basis, but the correct position depends on how the data will be used and which channel the marketing partner will use. Getting it wrong can lead to complaints and ICO fines of up to £17.5 million or 4% of global turnover. Here is the position in England and Wales.
Sharing personal data needs a lawful basis
Customer names, emails and phone numbers are personal data, so the UK GDPR applies whenever you share them. To share lawfully you need a lawful basis, and you must have been transparent with customers about it, your privacy notice should say who you share data with and why. Sharing data in a way customers were never told about breaches the transparency principle.
Why consent is usually needed for marketing
Two things push you towards needing consent:
- PECR. If the marketing partner will send unsolicited email or text marketing to individual subscribers among your customers, specific consent will generally be required under the Privacy and Electronic Communications Regulations 2003. Note that PECR rules differ by channel and by recipient type: the consent requirement does not apply in the same way to corporate subscribers, and other channels such as postal marketing and some telephone marketing operate under different rules. Crucially, the "soft opt-in" only helps the business that originally collected the details for its own similar products, it does not let you pass customers to a third party to market their own offers. So consent for third-party marketing usually has to be specific and named.
- Reasonable expectations. Even where you might consider "legitimate interests", customers do not generally expect their data to be handed to other companies for marketing, which makes that basis hard to rely on for this purpose.
In practice, to share your list so a partner can market to your customers, you typically need clear, specific consent that names (or clearly describes) the partner.
Get a data sharing agreement
Where you do share data lawfully, put a data sharing agreement in place setting out each party's responsibilities, the purpose, security measures, and what the partner can and cannot do with the data. This protects you and helps demonstrate accountability.
Practical checklist
- Check what you told customers when you collected their data, did you mention sharing for third-party marketing?
- For third-party marketing, obtain specific, named consent; don't rely on the soft opt-in.
- Be transparent in your privacy notice about data sharing.
- Use a data sharing agreement with the partner.
- Honour opt-outs and the right to object.
Key takeaways
- Sharing a customer list is processing personal data, you need a lawful basis and transparency (UK GDPR).
- For a partner to market to your customers, you usually need specific consent, the soft opt-in does not cover third-party marketing (PECR).
- Put a data sharing agreement in place.
- Penalties for getting it wrong reach £17.5m or 4% of global turnover.
Sources
- UK GDPR and Data Protection Act 2018 (lawful basis, transparency, accountability)
- Privacy and Electronic Communications (EC Directive) Regulations 2003 (consent for electronic marketing; limits of the soft opt-in)
- ICO guidance on data sharing and direct marketing
--- This article is general information about the law of England & Wales as at 2026, not legal advice. For advice on your circumstances, consult a qualified solicitor.