Purchased List Due Diligence Checklist

Before importing a purchased list, run a short, evidence-driven due-diligence routine that tests source provenance, lawful basis, notice to data subjects, data accuracy, and contractual protections. This checklist is an operational audit you can complete in one meeting with the seller and your legal or privacy owner; it identifies go/no-go signals and limited mitigations when issues are found.

Scope and decision boundary

Define exactly which records you will buy and import: count, fields (email, name, company, role, country, consent flags), and intended processing (marketing, sales outreach, profiling). The rest of this checklist applies only to that defined subset; do not treat a seller’s larger roster as automatically covered. State the stop condition up front: if provenance or lawful basis cannot be documented within 72 hours, treat the list as non-importable until resolved. This limits exposure and focuses follow-up.

Verify source provenance and chain of collection

Ask the seller for a written provenance statement that identifies original collectors (names, dates, collection method), and any intermediaries who aggregated or resold the records. Require at least one supporting artifact per claim (sample inbound form, API log excerpt, trade-show sign-up sheet scan) with redactions allowed for personal details. Decision boundary: provenance is adequate only when artifacts show direct collection from the data subject or from a known, documented third party. If the seller provides only high-level statements without artifacts, flag as insufficient and escalate for legal review.

Assess lawful basis and notice to data subjects

For each processing purpose you plan (marketing vs transactional), obtain the seller’s statement of lawful basis and examples of the notice provided to the data subject at collection (privacy notice text, checkbox labels, email opt-in confirmations). Where legal basis is consent, require proof of opt-in (timestamped consent record, IP address, or double opt-in confirmation). When relying on legitimate interests or contract, request the justification document used by the collector. Evidence limits: determinations about lawfulness require your privacy/legal team; this checklist documents evidence to support their decision and should not substitute for a legal opinion. The UK ICO guidance on transparency and notice is directional for these items 1.

Check accuracy, freshness, and suppression

Require the seller to provide the date each record was last verified and the method used (re-validation email, bounce handling, human confirmation). Set a freshness threshold appropriate to your outreach cadence (for example, 90 days for high-velocity email campaigns; shorter if targeting dynamic roles). Audit for suppression commitments: get a written warranty about honoring suppression lists (do not contact lists, global unsubscribe lists) and a copy of the seller’s suppression process. If the seller cannot demonstrate active suppression reconciliation, treat the list as higher risk and run additional pre-import validation.

Contract terms and risk allocation

Insist on a contract clause set that includes warranties about provenance and consent, indemnities for data protection breaches and regulatory fines, an audit right (at least sample-level access), and breach notification timelines. Also require SLA-level commitments for record accuracy and an explicit data return or deletion clause on request. Decision boundary: if the seller refuses indemnity or audit rights, either negotiate stronger operational mitigations (limited, heavily screened pilot) or decline the purchase. A partial contract without core warranties shifts unacceptable legal and reputational risk to you.

Operational pre-import checks and stop conditions

Before importing, run a sample verification: 1) a 200–500 record re-check against live sources (deliverability probes, public directory checks), 2) automated syntax and domain validation, and 3) suppression list intersection. Stop import if sample bounce rates or suppression hits exceed your pre-defined thresholds (example thresholds: >5% hard-bounce in probe, >1% on corporate suppression lists). Sequence: obtain contract and provenance artifacts → legal sign-off on lawful basis → run sample validation → import a limited segment (pilot) with monitoring → expand only if pilot meets quality and complaint thresholds.

Practical checklist

• Obtain a written provenance statement and at least one supporting artifact per collection claim.
• Get the exact fields and volume you will receive; exclude any fields you do not need.
• Collect the collector’s notice text and lawful-basis documentation; route to privacy/legal for sign-off.
• Require proof of consent where claimed (timestamped record or confirmation) or a documented legitimate-interest assessment.
• Secure contract warranties: provenance, lawful basis, accuracy, suppression handling, indemnity, and audit rights.
• Verify record freshness: require last-verified date and reject records older than your threshold.
• Run a 200–500 record sample re-check before import (syntax, domain, suppression, deliverability probe).
• Define and enforce stop thresholds for pilot (hard-bounce, spam complaints, suppression hits).
• Document remediation steps and deletion/return procedures in the contract.

Where RepMail fits

Use this checklist as a decision aid and gate in your outbound workflow: attach the completed provenance artifacts and contract summary to the import ticket, require privacy/legal sign-off, and make the sample-validation results a required field on any import task. This helps link sourcing due diligence to suppression and import QA and creates an auditable trail for later review.

Continue with Bounce Webhook Idempotency and Suppression State for the next step in the workflow.

Related RepMail guides

• List Import QA: Required Fields, Duplicates, and Suppression Checks
• List Sourcing Decision Tree: Build, Buy, Partner, or Reuse

Sources