How do data brokers get your personal information?

If you have ever wondered how a company you have never heard of came to hold your name, your address, and your phone number, the answer usually starts with a register you did not know you were on. UK data brokers draw from a surprisingly small set of sources — but the cascading effect of those sources is what makes the problem difficult to solve on your own.

The edited electoral register

Every household in the UK receives an annual canvass form asking residents to update their details for the electoral register. What most people do not know is that there are two versions of that register: the “full” register, which only political parties, election candidates, and certain public bodies can access, and the “edited” register, which is sold commercially to anyone who wants to buy it.

You are automatically included in the edited register unless you opt out. The opt-out box is on the canvass form, but it is easy to miss — and local councils are not required to make it prominent. Data brokers purchase the edited register from local councils and use it as a foundational address and identity dataset. This is the single largest source of consumer data in the UK.

Companies House

If you have ever been a company director, a person with significant control (PSC), or a registered member of an LLP, your details appear in the Companies House public register. This includes your date of birth (partial), your nationality, your correspondence address, and — until 2024 reforms — often your residential address.

Data brokers harvest this data routinely. If you have been a director at any point, even for a dormant company or a community interest organisation, that record exists and is cross-referenced against everything else they hold. There is a process to suppress your residential address from Companies House, but most people do not know about it.

Credit reference agency marketing databases

Experian, Equifax, and TransUnion are primarily known as credit reference agencies — but each runs a parallel marketing database business that is distinct from their credit reporting function. These marketing databases are populated from a range of sources including the edited electoral register, county court judgments (CCJs), insolvency records, and data licensed from third parties.

When you apply for credit, open a bank account, or sign up for a utility, the lender or provider typically shares some of that data with the CRA. Not all of it — but enough to keep their marketing profile on you current. Experian's marketing arm (Experian Marketing Services) is one of the data brokers DataDelete covers precisely because of how widely that profile is licensed to other organisations.

Loyalty cards and transactional data

Every time you use a supermarket loyalty card or a retail app, you are providing transactional data — what you buy, when, and at which locations. Retailers sometimes license this data to data brokers or their analytics subsidiaries. The resulting segments (inferred income band, household composition, purchase behaviour) become part of the profile brokers sell to direct marketers.

This data is typically handled under broad consent clauses buried in loyalty scheme terms and conditions. You almost certainly agreed to them. You also have the right to object to your data being used for direct marketing, regardless of how it was collected.

Broker-to-broker data sales

This is the mechanism that makes the problem self-reinforcing. Data brokers do not just collect from primary sources — they buy from each other. If Broker A holds a record about you and Broker B does not, Broker B can simply purchase a list that includes your record. You opt out of Broker A. Broker B, who bought your data two years ago, still has it. And Broker C, who bought it from Broker B last month, has never heard of your opt-out.

This is why removing yourself from one broker does not remove you from others, and why re-listing is such a persistent problem. The same underlying record keeps circulating through the ecosystem. Addressing it properly requires simultaneous opt-outs across all brokers in the chain.

Public records

Beyond Companies House, a number of public records contribute to broker datasets. CCJ and insolvency records are published via the Insolvency Service and the Registry Trust. Property ownership records appear in Land Registry title data. Planning applications are published by local councils. Probate records are publicly searchable.

Each of these has a legitimate public interest rationale. But individually they provide pieces of a profile that, when aggregated, can reveal far more than any single record would suggest. The act of aggregation is where the privacy problem sits — and it is why the UK GDPR's right to erasure extends to aggregated marketing profiles, not just to the original source records.

What you can do

The breadth of sources is what makes manual opt-outs so time-consuming. Each broker requires a separate erasure request. Most provide web forms or email addresses for this purpose, but the process differs for every one. The 30-day GDPR response clock runs from the moment each individual request is submitted.

DataDelete covers 23 of the most significant UK data brokers — including 192.com, Experian Marketing Services, Acxiom, Royal Mail Door-to-Door, and the electoral register in your local authority area. We submit the requests, monitor the deadlines, and escalate to the ICO if any broker does not comply. We also run re-checks every 60 days to catch re-listing from broker-to-broker resales.