There is an industry in the UK that holds a detailed file on almost every adult in the country. It knows where you live, where you lived before, roughly how old you are, who you are related to and often what you earn. It sells that file to whoever pays.
You have almost certainly never heard of most of the companies involved. You have never agreed to be on their systems. And what they are doing is, for the most part, entirely legal.
This guide explains how that came to be — and what you can actually do about it.
A data broker is a company whose product is information about people. They do not have a relationship with you. You are not their customer — you are their inventory.
The distinction that matters is between companies you gave your data to and companies that simply collected it. Your bank is not a data broker: you have a relationship with them and a reason to be on their systems. A data broker assembled a profile on you from sources you never thought of as public, and now sells access to it.
The most visible type. Enter a name and they return addresses, ages, relatives and phone numbers. They make money through subscriptions and from selling "full reports". These are the sites most likely to be surfacing your home address to a stranger right now.
Less visible, often more detailed. They compile lists for direct marketing — segmented by age, income bracket, homeowner status, sometimes health interests. If you receive post addressed to you personally from companies you have never dealt with, a list broker sold your details.
The three main UK credit reference agencies hold extensive financial and address records. They have a legitimate and regulated role in lending decisions — but several also operate marketing divisions using related data. These are governed by their own statutory framework and have dedicated opt-out routes separate from a standard GDPR request.
They compile professional contact details, usually scraped from LinkedIn, company sites and email patterns, and sell them to sales teams. If you have ever wondered how a cold caller got your direct work number, this is generally the answer.
Almost none of it is stolen. That is what makes this difficult to fight — the collection itself is usually lawful.
Most buyers are mundane — marketing agencies, debt tracing firms, background screening companies, insurers, journalists and researchers. Some uses are genuinely legitimate.
But the same profile that helps a marketing agency also helps someone else entirely. A fraudster who knows your name, your address and the names of your relatives can construct an approach that sounds convincing. That is why a scam call so often opens with details you assume only a real bank would know.
UK Finance put fraud losses at £2.3 billion last year. Action Fraud receives over 870,000 reports annually. Not all of that traces back to data brokers — but the industry makes targeting dramatically easier and cheaper than it would otherwise be.
UK GDPR gives you rights that most people never exercise:
| Right | Article | What it means |
|---|---|---|
| Erasure | 17 | Demand deletion of your data. One calendar month to respond. |
| Access | 15 | Demand a copy of everything they hold on you. |
| Object to marketing | 21(2) | Absolute right. They cannot refuse. |
| Rectification | 16 | Correct information that is wrong. |
| Complain to the ICO | 77 | Escalate if they ignore you. |
Brokers commonly rely on "legitimate interests" as their lawful basis for processing. That basis requires balancing their commercial interest against your rights and reasonable expectations — and when you actively object, that balance shifts considerably in your favour.
This is the part the industry rarely explains and some competitors gloss over.
Removal works. Then the broker re-runs its collection process against the same public registers, finds you again, and relists you. Typically within three to six months.
You have not been ignored — the deletion was genuine. But nothing stopped them collecting the same lawfully-available data a second time. Unless you also address the underlying sources, particularly the open electoral register, you are draining a bath with the tap running.
Which means effective privacy protection is two things: cutting off the sources you can control, and repeating removals on the ones you cannot.
Everything above, plus the scam types currently targeting UK residents
📄 Download Free GuideYou cannot disappear. Some records are public by law and no service can change that, whatever they claim in their advertising.
What you can do is make yourself substantially harder to find and target. Cut off the sources you control, exercise the rights you already have, and keep doing it. That is unglamorous, but it is what actually works.
Every one of these steps is available to you free. We publish the guides because we would rather people were protected than profitable. If you would prefer not to spend forty hours a year on it, that is what we exist for — but the choice should be an informed one.
Free tools, no account needed