Building a Compliant Investor List from Scratch

How do you build a property investor list lawfully? On permission, not purchased data — by publishing useful content, letting investors opt in, and keeping clean records of consent and preferences. A list built that way is one you can actually use; a list scraped or bought is a liability that breaches both UK GDPR and PECR the moment you email it. This guide sets out the compliant route: inbound versus outreach, the lawful basis you need, the PECR rules for business and consumer contact, ICO registration, how to qualify investors without straying into regulated advice, the records to keep, and how to nurture a list toward a waitlist.

This is general information, not financial, legal or tax advice — seek independent professional advice.

Inbound vs outreach: which builds a usable list

There are two engines for building a list, and a compliance-led firm leans on them in a particular order.

UK GDPR: getting your lawful basis right

Before you process anyone's personal data, you need a lawful basis under UK GDPR. For an investor list, two bases come up most often.

• Consent. The cleanest basis for marketing — the individual has actively, freely agreed. For most electronic marketing to individuals, PECR effectively requires it anyway.
• Legitimate interests. Can apply to some business-to-business processing, but it is not a free pass: you must weigh your interest against the individual's rights and document the reasoning in a legitimate interests assessment.

Whichever you rely on, record it, give people a clear privacy notice explaining what you do with their data, and honour their rights — access, correction, objection and erasure. The lawful basis is not paperwork for its own sake; it is what makes everything downstream defensible. Take advice on which basis fits your specific model.

A practical trap worth naming: the lawful basis you choose for processing the data is not the same question as whether PECR lets you send a marketing message. You can have a perfectly valid basis to hold a contact's details and still be barred from emailing them marketing without consent. The two regimes stack, and you have to satisfy both. Treat the lawful basis as the foundation and PECR as the rule that governs the actual sending — get them confused and you can end up technically holding data lawfully while marketing to it unlawfully.

PECR rules for B2B and consumer marketing

The distinction matters because it changes what you can lawfully do:

• Individuals (B2C and sole traders/partnerships): you generally need prior consent for electronic marketing, with only a limited "soft opt-in" available for existing customers in narrow circumstances.
• Corporate bodies (limited companies, LLPs): unsolicited B2B email is treated more permissively, but you must still identify yourself, provide an opt-out, and respect UK GDPR wherever the data identifies a living individual (for example a named person at a company).
• Always: identify who you are, say how to opt out, and act on opt-outs promptly. SMS and live/automated calls have their own rules and screening obligations.

The safe operating posture is to treat individuals as requiring consent, treat corporate contacts carefully, and offer a frictionless opt-out everywhere. When the analysis is finely balanced, do less and take advice.

ICO registration and the data protection fee

Most organisations that process personal data for business purposes must pay the data protection fee and register with the Information Commissioner's Office, unless a specific exemption applies. Building and marketing to an investor database is exactly the kind of processing that brings you within scope.

• Check your position using the ICO's self-assessment before you start processing at scale.
• Registration is inexpensive relative to the risk and penalties of failing to register.
• Keep your registration current and your privacy documentation aligned with what you actually do.

Qualifying investors without giving regulated advice

This is the part where good intentions can drift into regulated territory. Qualifying an investor means understanding fit; it does not mean advising them on what to do with their money.

• Gather factual information: stated risk appetite, available funds, timelines and objectives — through straightforward questions.
• Assess fit, not merits: whether a future opportunity might match their stated criteria, not whether they should invest.
• Do not advise on the investment, and never promise or imply a yield, return or profit.
• Do not operate an unauthorised collective investment scheme. Pooling investor money into a common enterprise can engage strict rules — keep well clear and take advice if your model goes anywhere near it.

The line between information and advice is one for professional advice on your specific facts. The conservative default — gather facts, assess fit, make no recommendations, promise nothing — keeps a sourcer on the right side of it.

It also helps to be deliberate about language. The moment your wording shifts from describing a property and its facts to telling an investor that something is "a great opportunity" or projecting what they might make, you have moved from information toward advice and promotion. A compliance-led sourcer trains itself to describe rather than recommend, to present rather than persuade, and to leave the investment decision firmly with the investor and their own advisers. That discipline is not just about staying inside the rules — it is what a serious investor expects from a firm that takes its obligations seriously.

CRM, record-keeping and nurturing to a waitlist

A compliant list is only as good as the records behind it. The CRM is where compliance and commercial value meet.

What the CRM should record

• Source: where each contact came from and how they joined.
• Lawful basis and consent: which basis you rely on, plus the date and source of any consent.
• Preferences: what they agreed to receive, and on which channels.
• Opt-outs: recorded and acted on promptly, never overwritten.
• Retention: data kept only as long as needed, with a clear deletion process.

Nurturing honestly toward a waitlist

Nurturing is about being useful over time, not about pressure. Send genuinely helpful material, keep frequency reasonable, and let interested investors progress to a waitlist at their own pace. There is no place for urgency theatre, manufactured scarcity or return promises — those tactics damage trust and can stray into misleading-practice territory. A waitlist built on honest communication is a list that converts when the time is right, and that withstands scrutiny.

Who's behind L&M

Notes and sources cited in this guide

Frequently asked questions about building an investor list