How to build a lawful UK regional media list without a scraped database

What to take away

Why a scraped database fails the lawful basis test

A scraped database looks cheap until you try to defend it. Under UK GDPR you need a lawful basis before you process any personal data, and a list of journalist names, work emails and phone numbers is personal data.

The ICO's own UK GDPR guidance and resources set out the six lawful bases, and the Data Protection Act 2018 sits alongside the UK GDPR as the statute that gives it effect in the UK. None of the six bases fit a list assembled by a robot that never spoke to the person named.

Consent is the obvious candidate and the weakest. For consent to be valid it must be freely given, specific, informed and unambiguous. A journalist who published a work email in a byline did not consent to your agency's regional media campaign.

The ICO is clear that silence, pre-ticked boxes and inactivity do not count as consent, so a scraped list cannot rest on it.

Legitimate interests is the basis most PR teams actually rely on, and it can work. But it is not a free pass. You must run a three-part test: identify a legitimate interest, show the processing is necessary for it, and balance it against the individual's rights and expectations.

A scraped list usually fails the third limb because the journalist's expectation was a byline, not a bulk press release.

There is a second problem: accuracy. Scraped lists go stale within weeks. Journalists move between the BBC, ITV regional newsrooms and independent titles, and a dead address is still personal data. If you cannot show you keep the list up to date, you cannot show the processing is fair.

Data brokers make the position worse. The ICO has a dedicated warning for firms using the marketing services of data brokers, and it points out that buying a list does not transfer the seller's compliance to you. If you buy a media list, you inherit the risk.

Read the ICO's page on Organisations using marketing services of data brokers: what you need to know | ICO before you sign a contract.

ICO guidance on legitimate interests for media contact data

The ICO's A guide to lawful basis is the place to start, because it explains how to choose and document a basis rather than treating the choice as an afterthought. For media outreach, legitimate interests is normally the right basis, and the guide tells you what to write down.

Start with the purpose. You are contacting a named journalist because their beat covers your story, not because you bought a list. That purpose is specific and legitimate. A regional manufacturer announcing a factory expansion in the West Midlands has a real interest in reaching the business desks of the Birmingham Mail, the Express & Star and BBC West Midlands.

The necessity limb asks whether you need the personal data at all. A generic newsroom inbox may be enough for a first approach. If you can reach the right desk without a named individual's mobile number, you should. Collect less and you have less to defend.

The balancing limb is where scraped lists die. Ask what the journalist would reasonably expect. A reporter who lists a work email on a newsroom page expects press releases on their patch. They do not expect their address to be sold, reused for unrelated campaigns, or held for years after they leave the title.

Document the test before you send, not after a complaint. A short record with the purpose, the categories of data, the necessity reasoning and the balancing conclusion is enough. Keep it with the list so that anyone querying the campaign can see the thinking.

One practical rule: legitimate interests does not remove the right to object. If a journalist says stop, you stop, and you suppress the record rather than delete the evidence that they opted out. That single habit prevents most ICO complaints.

UK GDPR duties when building and using a regional media list

The UK GDPR duties that matter for media outreach are transparency, accuracy, storage limitation and security. They apply whether your list has fifty names or five thousand, and they apply to a sole trader in Cardiff as much as to a network agency in London.

Transparency means telling the journalist what you are doing. Your first email should identify your organisation, explain how you got their details and offer a simple opt-out. If you obtained the data from a directory or a colleague, say so. The ICO sets out the privacy information you must provide when data comes from a third party.

Accuracy means the list is a living record. Check bounce-backs, update job moves and remove anyone who has left journalism. A regional media list for Yorkshire and the Humber will change several times a year as reporters move between the Yorkshire Post, BBC Look North and local titles. HoldtheFrontPage, the trade site for regional and local journalism, reports those moves and title changes, so it is a named source you can check against before a record goes stale.

Storage limitation means a retention rule. Keep a contact while they cover the beat and for a short period afterwards, then delete. Set the review date when the record is created so the rule runs on its own, and do not keep a dormant list indefinitely because it might be useful one day.

Security means access control. A shared spreadsheet on a personal drive is not good enough. Limit who can export the list, log access, and avoid sending full contact data in a bulk email that exposes every address in the to field. Use the bcc field or a distribution tool that respects the same rules.

If a journalist asks where their data came from, you need an answer. That is why the provenance to deletion trail matters: record the source, the date added and the reason, then you can answer a subject access request without a scramble.

The rules split in two. The UK GDPR governs the personal data in the list; PECR, the Privacy and Electronic Communications Regulations, governs the electronic marketing you send to it. The ICO's direct marketing guidance explains how PECR treats business addresses such as news desks, including when consent is needed and when a message is allowed without it, so read it before your first send rather than after a complaint.

Regional press directories and News Media Association resources

Regional press directories are the lawful alternative to scraped data. They are published so that people can find the right newsroom, and using them keeps your source visible. Start with the publishers' own newsroom directories: the groups behind most local titles, Reach, Newsquest and National World among them, publish contact routes title by title on their own sites. The News Media Association represents national, regional and local publishers across the UK, and its website lists the member publishers behind the titles, which is where an ownership map starts.

Start with the publisher, not the person. Most regional groups list newsroom contacts, patch information and submission guidance on their own sites. A directory entry that names the news desk for a title in the North West is more reliable than a scraped personal address, and it is easier to justify.

Work region by region. England has distinct patches: Greater London, the North West, the West Midlands and Yorkshire and the Humber all have different lead titles and different newsroom structures. Scotland, Wales and Northern Ireland have their own national and regional outlets, and a list that only covers London and Manchester will miss the devolved nations entirely.

Use public service broadcasters alongside print. BBC regional newsrooms and ITV regional newsrooms publish contact routes for their patches, and Ofcom's licensing records confirm which services cover which area. That gives you a defensible map of who to contact.

Keep a source note for every entry. A directory page, a newsroom contact page or a publisher's submission guide is a source you can name. A scraped row is not. If you want a wider distribution plan, see how to build a UK press release distribution media list using the same source-first method.

Trade bodies help with context. The CIPR and the PRCA publish codes and guidance that sit alongside data protection rules, and the News Media Association resources show which publishers own which titles. That ownership map stops you duplicating the same newsroom under three different mastheads.

Individual rights and the data protection fee

Journalists have rights over the data you hold, and the ICO's A guide to individual rights | ICO explains what they can ask for. The ones you will meet most often are the right of access, the right to rectification, the right to erasure and the right to object.

A subject access request can arrive by email and does not need a special form. You have one month to respond, and you must provide the data you hold plus the purpose and the source. If your list has a clear source column, this is a short job.

Rectification is common when a journalist changes title. Update the record and tell anyone you shared it with, if any. Erasure is less common but real: if there is no lawful reason to keep the data, delete it. Objection is the one that stops marketing, and you must act on it without delay.

There is also a fee. If you process personal data for marketing, you are likely to be liable for the ICO's data protection fee unless an exemption applies. The ICO publishes its exemption rules and the tiers behind the fee, and it keeps a register of fee payers, so you can check whether you are liable and whether a supplier has paid before you rely on their list.

The ICO's Direct marketing checklist | ICO is worth running before any campaign. It covers consent and legitimate interests, the right to object, screening against opt-out lists and the records you should keep. Work through it once and your media outreach process becomes repeatable.

Keep the paper trail short but complete. A one-page record per campaign, listing the lawful basis, the source of the data, the retention period and the opt-out route, is enough for most queries and takes minutes to produce.

A lawful list-building checklist for media outreach

Use this checklist before you send anything. It assumes legitimate interests as your basis and a regional focus across England, Scotland, Wales and Northern Ireland.

Here is how the pieces fit together for a typical campaign, step by step, with the evidence to keep alongside the list.

For a worked example, take a Welsh renewable energy firm. It wants coverage in Wales and the South West of England. It builds a list from publisher directories covering WalesOnline, the Western Mail and BBC Wales, plus ITV Cymru Wales. Each entry records the newsroom contact page it came from, the date it was added and the reason it belongs on the list.

The legitimate interests assessment records the purpose, the necessity of contacting those desks and the balancing view that the desks expect energy stories. The first email explains the source and offers an opt-out. Two journalists decline, and both are suppressed the same day.

At the end of the campaign the list is reviewed and the entries with no engagement are deleted.

That process is slower than buying a list. It is also defensible, and it produces better coverage because the contacts are current. If you are mapping who to contact beyond the media, the five target audiences to map before you send will keep the list focused.

And if you are unsure how the rules apply to your campaign, these six questions on UK regulations cover the common sticking points.

Common questions