Does Third-Party Lead Data Comply with KVKK? Risks of Purchased Customer Lists

Updated: 3 September 2026 · Category: Advertising, Targeting and CRM Compliance

Does Third-Party Lead Data Comply with KVKK? Risks of Purchased Customer Lists

For a purchased lead list, the key question is not simply whether data is available. It is what legal basis supported its collection, for which purposes it may be transferred, what the privacy notice says and whether its use complies with the rules on commercial electronic communications.

Contents

Short answer
Why does it matter?
What should companies do?
How should it be measured?
Sources
Frequently asked questions

Short Answer

Receiving a purchased or third-party lead list does not automatically make use of the personal data on that list compliant with KVKK. The recipient company must separately assess the legal basis for its own processing purpose, the source of the data, the transfer chain and the information that must be provided to the individuals concerned. If the data will be used for marketing by SMS, email or phone, the rules on commercial electronic communications and the İYS status must also be checked separately.

Why Does It Matter?

The most common mistake when buying leads is treating the supplier’s “KVKK compliant” statement as sufficient evidence. Whether a dataset can be commercially purchased and whether its personal data can be processed by a new controller for a specific marketing purpose are separate legal questions.

First examine how the data was collected, its original purpose, whether a valid legal basis supports the transfer and whether your intended use is compatible with this chain. The supplier contract is part of this review but does not itself establish a legal basis for processing.

What Does Decision 2026/1183 Show?

KVKK Decision No. 2026/1183 of 10 June 2026 does not directly concern a customer list purchased from a data broker. It examined a savings financing company that obtained third parties’ phone numbers from its customers through a “brand ambassador” programme and contacted those individuals for marketing.

The Board did not accept continuing the marketing conversation during the call made after a third party supplied the individual’s number as valid explicit consent. It stressed that consent must be specific, informed and freely given. It imposed an administrative fine of TRY 1,000,000 on the controller for processing data without a valid legal basis.

This matters for purchased lead lists because giving a number to a third party, answering a call, listening to a campaign or a supplier’s claim of permission does not, on its own, establish a valid legal basis for the recipient company’s processing.

KVKK Permission and Consent to Commercial Messages Are Different

The right to process a phone number under KVKK and the right to send marketing SMS or emails or make commercial calls are separate control layers. A legal basis for personal data processing does not automatically remove consent requirements under the commercial electronic communications rules.

Likewise, a communication channel showing consent in İYS does not by itself answer every question about the original data source or the legal basis under KVKK. CRM and İYS records should be assessed together, but for separate legal purposes.

What Should Companies Do? 10 Steps for Accepting Third-Party Leads

Identify the source company. Record the identity of the individual or legal entity sending the list and their role in the data chain.
Request the collection method. Document whether collection occurred through a web form, event, referral, campaign, data broker or another process.
Establish the original collection purpose. Identify the service or purpose for which the data was originally obtained.
Examine the transfer basis. Check which legal basis is relied on to transfer the data to another company for marketing.
Determine your own processing basis. Assess the recipient’s intended activity separately instead of copying the supplier’s legal basis.
Plan when to provide privacy information. If the data was not obtained directly from the individual, integrate the applicable rules on indirect collection into the process.
Verify commercial communication status. Check İYS and consent/opt-out status for SMS, email and telephone channels.
Run suppression checks. Before upload, exclude people who previously opted out or appear on the internal do-not-contact list.
Obtain only the minimum data. Do not import age, address, occupation or other fields unnecessary for the campaign into CRM just because they are “on the list”.
Quarantine the list if evidence is missing. Do not release the list to sales teams or campaign systems until the source and right of use are verified.

What Evidence Should Vendor Due Diligence Request?

Rather than just a “KVKK compliant” assurance, request an example of the collection interface or process, the privacy notice version used, any explicit consent text, the transfer scope, collection date and management of opt-out records. These documents need not be identical for every record; lists combining different sources can retain them by source batch.

Contractual guarantees about data sources, notification duties for unlawfully supplied data, deletion/recall procedures and audit rights provide operational safeguards. A contract does not, however, make an unlawfully collected dataset lawful.

Build a List Acceptance/Rejection Matrix

Instead of managing lead files only as “accepted” or “rejected”, classify them as low, medium or high risk. A dataset with complete source evidence and a limited purpose may be admitted under controls, while an old file with unclear provenance, excessive fields or no permission evidence may be quarantined.

Proposed Measurement Model for B10

Control Area	KPI	Risk Signal
Source	Verified lead-source rate	Record with an unknown source
Evidence	Evidence-complete batch rate	Undocumented dataset
Legal basis	Legal-basis review coverage	Generic “KVKK permitted” label
İYS	Channel consent verification	Campaign not covered by consent
Opt-out	Suppression match rate	Contacting someone who opted out
Age	Stale lead ratio	Old list with uncertain currency
Supplier	Supplier evidence score	One-sentence compliance assurance

This model measures how far the right to use data can be verified, rather than list size. Poor evidence coverage for a large list can create compliance risk that outweighs its commercial value.

Expert Assessment

The central question in third-party lead operations should be: “At which stage of this processing chain was the individual informed of which purpose, and on what legal basis is the company processing the data today?” rather than just “Who sold the data?”

Particularly in referral and recommendation programmes, a referral by a friend or an existing customer does not automatically authorise contacting the data subject for marketing. Decision No. 2026/1183 illustrates this distinction through a current, concrete example.

The safest architecture for purchased lists first places the file in a compliance staging area. Only suitable records move to the active sales pool after the source, evidence, legal basis and communication permissions are verified, rather than importing the file directly into CRM.

Digital Risk and Compliance Analysis

B10 can create a Third-Party Lead Risk Audit that scores files by source, collection method, transfer chain, legal basis, İYS/consent status and suppression records, separating high-risk batches before they reach sales teams.