How long you can keep a prospect's data under UK GDPR

How long can you keep a prospect's data under UK GDPR? The honest answer disappoints people: the regulation does not give a number. There is no rule that says six months, or two years, or until they reply. What it gives you is a principle, and your job is to turn that principle into a period you can explain if anyone asks. This is general guidance for small agencies and freelancers, not legal advice, and the ICO's own website is the place to check anything that matters to your situation.

The principle: no longer than you need it

UK GDPR has a storage limitation principle. Personal data should be kept in a form that identifies someone only for as long as you need it for the purpose you collected it for. A prospect list is built for one purpose, which is deciding whether to contact a business about your services and then, if they respond, talking to them. Once that purpose has run its course, the reason to hold the details runs out with it.

Two things follow. You need to know what the purpose is, and you need to decide when it has ended. Most small senders skip both, which is how a spreadsheet from three years ago ends up still sitting in a shared drive.

What counts as a prospect's personal data

It is easy to assume a business list is not personal data. Often it is. An email address like sarah@harbourbakery.co.uk names a person. A sole trader running a plumbing business in Carlisle is, in practice, the same individual as the business. The name of the owner, a direct email address and a mobile number all count. A generic info@ address for a limited company is less clear cut, but the moment your notes mention the person behind it, you are holding personal data.

Your own notes count too. “Spoke to the owner, sounded rushed, call back in spring” is personal data about an identifiable person, and it is the kind of detail people are most surprised to find in a record when they ask what you hold on them.

Setting a period you can defend

Because there is no official figure, the standard to aim for is reasonable and written down. A workable approach is to give each stage of your pipeline its own clock.

• Found but never contacted. If you researched a business and decided not to email, there is little reason to keep their personal details beyond the point you decided. Keep the fact that you looked if it stops you duplicating work, but not the person's contact data.
• Contacted, no reply. A follow-up sequence has a natural end. Pick a window after your last message, say a few months, after which the record is deleted or stripped back unless something changes.
• Replied and in conversation. While there is a live discussion, you have an obvious need for the data. Review it when the conversation goes quiet.
• Became a client. This is a different relationship with different reasons to keep records, including invoices and contracts, and those have their own retention needs. Do not let it inherit the prospect clock by accident.

The exact windows are your call. What matters is that you chose them for a reason, such as how long a follow-up sequence realistically runs and how often you revisit a quiet lead, rather than keeping everything because deleting felt risky.

The one record you should keep

Deleting is not always the safe move. If someone has asked you to stop emailing them, you need to keep enough to honour that, usually just their email address on a suppression list. Deleting that entry along with everything else is how a person who opted out ends up emailed again six months later. We cover how to build one in unsubscribe and suppression lists for cold email in the UK. Keep that list minimal, and treat it as the deliberate exception to your deletion routine.

Making it happen without a project

A policy that depends on remembering to tidy up will not survive a busy month. Make it a calendar habit instead.

1. Write your retention windows in one short document, with a sentence on why each is the length it is.
2. Put a recurring monthly reminder in your diary to clear out records past their date.
3. Keep prospect data in as few places as possible. Every extra spreadsheet, export and inbox folder is another copy to remember.
4. Be ready to answer a request. If someone asks what you hold or asks you to erase it, you have a month to respond, and it is far easier when the data lives in one place.

If you are building outreach lists from scratch, the habits in building a list of local businesses worth emailing pair well with this, because a list built with a clear purpose is easier to retire. And the rules on whether you can email a given business at all are covered in is PECR cold email legal in the UK.

Where a system helps and where it does not

A tool cannot decide your retention period for you, and nobody should claim otherwise. What it can do is keep the information in one place so that your monthly clear-out is a five-minute job rather than a hunt. Patchscout keeps each prospect's audit, outreach drafts and pipeline stage together on one board, so you can see at a glance which leads have gone quiet and are due a review. The decision about how long to hold them remains yours.

If you want to see how that looks in practice, every new account gets three free searches with no credit card, and you can start at app.patchscout.co.uk. Either way, write your windows down this week. A short, honest policy you follow beats a perfect one you never get round to.