Updated August 2026. Purchased contact data should not be uploaded and sent at maximum volume without preparation. First verify that your planned use is permitted, inspect and validate the file, remove duplicates and suppressed contacts, segment the audience, configure sender authentication and begin with controlled volumes.

Before importing the file

Confirm that the audience matches the offer

Remove countries, industries or contact types that your business cannot serve. Relevance protects budget and sender reputation because fewer messages are sent to people who are unlikely to need the offer.

Inspect the columns

Open a small portion of the file and identify the available fields. Map only the fields needed by your CRM or campaign. Do not assume that every database follows the same column order.

Remove duplicates and suppressions

Deduplicate by normalised email address. Then remove previous opt-outs, complaints, hard bounces, customers who should not receive the campaign and any internal addresses used for testing.

Validate addresses appropriately

Contact data changes over time. An email validation process can identify malformed and clearly undeliverable addresses before sending. Validation does not establish consent or a lawful basis; it only helps with technical list hygiene.

Check legal and platform requirements

Rules depend on where the sender and recipients are located, whether recipients are individuals or corporate subscribers, and the nature of the message. Obtain professional advice when needed.

• United States: the FTC states that CAN-SPAM covers commercial email, including B2B email. It requires accurate sender information, non-deceptive subject lines, a valid postal address, a clear opt-out method and prompt handling of opt-out requests.
• United Kingdom: the ICO explains that PECR and data-protection law apply to electronic direct marketing. Rules can differ between individual and corporate subscribers, and bought-in lists require careful due diligence.
• Sending platforms: an email service can impose stricter permission standards than local law. Review the platform’s acceptable-use and list policies before import.

Useful official references:

• FTC CAN-SPAM compliance guide
• ICO direct marketing checklist
• ICO guidance on planning direct marketing

Protect sender reputation

Use a properly configured sending domain

Set up SPF, DKIM and DMARC for the domain used to send. Keep the visible sender identity and reply path accurate. Authentication does not guarantee inbox placement, but missing or broken authentication is an avoidable risk.

Start with controlled volumes

A sudden volume increase can damage reputation. Begin with a well-matched segment, monitor delivery and complaints, and expand only when the technical and commercial signals justify it.

Make the message relevant and honest

State who you are, why the offer may be relevant and what action you want the recipient to take. Avoid misleading subject lines, false urgency and claims that cannot be supported.

Provide a working opt-out

Make unsubscribe instructions clear and process requests promptly. Maintain a central suppression list so that opted-out contacts are not reintroduced from a later file.

Measure the right signals

Open tracking is imperfect because privacy tools can block or pre-load tracking pixels. Focus on a combination of delivery, hard bounces, complaints, replies, qualified visits, checkout activity and purchases.

Stop or change a segment if it produces poor delivery or irrelevant responses. Continuing to send simply because a large file is available can reduce future performance.

Responsible campaign checklist

• The audience and geography match the offer.
• The planned use is permitted by applicable law and platform rules.
• Duplicates, opt-outs, complaints and hard bounces are suppressed.
• Sender identity, SPF, DKIM, DMARC and reply handling are configured.
• The subject and message are accurate and relevant.
• A clear opt-out method is present and monitored.
• Initial volume is controlled and results are reviewed before scaling.

Frequently asked questions

Does email validation make a campaign compliant?

No. Validation helps identify technical address problems. It does not create consent, a lawful basis or permission under a sending platform’s rules.

Should I send to the entire database at once?

No. Start with the most relevant segment and a controlled volume. Review delivery, complaints and business results before expanding.

What happens when someone unsubscribes?

Add the address to a durable suppression list and ensure future imports are checked against it. Do not simply delete the opt-out record and risk adding the address again.

Can purchased data be used in every country?

No. Requirements vary by jurisdiction, recipient and message. Check the laws and platform policies that apply before using the data.

Need help selecting the audience first? Read our B2B vs B2C comparison and buyer’s guide.