How to clean and validate a UK customer database for GDPR accuracy

Under UK GDPR Article 5, personal data must be accurate and, where necessary, kept up to date. For UK organisations, that means regularly cleaning and validating your customer database: checking phone numbers are live, email addresses are deliverable, postal addresses match the Royal Mail PAF file, and that contacts have not registered on TPS, CTPS or MPS. This guide walks through the full process step by step, from a one-off audit to validating data at the point of capture, so you can prove accuracy to the ICO and stop wasting budget on contacts who can never respond.

It applies whether you hold 500 records in a spreadsheet or five million in a CRM. The principles are the same; only the tooling changes.

What does GDPR say about data accuracy?

Article 5(1)(d) of the UK GDPR sets out the accuracy principle, often called the GDPR Article 5 accuracy requirement. Personal data must be "accurate and, where necessary, kept up to date", and organisations must take "every reasonable step" to make sure inaccurate data is "erased or rectified without delay". You can read the full text in Article 5 of the UK GDPR on legislation.gov.uk.

The ICO's guidance on the accuracy principle explains what this means in practice for a UK data controller. You need to take all reasonable steps to ensure the personal data you hold is not incorrect or misleading, consider whether it needs periodic updating for the purpose you hold it, and correct or delete inaccurate data promptly, especially when someone challenges it. Individuals also have an absolute right to have incorrect factual data rectified.

Two words in the Article matter enormously for anyone managing a customer database: "reasonable step". The ICO does not expect perfection. It expects you to have a sensible, documented process for keeping contact data accurate, and to be able to show it working. A database that has never been cleaned, where a third of the phone numbers are dead and nobody can say when it was last checked, is hard to defend as "every reasonable step".

Why does customer database accuracy matter beyond compliance?

Because inaccurate data burns money long before the ICO ever looks at it.

Every dead mobile number in your dialler is agent time spent listening to a disconnected tone instead of having a conversation. Every undeliverable email address is a bounce that chips away at your sender reputation, which drags down deliverability for the contacts who can receive your messages. Every out-of-date postal address is print and postage spent mailing a house your customer left two years ago.

Contact data decays constantly. Industry estimates put database decay at around 2% every month as people change jobs, switch providers, move house and abandon email accounts. For phone numbers specifically, that compounds to roughly 30% going stale within a year. A list that was clean last summer is not clean now.

So while this guide is framed around GDPR accuracy, the commercial case usually pays for the compliance case several times over. Cleaner data means more conversations per hour, better campaign reporting, lower complaint rates and less budget quietly disappearing into numbers that will never connect. If you want a primer on the basics first, start with our plain-English guide to data cleaning.

What does cleaning and validating a UK customer database actually involve?

Database validation for a UK organisation covers four areas: phone numbers, email addresses, postal addresses, and suppression checks against the UK's official opt-out registers. Run all four and you have a database that is accurate, contactable and legal to use.

Phone number validation

Phone validation works in layers, from cheap and instant to a live network check.

First, a syntax check confirms each number is correctly formatted and could actually exist on a UK network. This catches typos, missing digits and obvious garbage, and costs very little to run across an entire database.

Second, an HLR lookup (Home Location Register, the live database mobile networks use to route calls) checks whether each mobile number is actually active on a network right now. This is the difference between a number that looks valid and a number that will genuinely ring. It identifies dead SIMs, disconnected numbers and numbers ported to another network.

Third, an enhanced landline check does the equivalent job for UK landlines, flagging lines that are disconnected or no longer accepting calls.

Finally, screen every number against TPS and CTPS before anyone dials it. Calling a number registered on either list without consent is unlawful under PECR (the Privacy and Electronic Communications Regulations), and the ICO enforces it. More on suppression checks below.

Email address validation

Email validation follows a similar ladder. A format check catches syntax errors such as missing @ symbols or invalid characters. A domain check confirms the domain exists and can receive mail. A deliverability check then verifies the specific mailbox exists, without sending anything to it.

Good validation also flags two categories worth reviewing rather than blindly keeping: disposable addresses (temporary inboxes from services like Mailinator, which will be dead within days of sign-up) and role-based addresses such as info@ or sales@, which may never reach the individual whose record they sit on. Under the accuracy principle, an email address that can no longer reach the person it belongs to is exactly the sort of stale data you are expected to correct or remove.

Postal address validation

UK postal addresses should be validated against the Royal Mail Postcode Address File (PAF), the definitive database of more than 30 million UK delivery addresses. PAF validation confirms each address genuinely exists, corrects formatting, fills gaps such as missing postcodes, and standardises everything into a consistent structure.

The payoff is immediate: less returned mail, lower print and postage waste, and address data the whole business can rely on. It also directly supports the accuracy principle, because you can demonstrate that every address you hold has been verified against the authoritative national source.

Suppression and opt-out checks

Accuracy is not just about whether data is correct. It is also about whether you are allowed to use it. Four suppression checks matter for UK databases.

TPS (Telephone Preference Service) is the official register for consumers who have opted out of unsolicited marketing calls. CTPS (Corporate Telephone Preference Service) is the equivalent for businesses, and it catches out plenty of B2B teams who assume opt-out registers only apply to consumers. MPS (Mail Preference Service) covers households that have opted out of unsolicited direct mail; screening against it is not a legal requirement in the way TPS is, but it is recognised best practice and forms part of demonstrating accountability. The DMA, which operates these preference services, publishes guidance on responsible one-to-one marketing.

Alongside the official registers, you must screen against your own internal do-not-contact list: everyone who has asked you specifically not to call, email or write. Honouring your own suppressions is a legal obligation independent of TPS and CTPS, and forgetting a past opt-out is one of the fastest routes to a complaint. Data Soap's TPS checking runs TPS, CTPS and internal DNC screening in a single pass.

How often should you clean your database?

More often than most organisations do. Data cleansing for GDPR is a habit, not a project. With phone numbers going stale at roughly 30% a year, an annual clean means knowingly working with a meaningful proportion of dead data for months at a time.

A practical baseline for most UK organisations looks like this: run a full clean and validation before any significant campaign, re-screen against TPS and CTPS within 28 days of every calling campaign (numbers join the registers daily, so a screening result has a short shelf life), and put the whole database through a scheduled clean at least quarterly. High-volume outbound teams typically validate monthly or continuously.

The ICO's guidance asks whether you have considered how often the data needs updating for its purpose. A documented cleaning schedule is precisely the kind of "reasonable step" that answers that question. A one-off clean, however thorough, is a snapshot, and snapshots age.

How do you validate data at the point of capture?

The cheapest record to fix is the one that never enters your database wrong in the first place.

Validation APIs plug into the places data arrives: web forms, landing pages, CRM entry screens and call centre scripts. When a prospect types a phone number into your lead form, a real-time check confirms it is live before the form submits. Mistyped email addresses are caught while the person is still on the page and able to correct them. Addresses are matched to PAF as they are entered, so what lands in the CRM is the standardised, verified version.

Point-of-capture validation changes database hygiene from a periodic repair job into a maintenance routine. Your quarterly cleans get faster and cheaper because they are correcting decay, not shovelling out garbage that should never have got in. Data Soap's RESTful API handles phone, email and address validation in real time, and the drag-and-drop portal covers everything else without involving IT.

How do you demonstrate GDPR compliance to the ICO?

Accountability is itself a GDPR principle: it is not enough to comply, you need to be able to show it. For data accuracy, that means keeping evidence of the reasonable steps you have taken.

A defensible audit trail typically includes the date and scope of each validation run, what was checked (HLR, email deliverability, PAF, TPS and CTPS screening), what was found and what you did about it, such as records corrected, suppressed or deleted. Add your cleaning schedule, your point-of-capture controls and your process for handling accuracy challenges from individuals, and you have a coherent answer to the question "what steps do you take to keep personal data accurate?"

This is also where professional data cleaning services quietly earn their keep. Every Data Soap cleaning run produces a results report showing exactly what was checked and when, which slots straight into your compliance records. If the ICO, an auditor or your own DPO ever asks, the evidence already exists.

Frequently asked questions

Is a one-off database clean enough for GDPR?

No. The accuracy principle requires data to be "kept up to date" where necessary, and contact data decays at around 2% a month. A one-off clean is an excellent starting point, but the ICO's guidance expects you to consider ongoing updates. Best practice is a documented schedule: clean before campaigns, re-screen TPS and CTPS within 28 days of calling, and run a full validation at least quarterly.

Does GDPR apply to B2B data?

Yes, wherever the data identifies an individual. A named contact at a company, their direct line, their work email address: all personal data under UK GDPR, and all subject to the accuracy principle. B2B callers also need to screen against CTPS, because businesses can register to opt out of unsolicited calls just as consumers can via TPS.

What is CTPS and do I need to check it?

CTPS is the Corporate Telephone Preference Service, the register for businesses that have opted out of unsolicited marketing calls. If you make B2B marketing calls, yes: calling a CTPS-registered number without consent breaches PECR, exactly as calling a TPS-registered consumer does. Data Soap screens TPS and CTPS together in one pass.

How do I validate a database without sending test emails?

Use an email validation service. It checks syntax, confirms the domain exists and accepts mail, then verifies the individual mailbox through the mail server's own responses, all without ever delivering a message. You get a deliverability verdict for every address with no bounces, no spam-trap hits and no damage to your sender reputation.

Clean data is a five-step habit, not a one-off project

To recap, cleaning and validating a UK customer database for GDPR accuracy comes down to five steps: validate phone numbers with syntax, HLR and landline checks; validate email addresses for deliverability; verify postal addresses against Royal Mail PAF; screen against TPS, CTPS, MPS and your internal do-not-contact list; then repeat on a documented schedule, with validation at the point of capture stopping new dirty data getting in.

None of it requires a data science team. Upload a file to Data Soap's portal, or connect the API, and your first clean can be done today. Try Data Soap free with the £4.99 starter pack, which includes £100 of credits, and find out exactly how accurate your database really is.