How to clean and validate a UK customer database for GDPR accuracy

Quick answer: To clean and validate a UK customer database for GDPR accuracy, run four checks across every record: validate phone numbers (format, HLR mobile lookup and landline checks), verify that email addresses are deliverable, match postal addresses to the Royal Mail PAF file, and screen against TPS, CTPS, MPS and your own do-not-contact list.

Repeat on a documented schedule, at minimum quarterly and always before a campaign, because UK contact data decays at roughly 2% a month. UK GDPR Article 5(1)(d) does not require perfect data. It requires you to take every reasonable step to keep it accurate, and to be able to evidence that you did.

Under UK GDPR Article 5, personal data must be accurate and, where necessary, kept up to date. For UK organisations, that means regularly cleaning and validating your customer database: checking phone numbers are live, email addresses are deliverable, postal addresses match the Royal Mail PAF file, and that contacts have not registered on TPS, CTPS or MPS. This guide walks through the full process step by step, from a one-off audit to validating data at the point of capture, so you can prove accuracy to the ICO and stop wasting budget on contacts who can never respond.

It applies whether you hold 500 records in a spreadsheet or five million in a CRM. The principles are the same; only the tooling changes.

What does GDPR Article 5 say about data accuracy?

Article 5(1)(d) of the UK GDPR sets out the accuracy principle: personal data must be "accurate and, where necessary, kept up to date", and organisations must take "every reasonable step" to make sure inaccurate data is "erased or rectified without delay". You can read the full text in Article 5 of the UK GDPR on legislation.gov.uk.

The ICO's guidance on the accuracy principle explains what this means in practice for a UK data controller. You need to take all reasonable steps to ensure the personal data you hold is not incorrect or misleading, consider whether it needs periodic updating for the purpose you hold it, and correct or delete inaccurate data promptly, especially when someone challenges it. Individuals also have an absolute right to have incorrect factual data rectified.

Two words in the Article matter enormously for anyone managing a customer database: "reasonable step". The ICO does not expect perfection. It expects you to have a sensible, documented process for keeping contact data accurate, and to be able to show it working. A database that has never been cleaned, where a third of the phone numbers are dead and nobody can say when it was last checked, is hard to defend as "every reasonable step".

If you want the legal detail rather than the practical process, we unpack the principle record by record in our guide to GDPR Article 5 and data accuracy in your CRM.

Why does customer database accuracy matter beyond compliance?

Because inaccurate customer data burns money long before the ICO ever looks at it.

Every dead mobile number in your dialler is agent time spent listening to a disconnected tone instead of having a conversation. Every undeliverable email address is a bounce that chips away at your sender reputation, which drags down deliverability for the contacts who can receive your messages. Every out-of-date postal address is print and postage spent mailing a house your customer left two years ago.

Contact data decays constantly. Industry estimates put database decay at around 2% every month as people change jobs, switch providers, move house and abandon email accounts. For phone numbers specifically, that compounds to roughly 30% going stale within a year. A list that was clean last summer is not clean now.

So while this guide is framed around GDPR accuracy, the commercial case usually pays for the compliance case several times over. Cleaner data means more conversations per hour, better campaign reporting, lower complaint rates and less budget quietly disappearing into numbers that will never connect. If you want a primer on the basics first, start with our plain-English guide to data cleaning.

What does cleaning and validating a UK customer database actually involve?

Database validation for a UK organisation covers four areas: phone numbers, email addresses, postal addresses, and suppression checks against the UK's official opt-out registers. Run all four and you have a database that is accurate, contactable and legal to use.

Phone number validation

Phone validation works in layers, from cheap and instant to a live network check.

First, a syntax check confirms each number is correctly formatted and could actually exist on a UK network. This catches typos, missing digits and obvious garbage, and costs very little to run across an entire database.

Second, an HLR lookup (Home Location Register, the live database mobile networks use to route calls) checks whether each mobile number is actually active on a network right now. This is the difference between a number that looks valid and a number that will genuinely ring. It identifies dead SIMs, disconnected numbers and numbers ported to another network.

Third, an enhanced landline check does the equivalent job for UK landlines, flagging lines that are disconnected or no longer accepting calls.

Finally, screen every number against TPS and CTPS before anyone dials it. Calling a number registered on either list without consent is unlawful under PECR (the Privacy and Electronic Communications Regulations), and the ICO enforces it. More on suppression checks below.

Email address validation

Email validation follows a similar ladder. A format check catches syntax errors such as missing @ symbols or invalid characters. A domain check confirms the domain exists and can receive mail. A deliverability check then verifies the specific mailbox exists, without sending anything to it.

Good validation also flags two categories worth reviewing rather than blindly keeping: disposable addresses (temporary inboxes from services like Mailinator, which will be dead within days of sign-up) and role-based addresses such as info@ or sales@, which may never reach the individual whose record they sit on. Under the accuracy principle, an email address that can no longer reach the person it belongs to is exactly the sort of stale data you are expected to correct or remove.

Postal address validation

UK postal addresses should be validated against the Royal Mail Postcode Address File (PAF), the definitive database of more than 30 million UK delivery addresses. PAF validation confirms each address genuinely exists, corrects formatting, fills gaps such as missing postcodes, and standardises everything into a consistent structure.

The payoff is immediate: less returned mail, lower print and postage waste, and address data the whole business can rely on. It also directly supports the accuracy principle, because you can demonstrate that every address you hold has been verified against the authoritative national source.

Suppression and opt-out checks

Accuracy is not just about whether data is correct. It is also about whether you are allowed to use it. Four suppression checks matter for UK databases.

TPS (Telephone Preference Service) is the official register for consumers who have opted out of unsolicited marketing calls. CTPS (Corporate Telephone Preference Service) is the equivalent for businesses, and it catches out plenty of B2B teams who assume opt-out registers only apply to consumers. MPS (Mail Preference Service) covers households that have opted out of unsolicited direct mail; screening against it is not a legal requirement in the way TPS is, but it is recognised best practice and forms part of demonstrating accountability. The DMA, which operates these preference services, publishes guidance on responsible one-to-one marketing.

Alongside the official registers, you must screen against your own internal do-not-contact list: everyone who has asked you specifically not to call, email or write. Honouring your own suppressions is a legal obligation independent of TPS and CTPS, and forgetting a past opt-out is one of the fastest routes to a complaint. Data Soap's TPS checking runs TPS, CTPS and internal DNC screening in a single pass, and our walkthrough on how to check UK phone numbers against TPS and CTPS before a calling campaign covers the process in detail.

What tools can I use to validate a UK customer database?

UK teams have three realistic options: manual checks in a spreadsheet, whatever validation is built into your CRM, or a dedicated data validation platform that queries the live sources directly. Only the third can actually satisfy the accuracy principle on its own.

Spreadsheet checks are free and better than nothing. Formulas will find blank fields, obvious duplicates and phone numbers that are the wrong length. What a spreadsheet cannot tell you is whether a mobile is still live on a network, whether a mailbox still exists, whether an address is a real Royal Mail delivery point, or whether a number joined the TPS register last Tuesday. Those answers only exist outside your file.

CRM built-in validation is a step up, but in most systems it is format-level only: it stops someone typing eleven digits into a ten-digit field. Useful at the point of entry, no help at all with the records already sitting in your database going quietly out of date.

A dedicated GDPR data validation tool is what closes the gap. Data Soap is one, built specifically for UK data: HLR mobile lookups, enhanced landline validation, email deliverability checks, Royal Mail PAF address validation and TPS, CTPS, MPS and internal DNC screening, all drawn from a single balance. You can drag and drop a file into the portal without involving IT, or connect the RESTful API to validate at the point of capture. Every run produces a dated results report showing what was checked and what was found, which is the evidence the accountability principle asks for. Data Soap is Cyber Essentials Plus certified, PCI DSS Level 4 compliant, ICO registered (ZA128196), Royal Mail PAF licensed and a DMA member.

Whichever route you choose, apply the same two tests: can the tool check against the live source rather than just the shape of the data, and will it give you a dated record of what it did? You can compare the individual checks on the Data Soap services page, and see what a clean costs on the pricing page.

How often should you validate a UK contact database?

Most UK organisations should run a full clean before any significant campaign, re-screen against TPS and CTPS within 28 days of every calling campaign, and put the whole database through a scheduled validation at least quarterly. High-volume outbound teams typically validate monthly or continuously.

That cadence exists because data cleansing for GDPR is a habit, not a project. With phone numbers going stale at roughly 30% a year, an annual clean means knowingly working with a meaningful proportion of dead data for months at a time. The 28-day rule for TPS and CTPS matters because numbers join the registers daily, so a screening result has a short shelf life.

The ICO's guidance asks whether you have considered how often the data needs updating for its purpose. A documented cleaning schedule is precisely the kind of "reasonable step" that answers that question. A one-off clean, however thorough, is a snapshot, and snapshots age.

How do you validate data at the point of capture?

You validate at the point of capture by connecting a real-time validation API to the places data arrives: web forms, landing pages, CRM entry screens and call centre scripts. The cheapest record to fix is the one that never enters your database wrong in the first place.

When a prospect types a phone number into your lead form, a real-time check confirms it is live before the form submits. Mistyped email addresses are caught while the person is still on the page and able to correct them. Addresses are matched to PAF as they are entered, so what lands in the CRM is the standardised, verified version.

Point-of-capture validation changes database hygiene from a periodic repair job into a maintenance routine. Your quarterly cleans get faster and cheaper because they are correcting decay, not shovelling out garbage that should never have got in. Data Soap's RESTful API handles phone, email and address validation in real time, and the drag-and-drop portal covers everything else without involving IT.

How do you demonstrate GDPR compliance to the ICO?

You demonstrate it with an audit trail: dated records of every validation run, showing what was checked, what was found and what you did about it. Accountability is itself a GDPR principle, so it is not enough to comply, you need to be able to show it.

A defensible audit trail typically includes the date and scope of each validation run, what was checked (HLR, email deliverability, PAF, TPS and CTPS screening), what was found and what you did about it, such as records corrected, suppressed or deleted. Add your cleaning schedule, your point-of-capture controls and your process for handling accuracy challenges from individuals, and you have a coherent answer to the question "what steps do you take to keep personal data accurate?" The ICO's data protection audit framework sets out the kind of evidence it looks for.

This is also where professional data cleaning services quietly earn their keep. Every Data Soap cleaning run produces a results report showing exactly what was checked and when, which slots straight into your compliance records. If the ICO, an auditor or your own DPO ever asks, the evidence already exists.

Frequently asked questions

Is a one-off database clean enough for GDPR?

No. The accuracy principle requires data to be "kept up to date" where necessary, and contact data decays at around 2% a month. A one-off clean is an excellent starting point, but the ICO's guidance expects you to consider ongoing updates. Best practice is a documented schedule: clean before campaigns, re-screen TPS and CTPS within 28 days of calling, and run a full validation at least quarterly.

What does GDPR Article 5 say about data accuracy?

Article 5(1)(d) of the UK GDPR requires personal data to be "accurate and, where necessary, kept up to date", and requires organisations to take "every reasonable step" to erase or rectify inaccurate data without delay. It does not demand a perfect database. It demands a documented, working process for keeping contact data accurate, and evidence that you follow it.

Does GDPR apply to B2B data?

Yes, wherever the data identifies an individual. A named contact at a company, their direct line, their work email address: all personal data under UK GDPR, and all subject to the accuracy principle. B2B callers also need to screen against CTPS, because businesses can register to opt out of unsolicited calls just as consumers can via TPS.

What is CTPS and do I need to check it?

CTPS is the Corporate Telephone Preference Service, the register for businesses that have opted out of unsolicited marketing calls. If you make B2B marketing calls, yes: calling a CTPS-registered number without consent breaches PECR, exactly as calling a TPS-registered consumer does. Data Soap screens TPS and CTPS together in one pass.

How do I validate a database without sending test emails?

Use an email validation service. It checks syntax, confirms the domain exists and accepts mail, then verifies the individual mailbox through the mail server's own responses, all without ever delivering a message. You get a deliverability verdict for every address with no bounces, no spam-trap hits and no damage to your sender reputation.

How much does it cost to clean a UK customer database?

UK data validation is normally priced per check rather than per subscription, with the unit cost falling as volume rises, so a 5,000-record clean costs a fraction of what most teams expect. Data Soap draws every service from one balance, and new customers can take £100 of credits for a one-off £4.99 to see exactly what condition their database is in. Current rates are on the pricing page.

Clean data is a five-step habit, not a one-off project

To recap, cleaning and validating a UK customer database for GDPR accuracy comes down to five steps: validate phone numbers with syntax, HLR and landline checks; validate email addresses for deliverability; verify postal addresses against Royal Mail PAF; screen against TPS, CTPS, MPS and your internal do-not-contact list; then repeat on a documented schedule, with validation at the point of capture stopping new dirty data getting in.

None of it requires a data science team. Upload a file to Data Soap's portal, or connect the API, and your first clean can be done today. Try Data Soap free with the £4.99 starter pack, which includes £100 of credits, and find out exactly how accurate your database really is.