"Who gave you my number?" - answering the question well
It is a fair question, it has a right answer, and most businesses cannot give it. Here is how to be one that can.
Someone rings back, mildly annoyed, and asks where you got their number. Most businesses respond with a version of "let me look into that and come back to you", which is a polite way of saying nobody knows.
That answer is worse than it sounds. It is the moment a reasonable person decides you are the kind of operation that has their details for no reason it can articulate - and under the UK GDPR it is also a question you are obliged to be able to answer.
What you are actually required to say
If you did not collect the details directly from the person, Article 14 says you have to tell them where the data came from, what you are using it for, on what lawful basis, how long you will keep it and what they can do about it. If they ask directly, that is a subject access request and you have a month.
None of that is exotic. It is roughly: what have you got, where did it come from, why do you have it, and how do they make it stop.
Why the answer usually does not exist
Not because anybody was careless. Because of how contacts get into a book.
- Somebody typed it in after a phone call, three years ago, and typed nothing else.
- It arrived in a spreadsheet import of 900 rows with a column called Source that was blank for 700 of them.
- It was on a business card in a jacket pocket.
- The person who added it has left, and the context left with them.
A contact record with a name and a number and nothing else is a record that cannot explain itself. And provenance is exactly the thing that is never captured at the time, because at the time everybody knows - it is only two years later that nobody does.
The fix is to capture it at the moment, automatically
The reason people do not record where a contact came from is that it is an extra field to fill in at the least convenient moment. So the answer is not discipline. It is to have the details arrive already carrying their own history.
What that looks like
When somebody fills in their own details - from a card you handed them, a link you sent, or a directory enquiry - the record that lands in your book keeps the circumstances. Not a source code in a dropdown, but the actual facts: which route they came in by, which card or page it was, the date and time, and anything they wrote themselves.
On the contact's page in CentralContacts that shows up as two plain headings - How you met, and What they wrote. So the answer to "who gave you my number?" is: you did, on the fourteenth, through this card, and here is the note you added at the time.
The strongest possible answer to "where did you get this?" is "from you - here is when, and here is what you told us."
For the contacts you already have
That solves the future. The existing book is the harder half, and honesty is the only workable approach.
- Sort what you have by whether you can explain it. Most books split fairly cleanly into records with a known origin and records without.
- For the known ones, write the origin down once. Even "imported from the 2023 supplier list" is a real answer and far better than silence.
- For the unknown ones, decide honestly whether you should still hold them. A contact you cannot account for and have not used in four years is a liability, not an asset.
- For the ones worth keeping, ask. A short note saying here is what we hold, here is why, tell us if you would rather we did not - is both a compliance step and, frequently, a conversation worth having.
- From then on, capture provenance at the point of entry so the pile stops growing.
Give the person a way to check for themselves
The version of this that actually ends the problem is letting the person look. Not a form they submit and wait a month on - a private page, secured by a one-time code, showing what you hold, where it came from, and controls to correct it or ask you to stop.
Two things happen when you do that. The compliance burden mostly evaporates, because a subject access request is largely a request to see something the person can now already see. And the tone changes completely: you are no longer a business that has somebody's data, you are a business that is straightforward about it.
| Question | Without provenance | With it |
|---|---|---|
| Where did you get my number? | We will look into it | From you, on 14 March, via this card |
| Why do you hold it? | Reconstructed from memory | Recorded at the time, with the basis |
| Can I see what you have? | A month and some digging | Here is the link - look now |
| Please stop contacting me | Manual, easy to miss | They set it themselves; it applies |
Common questions
Do I have to tell people I hold their data if they gave it to me directly?
You still have to be transparent about purpose, basis and retention, but the where-did-you-get-it obligation under Article 14 applies specifically when you did not collect it from them. Directly-given data is Article 13, which is a lighter lift - though the honest answer is that the same information serves both.
Is a business card consent?
It is not consent in the GDPR sense, but it is usually a solid legitimate-interests case for contacting that person about the thing you were discussing. Where it stops being solid is adding them to a marketing list two years later.
How long can I keep a contact I have never used?
There is no fixed number. The test is whether you still have a reason. A contact you cannot account for and have not used in years fails that test, and the tidy answer is to remove it rather than keep it in case.
What if I inherited the list from someone who left?
Then you inherited their obligations too. Work through it as above - explain what you can, and be prepared to let go of what you cannot.
Does letting people see their record create more work?
It reduces it. Most subject access requests are somebody trying to find out what you have; if they can see it, the request usually does not get made.
Where to start
Pick ten contacts at random and try to answer where each came from. Whatever proportion you can answer is the honest state of your book, and it is usually a more useful number than any audit. Then fix the intake so next year's ten are all answerable.