Sophisticated investor data: sourcing, consent and lawful use

The short answer

There is no such thing as a list of certified sophisticated investors that you can buy and market to. Investor status under the UK financial promotions regime is a statement an individual signs, at a point in time, in a specific context. Data can tell you who is likely to qualify. It cannot certify anyone.

What you can lawfully do with a record depends on two separate regimes. Data protection law, meaning UK GDPR and PECR, decides whether and how you may contact the person at all. The financial promotions regime decides what you may say to them once you do. Most problems come from treating a pass under one as a pass under the other.

What investor status actually means

The Financial Promotion Order sets out the exemptions that let unapproved promotions of certain investments reach individuals who have made the right statement. The ones that matter for investor data are these.

Certified high net worth individual

Someone who signs the prescribed statement confirming annual income of £100,000 or more in the previous financial year, or net assets of £250,000 or more, excluding their main residence, pension rights and certain insurance benefits. The wording of the statement is prescribed in Schedule 5 of the Order, and a statement that departs from it does not do the job.

The thresholds have a recent history that matters for older data. They were raised to £170,000 and £430,000 from 31 January 2024, then restored to £100,000 and £250,000 by SI 2024/301, in force from 27 March 2024. The old statements remained usable as alternatives until 30 January 2025. A record flagged "HNW certified" in early 2024 may be resting on any of three versions of the test.

Self-certified sophisticated investor

Someone who signs a statement confirming at least one of: membership of a business angel network or syndicate for at least six months; more than one investment in an unlisted company in the previous two years; working in a professional capacity in private equity or SME finance in the previous two years; or being a director of a company with turnover of at least £1 million in the previous two years. The same 2024 order cut the director test from £1.6 million to £1 million and added the two-investment route.

Certified sophisticated investor

A different category altogether: the investor holds a certificate from an authorised firm confirming they are sufficiently knowledgeable to understand the risks of a type of investment. It is rarer and more robust, and it is the one most often confused with self-certification in data supplier descriptions.

The FCA's own categories

Authorised firms promoting restricted mass market and non-mass market investments work to the FCA's rules, which carry their own prescribed statements, including the certified high net worth investor statement in COBS 4 Annex 2R. The categories echo the Order but sit in a different rulebook, and the firm's onboarding journey is where they are captured.

The practical consequence for data is simple. Status is created inside a firm's process and evidenced by a document that firm holds. It does not transfer to you when you license a record from someone else.

Where investor data comes from

Every investor record has one of three origins, and its origin determines both its accuracy and its lawful uses.

Scale tells you which kind you are being offered. HMRC's May 2026 statistics show 3,735 companies raising £1,575 million under EIS in 2024 to 2025, from an investor base in the tens of thousands. A list of several hundred thousand UK "sophisticated investors" is almost certainly modelled, and should be priced, used and described as such.

Consent: what it covers and what it does not

PECR governs electronic marketing and sits on top of UK GDPR. For investor data, four rules do most of the work.

1. Email and text to individuals need consent that names you. The ICO's guidance requires clear, positive agreement specific to email marketing that names your organisation. The soft opt-in is narrower than many assume: it applies only to details you collected yourself during a sale or negotiation, for your own similar products, and it cannot be used for bought-in lists or details gathered by another organisation, group companies included.
2. Third-party consent rarely transfers. When you use a marketing list, the ICO says generic consent covering any third party will not be enough; people must have consented to that type of message from you specifically. The ICO also expects you to check that the list is accurate, that details were collected fairly, and that consent is specific and recent enough.
3. Live calls can rely on legitimate interests, with screening. Bought-in lists can be used for live calls, provided you screen against the TPS and your own do-not-call list, and the CTPS for business numbers. Recorded or automated calls need consent. When Energy Prices Direct Limited called unscreened bought data, the ICO fined it £160,000 in May 2026, after more than 700,000 calls.
4. Corporate subscribers are different, people are not. PECR's email consent rule does not apply to corporate subscribers, but the ICO treats sole traders and some partnerships as individuals, and UK GDPR still applies to any named employee, including their absolute right to object to direct marketing. A company director's work address is a lawful route to a business angel. Their personal email is not.

Modelled wealth data: the regulator's view

Profiling people for wealth is lawful in principle and risky in practice, because people rarely expect it. Two cases set the boundaries.

In December 2016 the ICO fined the RSPCA £25,000 and the British Heart Foundation £18,000 after investigating wealth screening, in which supporters' details were passed to third parties to estimate their wealth and giving potential without their knowledge. The lesson was transparency: people had not been told.

Experian's challenge to an ICO enforcement notice drew the other boundary. The First-tier Tribunal held that a controller can rely on legitimate interests for direct marketing, and that using credit reference data for marketing could be appropriate, while still finding a breach of transparency duties and declining to treat notification of more than five million people as disproportionate effort, according to Ropes & Gray's analysis of the decision. The ICO's appeal was dismissed by the Upper Tribunal in Information Commissioner v Experian [2024] UKUT 105 (AAC) on 22 April 2024.

Taken together: modelled investor data can have a lawful basis, but only if people are told it is happening and the processing has been assessed and documented. A supplier who cannot show you its privacy notice and its legitimate interests assessment for the modelling is asking you to share a risk you cannot see.

What changed in 2025 and 2026

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Section 70 inserted text into Article 6 of UK GDPR listing processing necessary for direct marketing among the examples that may be necessary for a legitimate interest, and that change came into force on 5 February 2026 under SI 2026/82, together with new PECR enforcement powers for the ICO. The Act also raised the maximum PECR fine from £500,000 to £17.5 million or 4% of global annual turnover.

The direction is clear. Using a lawful basis for marketing got slightly easier to argue. Getting PECR wrong got much more expensive. Neither change touches the requirement for email consent that names you.

What you can lawfully do with each type of record

None of the "yes" answers says anything about what the message may contain. That is the financial promotions question, and it depends on the investor's category and your approver.

Due diligence before you license investor data

• Origin of each segment: declared, behavioural or modelled.
• The consent wording shown to individuals, and whether it names you or a defined category that includes you.
• When and how consent was captured, and the record of it.
• The privacy notice individuals were shown, and whether it mentions profiling.
• The supplier's legitimate interests assessment for any modelling.
• Screening against TPS, CTPS and suppression files, with dates.
• Licence terms on channels, duration and onward use.
• How objections and erasure requests flow back to the supplier.

If a supplier hesitates on any of these, that hesitation is the answer.

How we handle it

Our 540,000 investor profiles sit on three foundations: subscribers who opted in directly with our own publishing titles over eight years, licensed data that we re-verify, deduplicate and suppress before use, and engagement data from campaigns already delivered. We tell clients which foundation a segment sits on, and its consent position, before a campaign is priced. We do not describe modelled data as certified, and we do not treat a consented record as a categorised investor.

Common questions

Where to go next

The HNW investor acquisition service page includes an interactive breakdown of where each data tier comes from. For how the data is then activated, read how HNW lead generation actually works, and for audiences outside the UK, see reaching UAE and Saudi investors compliantly.