Is a customer's mobile number personal data?

Yes. A customer's mobile number is personal data in almost every case a business will meet, and so is the list it sits on. Article 4(1) of the UK GDPR defines personal data as "any information relating to an identified or identifiable natural person", and the ICO's guidance on identifying people says "You do not need to hold an individual's name in order to identify them." A mobile number is usually carried by one person, in one pocket, so it picks that person out from everyone else whether or not a name sits next to it.

The ICO doesn't list phone numbers by name among its examples. Its guidance here is under review after the Data (Use and Access) Act 2025, and the ICO's work passed to the new Information Commission on 30 September 2026, but the text on the ICO's website is still the current guidance. The answer comes from applying its test, which is short. Once you accept it, every contact list comes with legal duties attached: a lawful basis, accuracy, security, a retention period and a right of access for every person on it.

What counts as personal data?

The full definition in article 4(1) goes on to say a person is identifiable if they "can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier" or factors specific to them. The list is open (that "such as" matters), and the ICO's guide puts the test in one line: "An individual is 'identified' or 'identifiable' if you can distinguish them from other individuals."

Its page on direct identification goes further. "If you hold any identifier, or combination of identifiers, this can be sufficient to identify a single individual," it says, and the example it picks is close to a phone number: "A corporate email address can directly identify the individual (as it is a unique identifier)". A mobile number does the same job. Text it and you reach one person, which is the whole reason a business wants it.

Business contacts are no exception. The ICO's business-to-business guidance says you are processing personal data if "you have the name and number of a business contact on file". What falls outside is information about the organisation itself, because "Information about companies or public authorities is not personal data." A switchboard number for a limited company, with no person attached, is the sort of thing that sentence covers. The mobile of the site manager you deal with every week isn't. (Sole traders are a separate wrinkle under the marketing rules, and our post on texting other businesses goes through it.)

Does a number count without a name?

The harder case is a list with no names on it at all. Take a keyword opt-in log that holds nothing but numbers, dates and the word each person texted in. Is that personal data?

Read the ICO's own wording and the answer is yes: "An individual is also identifiable if you are able to distinguish that individual from other members of a group." Each row in that log distinguishes one person from every other row, and each number belongs to someone who can be reached and, with very little effort, named. The safe course is to treat a column of mobile numbers exactly as you'd treat a column of names and addresses.

The marketing rules get to the same place by a different road. The ICO's direct marketing guidance says that "If you want to use contact details, such as a phone number or electronic mail address (eg email address), then PECR applies (as well as data protection law if your marketing involves using personal information)." PECR, the Privacy and Electronic Communications Regulations, governs the sending of marketing texts whether or not a name is attached. The UK GDPR governs the list.

Which lawful basis covers a contact list?

Article 6(1) gives six lawful bases, and processing is lawful "only if and to the extent that at least one" of them applies. For texting, two or three of them do nearly all the work.

For marketing texts to individuals, the ICO's guidance on choosing a lawful basis sets out the pairing in a table. The PECR requirement is "Consent" or the "Soft opt-in", and the likely data protection basis is "Consent" or "Legitimate interests". Since 5 February 2026, article 6(11), added by the 2025 Act, has named "processing that is necessary for the purposes of direct marketing" as an example of processing that may be a legitimate interest. That changes nothing about whether you may send the text. PECR still decides that, and for an individual's mobile it still wants consent or the soft opt-in.

Service texts are a different question. A reminder about an appointment the customer booked, or a message that their order is ready, sits most naturally under article 6(1)(b), processing "necessary for the performance of a contract to which the data subject is party". That's my reading of the article; the ICO's guidance doesn't walk through a booking reminder. Whichever basis you land on, write it down for each kind of text you send. Article 5(2) makes the controller "responsible for, and be able to demonstrate compliance with" the principles, and a list nobody can explain fails that on its own.

Keeping the numbers accurate

Article 5(1)(d) requires personal data to be "accurate and, where necessary, kept up to date", with "every reasonable step" taken to correct or erase what's wrong. The ICO's direct marketing guidance turns that into things to record accurately, including "the information you have been provided with (eg contact details)", "the source of that information", "which methods of direct marketing people have consented to" and "any objections, opt-outs, or withdrawals of consent".

It's relaxed about how far you have to go to keep numbers current. "It is reasonable to rely on people to tell you when they change address or other contact details," the guidance says, and "you don't need to take intrusive steps", with tracing services as its example. Its worked example is a retailer whose post comes back marked "no longer at this address", which complies by noting on the customer's record that the address is no longer correct. A number that fails every time you text it is the nearest thing a mobile list has to returned post, so the same habit fits: mark it, stop sending to it, and ask for a new one next time the customer is in front of you.

Keeping the list secure

Article 5(1)(f) and article 32 between them require "appropriate technical and organisational measures to ensure a level of security appropriate to the risk". For a texting list the risk comes mostly from people, and the ICO's own figures show how ordinary the data in a breach usually is.

The ICO publishes the data behind its breach reports incident by incident. Of the 13,456 personal data breaches reported to it in calendar year 2025, by our count, 10,840 involved what it calls basic personal identifiers, defined as "information, such as name, email address, or address, that can identify an individual". Health data came a distant second at 3,766, and the ICO classed 10,303 of the year's reports as non-cyber incidents. Most breaches, in other words, are ordinary contact details going somewhere they shouldn't.

One reprimand shows how that happens with phone numbers. On 31 July 2023 the ICO reprimanded NHS Lanarkshire over a WhatsApp group a team had set up on 24 March 2020, which 26 staff had access to. Between 1 April 2020 and 25 April 2022 the group held at least 533 entries naming patients, and at least 215 of those included phone numbers. WhatsApp "was not approved by NHS Lanarkshire for processing personal data of patients", and the ICO found breaches of articles 5(1)(f), 25(1) and 32(1). Swap patients for customers and a clinical team for a salon or a trades firm, and a staff group chat where numbers get passed round carries the same risk.

The other end of the scale is deliberate theft. The ICO's largest nuisance call investigation began in 2016, when a garage owner in County Durham told the regulator he was worried his customers blamed him for the personal injury calls they were getting. It found people who had obtained garage customers' details without consent between 2014 and 2017, with approximately one million records accessed, and by February 2026 ten people had been prosecuted. Those charges were under the 1998 Act. Today the offence of obtaining personal data "without the consent of the controller" sits in section 170 of the Data Protection Act 2018.

In practice that comes down to a login for each person who can see the list, so you know who exported what; staff texting from the business system instead of their own phones; and a short, honest answer to the question of who can download the whole thing.

Keeping it no longer than you need

Article 5(1)(e), storage limitation, has its own post here on how long to keep text message records, so just one point. The opt-out record is the exception to deletion. When someone texts STOP you keep the number on a suppression list so you never text them again, with as little as possible stored beside it.

What happens when a customer asks what you hold?

Article 15 gives every person on the list the right to a copy of their data and to be told the purposes, the recipients, how long you'll keep it and, where you didn't collect it from them, "any available information as to their source". The ICO's guide to subject access, updated on 16 July 2026, says a request can be made "verbally or in writing, including via social media", so a customer who replies to one of your texts asking what you've got on them has quite possibly made one.

You have a month. The ICO says you "must comply with a SAR without undue delay and at the latest within one month of receiving the request", with up to two more months if the request is complex, and "In most cases, you cannot charge a fee." The 2025 Act also inserted article 15(1A), which limits the duty to what the controller can provide "based on a reasonable and proportionate search". That helps when old spreadsheets are scattered across three laptops, but it won't excuse skipping the obvious places.

For a texting customer the answer is usually short: the number and name on file, every text you sent with its date, every reply, the consent record or the reason you texted them, and the companies that process the data for you, your SMS provider included.

People use these rights more every year. The ICO's annual report for 2025/26 counts 76,743 data protection complaints received, up from 42,315 the year before and 39,721 in 2023/24. In some of them, the report notes, the person "had approached us before giving the organisation sufficient opportunity to respond", which is one complaint a quick reply to a customer's text would have headed off.

CaptiFi Connect keeps a delivery report and the reply thread for every text, exports to CSV when a request comes in, and gives each member of the team their own login with a role and two-step sign-in, so nobody shares one password to the list. The security page covers the rest. The number is personal data whichever system holds it, and the article 15 clock starts on the day the customer asks.