How to Structure a Data-Broker, Lead-Generation or Customer-Intelligence Business

Banks and licensing authorities look at the activity. Data buyers look at the inventory. A business contact directory, a consumer lead engine, an identity-matching service and a scoring model are different products, even when one dashboard fronts all four. Each stands or falls on where its fields came from and what the source allowed. A food producer meets the same question, covered in the seafood processing guide, which separates the ministry permission from the licence.

Start with a register. For every field you intend to sell, record the source, what the person or source agreed to, and whether the intended reuse is compatible with that origin. A buyer's compliance team, a bank and any authority enquiry will all start from it.

If you cannot fill the register for a field, that field is not ready to be sold. No licence changes that.

The law applies to processing of personal data wholly or partly through electronic systems, whether inside or outside the UAE. That wording matters for a company that collects abroad and sells in the UAE, or the reverse.

Processing without the data owner's consent is prohibited, except where it is necessary to protect a public interest or to carry out legal procedures and rights. For a broker, that puts the burden on the source: a list bought from a third party is only as lawful as the consent behind it. Federal Law No. 15 of 2020 on Consumer Protection adds that suppliers may not use consumers' data for marketing.

Data owners can ask for correction of inaccurate personal data and can ask to restrict or stop processing. A business that resells a person-level file needs a working path for those requests, and a way to pass them on to buyers.

The law also sets requirements for transferring and sharing personal data across borders. Enrichment services that send files to offshore processors, and buyers that take exports abroad, fall inside that.

Confirm the current executive regulations and any sector rules with the UAE Data Office before you finalise the product.

Selling leads means someone will be contacted. TDRA says it works to limit intrusive marketing SMS through a dedicated regulatory policy, encourages licensees to offer clear opt-in and opt-out mechanisms, monitors compliance through regular reporting, and mandates strict action against senders who lack prior consent.

For a lead-generation company, that makes the consent record the asset. A lead with no proof of consent for the channel it will be contacted on is a liability to the buyer. Capture consent at the point of collection, keep it with the lead, and sell it with the lead.

Separately, TDRA issues a No Objection Certificate for practising e-activity, covering economic activity online through websites, apps or social media accounts. If you run a consumer-facing site or app to collect leads, ask TDRA whether that certificate applies to you.

Decide who is the controller and who is the processor before the contract is drafted. A company that decides why and how data is processed carries different duties from one that processes only on a customer's instructions. An enrichment service working on customer files is a different role from the owner of the proprietary database it enriches.

If one group runs several products, a split by data risk is usually cleaner. A firmographic product, a consumer-lead operation and a processing service each have their own failure mode, and a rights request or source failure in one should not contaminate the saleability of the others. Choosing between a mainland company and a free zone comes later: a DIFC entity, for example, brings the DIFC data law into the picture, so settle which framework the data model can satisfy first.

The entity that signs customer contracts should be the one able to answer for the data. It runs the rights process, enforces onward-use limits and stands behind the source warranties. Structures built around a cheap set-up price tend to fail at the first buyer questionnaire that asks who warrants the sources.

People matter more than premises here. You need a named owner for data protection, someone responsible for security and retention, and someone who handles customer due diligence. A small company can combine roles, but each must be assigned.

A bank reading a data company's file wants to see what is being sold, to whom and on what terms. Contracts that restrict onward use, a privacy notice that matches the register and a breach plan are what turn a cautious compliance reviewer into a customer. The corporate bank account readiness work covers how those documents line up with the licence activity and the account profile. Cost depends on the route and on how much governance the product needs. How Velarozone works is to build the register first, and Velarozone's own fee is itemised in the engagement letter.