Vendor Prospecting Is Not Dead. Casual Data Is.

A weekly briefing on the gap between what AI can do for your business and what you're actually using.

AI should be part of every agent's prospecting workflow in 2026.

Used well, it is a genuine power-up. It can help you find patterns in an old CRM, prioritise follow-up, segment buyers and vendors, draft better first-touch messages, prepare call notes, and keep more relationships warm without relying on memory and late-night admin.

That is exactly the kind of leverage The Listing Signal exists to help agents use.

But the same tools that make good prospecting stronger also make bad prospecting easier.

AI has made list-building feel almost frictionless. You can scrape public pages, enrich a spreadsheet, summarise property records, build owner profiles, draft the outreach, and queue a campaign faster than most agents could clean last year's CRM export.

The problem is not AI.

The problem is treating available data as usable data.

From 1 May 2026, New Zealand has a new privacy notification rule for personal information collected indirectly. It is called IPP3A, and the Office of the Privacy Commissioner says that when an agency collects someone's personal information from somewhere other than the person themself, that agency is generally required to notify them, unless an exception applies.

For agents, the practical issue is provenance.

Before you buy another homeowner list, enrich another CRM, scrape another source, upload another old spreadsheet, or run another cold campaign, you need to be able to answer one basic question:

Where did this data come from, and can I explain why I am using it?

That is not a legal footnote. It is now part of the prospecting workflow.

What changed

IPP3A sits inside the Privacy Act. The Privacy Amendment Act 2025 introduced it, and the Ministry of Justice says the change came into force on 1 May 2026.

The rule applies to personal information collected indirectly from 1 May 2026. In plain terms, that means information collected from another person, another agency, a supplier, a public source, a scraped page, a database, a lead-generation partner, or an enrichment tool.

The Office of the Privacy Commissioner also makes an important point: IPP3A is not a permission slip. Agencies still need to consider whether they have a proper basis to collect the information indirectly under the wider Privacy Act before they deal with notification.

So this is not a simple rule that says prospecting is banned.

It is also not a simple rule that says public data, bought lists, enriched CRMs, or old spreadsheets are always fine.

The useful operating question is narrower and more practical:

Can you explain the source, purpose, notification position, and opt-out path for the list you are about to use?

If not, do not turn it into an AI-assisted campaign yet.

What to do with the data you already have

Most agents have contact data they cannot explain cleanly.

Some of it is first-party data. The person came to an open home. They asked for an appraisal. They subscribed to buyer alerts. They replied to a vendor update. They filled out a form. They handed over their details in a context where the relationship is clear.

That data is valuable because the origin is visible.

The harder category is everything else: bought homeowner lists, old appraisal databases, portal exports, enrichment tools, referral spreadsheets, public-record scraping, third-party lead-gen providers, past-agent databases, and old files sitting in a shared drive with no useful note about where the contacts came from.

The answer is not to delete everything or stop prospecting.

The answer is to sort the list before you activate it.

Use four buckets:

Use it. The relationship is clear, the source is known, the purpose makes sense, and the person has a clear way to opt out.

Check it. The list came from a supplier, enrichment tool, public source, scraped page, or old export. Ask where it came from, what was collected, what the person was told, and who is responsible for notification.

Re-permission it. You have a real relationship, but the consent trail or original purpose is weak. Use the next contact to reset the relationship properly before you put the person into a campaign.

Do not campaign to it yet. You cannot explain the source, what personal information is included, what the person was told, or why this contact is relevant now.

Relevance reduces risk, but it does not replace compliance

There is a commercial truth here that agents already understand.

The practical risk is not evenly spread.

If your message is specific, relevant, and useful, most people will experience it as a professional contact. If it is generic, intrusive, or obviously scraped, they are much more likely to ask where you got their details, unsubscribe, complain, or report it.

That does not make relevance a substitute for good data practice.

It means good prospecting and good privacy practice point in the same direction.

Know where the data came from. Know why you are contacting the person. Make the message worth receiving.

AI should help with that. It should help you understand the list, segment it properly, personalise the reason for contact, and avoid lazy outreach.

It should not help you spray weak messages across data nobody can explain.

What happens if you get it wrong

A breach of the Privacy Act does not mean every bad prospecting email becomes an instant fine.

But it can still create real consequences.

The Office of the Privacy Commissioner says a breach can lead to reputational damage, damaged relationships with clients or customers, and financial consequences. A person affected by a breach can complain to the Commissioner. The Commissioner can investigate, try to resolve the complaint, and in some cases issue a compliance notice requiring an agency to do something or stop doing something.

More serious matters can end up before the Human Rights Review Tribunal, which can award compensation where there has been an interference with privacy and harm has been caused.

For agents, the more immediate risk is simpler.

If someone asks where you got their details, you need a better answer than "it was in the CRM" or "AI found it."

That answer needs to exist before the campaign goes out.

A simple audit to run this week

Pick one vendor prospecting campaign you were going to run in the next fortnight.

Not the whole CRM. One list.

Work through these questions before you send anything:

What is the source of this list?
Was the information collected directly from the person, or indirectly from somewhere else?
What personal information does the list include?
What was the person told when their information was collected?
What are we using the information for now?
Is there a clear opt-out path?
Who can answer these questions if the person asks where their details came from?

If you can answer them, you have a cleaner campaign to work with.

If you cannot, sort the list before you activate it.

That might mean asking the supplier for their IPP3A position in writing. It might mean updating your privacy notice. It might mean moving the list into a re-permission workflow. It might mean deciding not to use that data for cold prospecting.

The point is to make the decision before AI turns a messy list into a polished campaign.

Use AI to sort the list before you send

This is where AI is genuinely useful.

Not as a lawyer. Not as a permission machine. As a structured thinking tool.

Most agents do not have a neat data map sitting beside their CRM. They have memory, old spreadsheets, portal exports, enquiry lists, past-client records, appraisal notes, and a rough sense of where things came from.

That is exactly the kind of mess AI can help organise.

The prompt below walks you through one list and turns your answers into a practical audit. It will help you see which records are clean enough to use, which ones need checking, which ones may need re-permissioning, and which ones should be suppressed for now.

It will not tell you whether the campaign is legal. That decision still needs human judgement and, where the risk is serious, proper advice.

But it will give you something much more useful than a vague worry about compliance: a clearer view of what you know, what you do not know, and what to do before you press send.

Paste this into ChatGPT, Claude, or Gemini:

PromptProspecting data source audit

You help a New Zealand real estate agent review a prospecting or nurture list before using it in an email, call, SMS, or AI-assisted campaign.

This is not legal advice. Do not decide whether the campaign is lawful. Do not say the list is compliant or non-compliant. Your job is to help me organise the facts, identify missing information, and decide what operational action is needed before the list is used.

Do not assume there is a supplier, privacy officer, legal adviser, campaign manager, or internal data owner. In most cases, treat me as the person responsible for answering the provenance questions.

Ask me one question at a time. Keep each question short. Wait for my answer before asking the next question.

Do not ask a question if I have already answered it directly or indirectly. Use my previous answers to infer what is already known. If an answer is partial, ask the next most useful follow-up, not the same question in different words.

Gather enough information to understand:

- the campaign purpose
- who is on the list
- why they are relevant
- where the data came from
- whether the source is clear, mixed, third-party, or unknown
- what personal information is included
- whether the information was collected directly, indirectly, or through mixed or unknown pathways
- what people were told, if anything
- whether unsubscribe, opt-out, bounced, suppressed, or do-not-contact handling exists
- who can explain the list source if someone asks

Suggested question flow:

1. What is the campaign for?
2. Who is on the list?
3. What makes them relevant to this campaign?
4. Where did the list come from?

After question 4, adapt:

- If I say the list has mixed sources, do not ask whether it has one source or multiple sources. Treat it as mixed and ask which source types are included.
- If I name a supplier, enrichment tool, bought list, portal export, scraped source, or inherited database, treat that as indirect or third-party unless I clarify otherwise.
- If I describe open homes, appraisal enquiries, past clients, buyer alerts, or direct form fills, treat those as likely direct collection unless I clarify otherwise.
- If I say I do not know, treat the source or collection pathway as unknown.

Then ask only the missing questions needed to complete the audit.

Once you have the answers, produce a practical audit with these sections:

1. Campaign summary.
State what the campaign is, who it is going to, and what data is being used.

2. Provenance status.
Classify the list into one of four buckets:
- Use it: source, relationship, purpose, and opt-out path are clear.
- Check it: source or notice position needs confirmation before use.
- Re-permission it: there is a real relationship or plausible local relevance, but the consent trail or original purpose is weak.
- Do not campaign to it yet: source, notice, relevance, or opt-out position cannot be explained.

If the list contains mixed sources, recommend segmentation rather than treating the whole list the same way.

When recommending segmentation, produce a short segment-by-segment action table with four columns:

Segment | Status | Action before sending | Why

Use these statuses:
- Send
- Re-permission
- Check first
- Suppress for now

Do not stop at "segment the list first". Say what should happen to each likely segment based on the facts provided.

3. What is known.
List the useful confirmed facts.

4. What is missing.
List the gaps that matter before the campaign is sent.

5. Questions to answer before sending.
Write the exact questions I need to answer myself.

If a third-party supplier, data broker, enrichment tool, portal export, agency database, or lead-generation provider is involved, add a short subsection called "Questions for the supplier".

Include "When to get advice" only if there is a specific reason for escalation, such as large-scale unexplained indirect data, bought or scraped residential data, inherited records from another business, prior complaints, SMS or calling automation, or reliance on an exception I cannot explain.

If the issue can be handled by sorting, suppressing, re-permissioning, or asking a supplier for written provenance, give those operational steps first.

6. Relevance test.
Assess whether the proposed message is likely to feel specific, useful, and expected to the recipient. If it sounds generic, explain how to make it more relevant before sending.

7. Re-permission option.
If some records have a real relationship or plausible local relevance but weak provenance, suggest a practical re-permission approach.

Include:
- who this is appropriate for
- who should be suppressed instead
- one short example message in NZ English
- what the opt-out or consent action should be
- what to record afterwards

Do not suggest re-permissioning records where there is no clear relevance, no plausible relationship, or the source is highly questionable. In those cases, recommend suppressing the records for now.

When writing a re-permission message, be transparent about why the person is being contacted. Do not pretend the relationship is stronger than it is. Do not use pressure, urgency, or vague value language. Make it easy to opt out.

8. Recommended next action.
Give one clear operational recommendation using one of these actions:
- Send to the clean segment.
- Segment the list first.
- Label the source of each record before sending.
- Re-permission weak records.
- Suppress unclear records.
- Ask the supplier for written provenance.
- Do not campaign to this list yet.
- Get privacy or legal advice before using this list.

Do not recommend asking a supplier, manager, privacy officer, or legal adviser unless the facts clearly support that step.

Keep the output practical. Use NZ English. Be direct. Do not give legal advice. Do not invent facts. If something is unknown, mark it as unknown and explain what decision it blocks.

The real signal

Vendor prospecting is not dead. Casual data is.

AI makes the temptation sharper because the labour has disappeared. The scrape, the enrichment, the segmentation, the email draft, the call script, the follow-up sequence. All of it is faster than it used to be.

That is exactly why the source matters more.

The better database is not the biggest one. It is the one you can confidently use with AI because the relationship, source, purpose, and opt-out path are clear.

Start there.

Pick one list. Find out where it came from. Label it. Ask the awkward questions. Build the next campaign around people who have a clear reason to hear from you.

That is a stronger business than buying another spreadsheet and asking AI to make it sound personal.

This is not legal advice. Use it as a prompt to review your prospecting data, supplier questions, privacy notices, and opt-out process. If you are making compliance decisions, get proper legal advice.

— The Listing Signal