GDPR-compliant telecom data for KYC

Querying phone intelligence against a customer number during KYC is a legitimate and proportionate processing activity under GDPR when used for fraud prevention or identity verification. Telebase processes only the phone number you submit and returns carrier, country, number type, active status and a SIM swap signal. No subscriber identity data is returned. No data is shared with third parties for advertising or marketing purposes.

The legal basis for processing phone intelligence in KYC

GDPR does not prohibit using telecom signals in KYC. Processing phone numbers to verify identity or prevent fraud generally falls under Article 6(1)(f), legitimate interests, where the risk of fraud or identity theft is proportionate to the intrusion involved. The intrusion is limited: Telebase receives a phone number and returns network metadata. No name, address or subscriber record is involved.

Firms subject to Anti-Money Laundering obligations, regulated by the FCA in the UK, or under the Fifth Anti-Money Laundering Directive in the EU, have an additional basis under Article 6(1)(c) for processing data required by law. If your KYC process is mandated by AML regulation, the legal basis for querying phone intelligence as part of that process is straightforward.

Firms operating under UK GDPR (post-Brexit) follow the same test under equivalent domestic provisions. The substantive standard has not diverged materially from EU GDPR for this category of processing.

What Telebase returns, and what it does not

Telebase returns technical metadata about a phone number, sourced from network intelligence rather than subscriber records. The response contains:

• carrier: the network operator currently serving the number
• country: the country where the number is registered, as an ISO 3166-1 alpha-2 code
• numberType: mobile, landline, fixedVoip, nonFixedVoip, tollFree, or voicemail
• active: whether the number is currently reachable on the carrier network
• simSwap: recent SIM swap signal, launching; returns UNKNOWN today for GB, DE, NL and FR while carrier registration completes

Telebase does not return the subscriber's name, address, or any other personal identifier. It does not access or return call records, message content, or location data.

Example API response

Request a lookup for a UK mobile number in E.164 format. The leading + must be URL-encoded as %2B.

Request

curl -s 'https://telebase.fatcatremote.com/api/lookup?phone=%2B447700900000' \
  -H 'Authorization: Bearer tb_live_xxxxxxxxxxxxxxxxxxxxxxxx'

Response, 200 OK

{
  "phoneNumber": "+447700900000",
  "active": true,
  "carrier": "EE",
  "country": "GB",
  "numberType": "mobile",
  "simSwap": "UNKNOWN",
  "simSwapAt": null,
  "_meta": { "activeSource": "LINE_STATUS" }
}

simSwap returns UNKNOWN for GB, DE, NL and FR numbers while the carrier feed is being registered. When live, it returns SWAPPED, NO_SWAP, or UNKNOWN. _meta.activeSource of LINE_STATUS means the active signal comes from a live carrier status check, a strong signal. A value of VALID means format-only validation was used as a fallback and the active claim should be treated as weaker.

Data minimisation and retention

Telebase operates as a point-in-time lookup. The API does not cache query results beyond request handling. Your system receives the response and determines what to retain. Good practice is to log the decision, for example a fraud flag or a clear outcome, rather than the raw carrier response, and to tie the record to your KYC audit trail rather than a freestanding data store.

Under the data minimisation principle, retaining only the risk decision rather than the underlying telecom response reduces your GDPR surface area and simplifies data subject access request handling.

Merchant of record and data transfers

Telebase billing is handled via Paddle as the merchant of record. Coverage is live for GB, NL, DE and FR, meaning queries involve processing within or touching European Economic Area networks. No data is shared with advertising or marketing third parties.

Pricing

$0.03 per query. No contract. No minimum spend. New accounts receive a $5.00 starting balance. Top-up is handled via Paddle.