Let's Chat

Cold Calling Law in the UK: What B2B Sellers Must Know

Cold calling is not illegal in the UK. For live calls to businesses, the law does not ask for prior consent, but it does ask you to screen your list against the TPS and CTPS registers, respect anyone who has already said no, identify yourself and handle any personal data lawfully. Break those rules and the Information Commissioner’s Office (ICO) can fine you. I see sales teams get this wrong in both directions: some think the phone is off limits, others think B2B calling is a free-for-all. Neither is true.

This guide is written for business owners, sales leaders and solo consultants who sell to other businesses. It covers live calls, not recorded or automated ones, and it is general information rather than legal advice. If your sales activity touches pensions, claims management or consumer finance, speak to a solicitor or your compliance officer before you pick up the phone.

Aheadofsales
Build a More Confident Sales Team
Aheadofsales combines bespoke 1:1 coaching, sales training and consultancy to help businesses improve sales performance.

Explore sales training

TL;DR

Table of Contents

Yes. The rules sit mainly in the Privacy and Electronic Communications Regulations (PECR), which govern live and automated marketing calls, with UK GDPR layered on top whenever personal data is involved. The ICO’s guidance is clear that businesses generally do not need consent for live direct marketing calls if they have screened against the TPS and CTPS and the person has not previously objected.

That is quite different from automated, recorded calls, which need prior, specific consent. A person dialling from a desk is treated very differently from a machine dialling thousands of numbers.

Rules for live and automated marketing calls

The ICO also reminds businesses that live calls are intrusive. Even where a call is lawful, you should avoid causing unjustified harm or distress, particularly to vulnerable people. In practice that means a polite opener, a quick exit when someone is not interested, and no pressure tactics.

TPS and CTPS: the screening rule that catches most people out

The Telephone Preference Service (TPS) and the Corporate Telephone Preference Service (CTPS) are the two statutory “do not call” registers. The ICO describes them as a general objection to live marketing calls. In B2B marketing you need to screen against both, plus your own internal suppression list:

Register Who it protects Applies to your B2B list?
TPS Individuals and sole traders Yes, if your list includes sole traders or some partnerships
CTPS Corporate bodies such as limited companies Yes, for limited company switchboards and direct lines
Your own do-not-call list Anyone who has told you not to call Always

The ICO sets out that split in its business-to-business marketing guidance. The practical consequence for a solo consultant is easy to miss: if your ideal client is another sole trader or a small coach, the TPS is the register that matters, not just the CTPS.

The 28-day window

A number must have been on the TPS or CTPS for 28 days before registration takes effect, and you must screen before calling. A list you bought or cleaned six months ago is out of date. Build screening into the workflow so that every batch is checked immediately before the first dial.

When can you call a registered number?

Only if that person has consented to calls from you. The ICO’s penalty notice against Thermotech, dated 28 May 2026, is a useful reminder of how narrow that consent is. The notice says any consent overriding a TPS or CTPS listing must show willingness to hear from that specific caller, not generic agreement to hear from “third parties” or “partners”. Consent to marketing in general does not override the register unless it clearly includes telephone marketing.

If you buy data, ask the supplier exactly what wording the individual saw. “We may share your details with selected partners” will not carry you past a TPS listing.

What you must say and show on every call

The identification rules are simple, and teams still slip on them:

  1. Say who you are. Callers must identify their organisation at the start.
  2. Show a number people can call back. You must display your number or an alternative contact number, and give a postal address or Freephone number if asked.
  3. Never withhold your caller ID. PECR says you must not withhold or prevent the presentation of Calling Line Identification. The government tightened this in 2016 amendments so that enforcement bodies can trace unwanted callers more easily.

If you are running outbound from a CRM dialler, check what number the prospect actually sees. Some systems default to a withheld or unreturnable number, and that is a breach by itself.

Personal data: where UK GDPR comes in

PECR does not replace data protection law. When you use personal data to make a call, such as a named buyer’s direct line or mobile, UK GDPR also applies. You need a lawful basis, typically consent or legitimate interests, and the processing must be fair, lawful and transparent.

For most B2B outbound, legitimate interests is the basis teams rely on. That is fine if you have actually thought it through and recorded why: what you are trying to achieve, why calling is necessary, and why the individual’s rights do not override that. A work email or a switchboard number is generally lower risk than a personal mobile found on social media, but a named person’s details are still personal data.

We cover the email side in more detail in our GDPR checklist for cold emailing, and the same discipline of lawful basis, transparency and record keeping carries over to the phone.

Keep records

Businesses should keep records of consent. Where you rely on it, valid consent must be freely given, specific, informed and unambiguous, usually shown through a clear opt-in action. A practical minimum for any sales team:

Stricter rules for regulated products

If you sell anything near financial services, the general B2B position does not apply. The ICO notes that claims management marketing calls require consent, and pension scheme calls are limited to trustees, managers or FCA-authorised firms, and then only with specific consent or a qualifying relationship.

The government has also consulted on extending the pensions cold calling ban to all consumer financial services and products. The FCA’s rules for claims management go further: they prohibit cold calls in person for regulated claims management activity, and firms must retain telephone call recordings for at least 12 months from the latest applicable event under the rules.

If you are a sales trainer or consultant working with clients in these sectors, the compliance script matters as much as the sales script.

Stricter rules for regulated products

What happens if you break the rules

The ICO enforces PECR and has a record of issuing monetary penalties against companies that call numbers on the TPS or CTPS without valid consent. The Thermotech notice mentioned above is a recent example. The maximum penalty has also risen: according to one analysis, PECR breaches can now attract up to £17.5 million or 4% of worldwide turnover, following the Data (Use and Access) Act 2025, compared with the old £500,000 cap. Most fines in practice have been far lower, but the direction of travel is obvious.

The larger business risk is often reputational. A complaint to the ICO or a TPS investigation lands on your managing director’s desk, and the discovery that a sales team has been running unscreened lists can derail a deal with a cautious corporate buyer.

A compliant cold calling workflow

Here is the process I would put in place for a B2B team of any size:

  1. Define your target and basis. Decide who you are calling and why, and document your lawful basis.
  2. Source data properly. Know where each record came from and what the person was told.
  3. Screen before every campaign. Check against the TPS, the CTPS and your internal list, and log the date.
  4. Brief your reps. They should state the company name, be ready to give a callback number and never block caller ID.
  5. Honour objections instantly. If someone says “don’t call me again”, add them to your suppression list the same day.
  6. Review quarterly. Re-screen live lists and check that nobody is working from an old export.

Our guide to sales prospecting in the UK shows how to build target lists in a way that makes this screening easier, and the lead qualification process helps reps spend calls on prospects who are genuinely likely to buy.

Our perspective on cold calling

We work with UK sales teams and solo service owners, and what we see is that fear of the law pushes people away from the phone when the phone is often their fastest route to a conversation. The law is not the obstacle. Poor targeting is.

A compliant call list is a smaller, sharper list. When a rep is calling the right person at the right type of company, with a clear reason for the call, the call is shorter, the objections are fewer and the risk of complaint drops. The teams that struggle are usually dialling huge, untargeted lists with a script built around getting past the gatekeeper, and those are the teams that fall foul of the TPS.

My advice is to treat compliance as part of the sales process rather than a legal afterthought. Put screening in your CRM, give reps a one-page call standard, and coach them on how to take a “no” gracefully. Prospects remember how you handled it, and a respectful exit often earns you a second call later when the timing is right.

If you are selling services solo, you do not need a compliance department to do this well. You need a clean list, a clear opener and a record of what you did.

— Jerry

Getting your team calling confidently

Compliance covers what you may do. It does not teach your people how to open a call, handle an objection or book a meeting. That is where we work. Our team engagements combine bespoke coaching and consultancy for £4,500 to £8,500, and our sales acceleration track for solo service businesses and consultants runs from £2,995 to £5,995. You can see how each is structured on our sales training cost page.

Aheadofsales

If you need senior sales leadership without a full-time hire, our fractional sales director service can set up the process, the targets and the call standards for you.

FAQ

Yes. Live B2B calls do not generally need prior consent, but you must screen against the TPS and CTPS and your own do-not-call list, and honour any earlier objection. You must also identify yourself and show your caller ID. If the call uses a named person’s details, UK GDPR applies too.

Do I need to screen against the TPS if I only call limited companies?

Yes, you need the CTPS for corporate bodies. If your list also includes sole traders or some partnerships, you need the TPS as well. Most teams simply screen against both, which avoids guessing about a business’s legal structure.

How long does it take for a TPS or CTPS registration to apply?

A number must be on the register for 28 days before the registration takes effect. That is why you should screen immediately before each campaign, rather than relying on a list that was checked weeks or months ago.

Not necessarily. If their number is on the TPS or CTPS, the consent must clearly cover telephone marketing from your organisation specifically. Vague consent to hear from “partners” or “third parties” will not override the register.

What are the penalties for illegal cold calling?

The ICO can issue monetary penalties for PECR breaches, and the maximum has been raised to £17.5 million or 4% of worldwide turnover under the Data (Use and Access) Act 2025. Actual fines depend on the scale and nature of the breach.

Sources

Leave a Reply

Your email address will not be published. Required fields are marked *