Navigating Cold Calling - UK Compliance for Call Centers
For call centres, outbound calling is just another day at the office — until a complaint lands on your desk or the ICO comes knocking.
With the rules around cold calling becoming stricter and enforcement ramping up, it’s easy to get caught out, even with the best intentions.
Many organisations still believe that business-to-business calls are exempt, but recent high-profile fines prove otherwise. It’s not just about checking a box anymore — compliance needs to be part of your daily operations.
This blog will walk you through what the law actually says, how enforcement works in practice, and the practical steps you can take to protect your business.
If you’ve ever wondered what TPS, CTPS, or PECR mean for your team — or if you're simply not 100% confident your next campaign is legally watertight — keep reading.
This could save your business more than just money.
Understanding the Regulatory Landscape
The main rules on cold calling other businesses are to be found in the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”).
Essentially, PECR prohibits an organisation from making cold calls to both members of the public and businesses if they have registered their phone number with a telephone preference service or if they have indicated that they do not want to receive marketing calls from the organisation, that is they have opted out.
However, they may make the call if the person receiving the call has given their consent to it. The consent being to the high GDPR standard of freely given, specific, informed and unambiguous. It must be a positive affirmative action from the person agreeing to the marketing call.
There are two telephone preference services in the UK, which are:
The Telephone Preference Service (TPS)
The TPS is available to members of the public to block unwanted marketing calls. It is a free service where anyone doing a cold calling marketing campaign should check the numbers they are calling against it. It essentially operates as an opt-out register.
Failing to respect the wishes of those registered with the TPS may be a breach of PECR, which could have very serious consequences.
PECR is enforced by the Information Commissioner’s Office (the ICO), which has the power to impose large fines of up to £500,000 on companies and organisations who fall foul of the rules. If they find that a director has been complicit in the breach, they may also face the same level of fine personally.
The Corporate Telephone Preference Service (CTPS)
Similar to the TPS, there is also the CTPS, which is a blocking service for businesses who do not want unsolicited marketing calls. The service operates in the same way as the TPS and breaches can have serious consequences.
For many years, the CTPS was not enforced much at all by the ICO, as they appeared to focus on protecting individual members of the public.
However, this changed in two recent enforcement cases: in 2023, Ice Telecommunications was fined £80,000 for breaching the CTPS and UK Direct Business Solutions was fined £100,000. Both companies had made unlawful marketing calls to businesses signed up with the CTPS.
With the rules now more stringently enforced, it’s essential to understand how the ICO identifies breaches. Let’s look at the powers the ICO has — from complaint handling to full investigations — and how enforcement plays out.
The ICO's Investigative Powers and Enforcement Actions
The ICO doesn’t just wait for issues to escalate — it keeps a close eye on how organisations handle their marketing practices. In many cases, the enforcement process starts with something simple: a single complaint.
Complaint Handling
The Direct Marketing Association (DMA) is responsible for operating both the TPS and CTPS on behalf of the ICO. The ICO closely monitors the complaints that are received about companies and other organisations regarding unwanted cold calling and breaches of the opting-out services.
If the complaint levels become significant, the ICO is likely to start a formal investigation against the body concerned.
The ICO’s Investigative Powers
The ICO has a range of investigative powers available to them, which include the following:
- They may request information from organisations, including call centres, about how others are handling data. They are usually done by use of Third-party Information Notices, known as ‘3-PINS’. The ICO has the power to compel those receiving a 3-PIN to provide the information they require.
- They have the power to conduct audits and inspections.
- They have the power of entry to search premises under warrant, when they believe there is a serious concern about non-compliance of the data protection laws.
- They may write to an organisation under suspicion of breaching the data protection laws, including PECR 2003, and request information directly from them, which is how most investigations commence.
Enforcement Actions
The ICO have a number of enforcement powers available to them, which include the following:
- Provide practical advice to organisations on how they should handle data protection matters.
- Serve Enforcement Notices where there has been a breach, requiring organisations to take (or refrain from taking) specified steps in order to ensure they comply with the law.
- Conduct compulsory or voluntary assessments (audits) to check organisations processing of personal data.
- Issue monetary penalty notices requiring organisations to pay up to £500,000 for serious breaches of PECR. These fines are set to rise dramatically by new legislation passing through Parliament, which will take them to the GDPR levels of £17.5 million.
- Issue monetary penalties of up to £500,000 against directors, managers, a secretary or similar officer of an organisation committing a serious contravention of PECR, which means they may be personally liable for the penalty.
Again, these penalties are set to rise dramatically under new legislation. Awareness of the law is crucial — but compliance lives in the day-to-day operations of your call centre.
The following section breaks down practical steps to ensure your processes align with regulatory expectations.
Practical Implementation for Call Centres
Given the nature of call centres and their involvement in data handling and direct marketing calls, there are a number of practical implications for them in terms of how they comply with the data protection laws and PECR, which include:
- Using reputable data providers and ensuring detailed checks are made to verify that any consent relied upon to make direct marketing calls is confirmed as being up to the GDPR standard.
- If consent is not being relied upon to make direct marketing calls, the call centre must make sure that they are not calling numbers registered with either the TPS or CTPS. This is done by either using data that has been checked recently against the opt-out services or by the call centre screening the data against them.
- Similarly, the call centre or those using their services for telesales should maintain a list of those people who have indicated that they do not want to receive marketing calls, which is usually called a “Do Not Call” or suppression list. Any telephone campaign data lists should be screened against the suppression lists to remove any numbers that should not be called.
Even with the right processes, missteps can happen. That’s why understanding how to proactively avoid fines — and what enforcement actions look like — is vital. In the next section, we cover steps to safeguard your business.
Avoiding ICO Fines and Enforcement
There are a number of practical steps businesses can take to avoid falling foul of the ICO and their far-reaching enforcement powers. Whilst the fines may not be so significant at the moment, they are set to rise to eye-watering levels.
Enforcement action also has serious consequences for an organisation’s reputation, as the ICO publishes cases on their website, so it becomes public knowledge.
Companies embarking on cold calling campaigns, including the call centres involved, should ensure they carefully plan their compliance with the rules.
This includes ensuring the data is fit for purpose by buying it from a reputable supplier, checking that it is safe to use and ensuring it is properly screened against the telephone preference services and any relevant suppression list.
They should ensure that appropriate staff training is provided to ensure sales or call agents understand how to deal with any issues that might arise. Particularly if someone receiving a call wishes to complain or is indeed registered with the opt-out services.
Likewise, that they understand how to properly dispose of a call, especially someone who has indicated they do not wish to receive any further marketing calls.
It is vital to remember the importance of regularly monitoring and reviewing your systems and processes to ensure they are compliant and up to date with any regulatory or legislative changes.
Consider using suitable external professionals to take an objective look at what you are doing and whether it is likely to fall foul of the data protection rules and mobilise the ICO into taking action.
To Sum it All Up
In today’s regulatory climate, ignorance isn’t just risky — it’s expensive. Cold calling remains a valuable tool for many organisations, but only when done responsibly and in compliance with data protection laws.
With fines rising and enforcement becoming more aggressive, especially toward businesses ignoring opt-out registers like TPS and CTPS, call centres can no longer afford to cut corners.
Beyond the financial penalties, the reputational damage from an ICO investigation can be long-lasting. That’s why it’s vital to ensure your processes are robust, your staff well-trained, and your data legally sound.
If you’re unsure whether your current approach meets the legal standard, I can help. As a solicitor experienced in this area, I offer clear, practical advice tailored to your business — before small mistakes turn into major legal problems.
Get in touch today for peace of mind.