UK cold calling rules in 2026: TPS, CTPS, PECR and Ofcom explained

Not legal advice. This is a plain-English summary of official guidance, written by a software company. Rules and guidance change. Check the sources linked below and take legal advice for your own situation.

1. The rules that apply

Three sets of rules matter for most UK teams making live sales calls to businesses:

• PECR, the Privacy and Electronic Communications Regulations 2003. These cover marketing calls, texts and emails, including the TPS and CTPS. The Information Commissioner's Office (ICO) enforces them.
• UK GDPR and the Data Protection Act 2018, which cover the personal data you hold about the people you call: names, direct lines, mobile numbers, notes and recordings.
• Ofcom's persistent misuse policy, under the Communications Act 2003, which is where silent and abandoned calls from diallers are dealt with.

"B2B" doesn't switch these rules off. The ICO's telephone marketing guidance says the rules for calling businesses are the same as for calling individuals.

2. TPS and CTPS: who is on which

The Telephone Preference Service (TPS) is the register for individuals who don't want live sales calls. The Corporate TPS (CTPS) is the register for corporate subscribers. Under PECR you mustn't make a live marketing call to a number on either register unless that subscriber has specifically told you they're happy to receive your calls.

Which register applies follows the type of subscriber:

The practical result is the one the ICO spells out: for B2B calls without consent, you need to screen against both the TPS and the CTPS. A local trades list is full of sole traders, so a CTPS-only check isn't enough.

3. Screening your list

Screening means checking each number against the registers before you call. You can buy checks from a licensed screening provider, either in bulk or built into your CRM or dialler. Then:

• Screen your own do-not-call list too. The ICO also expects you to screen against your own list of people who've told you not to call.
• Screen again regularly. Registers change daily. Many callers re-screen at least every 28 days, a figure widely linked to how long new registrations take to come into effect. We haven't confirmed that timing with the TPS; check the TPS site.
• Keep a record of when each number was checked and the result.
• Record consent properly. If a business on the register tells you they're happy to hear from you, note when, how and who said it.

In Patchline, screening runs at the moment of the dial. In Block mode, a listed number, or one not screened in the last 28 days, won't ring unless consent is recorded. How TPS screening works in Patchline →

4. What you must do on the call

The ICO's guidance for live calls says you must:

• Say who is calling. Give your company name at the start, not after the pitch.
• Show a number (or an alternative contact number) to the person you're calling. Don't withhold caller ID.
• Give a contact address or freephone number if asked.
• Respect objections. If someone says they don't want your calls, stop and add them to your do-not-call list.

The ICO guidance also says you can't make unsolicited calls marketing claims management services. If you sell in a regulated sector, check the rules for that sector before you call.

5. Automated and recorded calls

Automated marketing calls, where a system plays a recorded message, are much stricter. The ICO says you need specific consent for automated calls; general marketing consent, or even consent to live calls, isn't enough. A power dialler that connects answered calls to a live rep is not making automated calls in this sense, because a person is on the line for every answered call.

6. Ofcom and diallers

If your team uses any kind of auto-dialler, Ofcom's persistent misuse policy is the other set of rules to know. It deals with silent and abandoned calls and sets out the steps Ofcom takes into account: a low abandoned-call rate, an information message, a 72-hour gap before redialling, a minimum ring time and caller ID. We cover it in detail, including the uncertainty about the 3% figure, in Ofcom's 3% abandoned call rule.

7. UK GDPR and your lead data

Company details aren't personal data, but a director's name, direct line or mobile, and your call notes, are. Most B2B callers rely on legitimate interests as their lawful basis, which means writing a short legitimate-interest assessment, telling people where you got their details when asked, and honouring objections and erasure requests. Keep only what you need, and tell people if calls are recorded.

8. Enforcement and fines

The ICO enforces PECR and UK GDPR. Several law-firm summaries report that the Data (Use and Access) Act 2025 raised the maximum PECR fine from £500,000 to the UK GDPR level of £17.5 million or 4% of worldwide turnover, from 5 February 2026. We haven't confirmed the commencement detail against the legislation itself; check the ICO's current guidance. Ofcom can separately act against persistent misuse.

9. A short checklist

1. Decide who you'll call and why, and write down your lawful basis.
2. Screen every number against the TPS, the CTPS and your own do-not-call list, and repeat regularly.
3. Record consent and opt-outs with dates.
4. Show a UK number you can be called back on.
5. Open every call with your name and company.
6. If you use a dialler, follow Ofcom's abandoned-call steps.
7. Train your team, and keep records you can point to later.

Patchline gives you tools for most of this list: screening, calling hours, consent and opt-out records, a do-not-call list and Ofcom guard rails. The decisions and the conversation stay yours. What the software does, and what's on you →

10. FAQ

Official sources

• ICO: telephone marketing guidance
• ICO: direct marketing and PECR
• Telephone Preference Service (TPS and CTPS)
• Ofcom: persistent misuse policy