Rules and ethics
Part of What the UK rules on appointment setting agencies mean for outsourced sales teams
Data protection before sharing prospect data with an agency
Data protection checks before sharing prospect data with an appointment-setting agency: lawful basis, UK GDPR terms, PECR screening and provider vetting.
What to take away
- The most common mistake is treating data protection as the agency's problem. Under the Data Protection Act 2018, your business is usually the controller and the agency is a processor acting on your instructions.
- You need a lawful basis before any list moves, recorded per contact rather than assumed from a job title.
- A written processor contract is mandatory. Without it, the transfer itself is a breach.
- Directors carry personal exposure for systemic failures, so reasonable care sits with you.
Who is responsible for prospect data
When you buy appointment setting services, the data flow looks simple but the legal roles are not. You decide why the data is processed, and what counts as a qualified lead. That makes you the controller. The agency dials, emails and records outcomes on your behalf, so it is a processor.
Controller and processor roles
- You decide why data is processed
- You define a qualified lead
- You are the controller
- Agency dials, emails, records outcomes
- Agency is the processor
That split matters because most enforcement risk lands on the controller. If the agency emails 4,000 contacts from a purchased list and a complaint follows, the Information Commissioner's Office looks at your instructions and your records.
For a wider overview of UK requirements for appointment-setting agencies, see our rules and compliance guide.
Lawful basis and consent records
You need one lawful basis per purpose. For cold B2B outreach many teams rely on legitimate interests, which requires a documented balancing test rather than a sentence in a policy.
Lawful basis records
- One lawful basis per purpose
- Documented balancing test for legitimate interests
- Separate basis for email and calls
- Record source of each contact
- Record date of each contact
- Record basis of each contact
The Privacy and Electronic Communications Regulations 2003 (PECR) governs unsolicited marketing calls and electronic messages alongside data protection law. Before making live marketing calls, screen numbers against the Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS); do not call a registered number unless that subscriber has specifically consented to calls from you.
For email, check whether the recipient is an individual or corporate subscriber. PECR generally requires consent for unsolicited marketing emails to individual subscribers, unless the soft opt-in applies; corporate subscribers can generally be emailed without consent, but the sender must identify itself and provide an opt-out. Where personal data is involved, these channel rules do not replace your UK GDPR duties.
Record where each contact came from, when, and under what basis. If you cannot show that trail, you cannot defend the contact later.
Before sharing personal data, use the ICO's data protection fee self-assessment to check whether your organisation must register and pay the fee; some organisations are exempt. This is separate from having a lawful basis for using the data.
The contract you must have in place
Article 28 of the UK GDPR requires a written contract between controller and processor. It must cover the subject matter, duration, nature and purpose of processing, the types of personal data, the categories of data subject, and your instructions.
It must also cover confidentiality, security, sub-processors, breach notification, help with subject requests, deletion or return of data at the end, and audit rights.
Founders signing that contract should note that director duties under GOV.UK's guidance on being a company director include promoting the success of the company and exercising reasonable care, skill and diligence.
Marketing rules that sit alongside data protection
The Committee of Advertising Practice (CAP) Code sets rules for non-broadcast marketing communications, including advertising claims and direct marketing. The Advertising Standards Authority (ASA) administers the Code and handles complaints.
That includes identification, honest claims, and honouring opt-outs promptly. The advertising rules for appointment setting agencies explain how the codes interact with scripts and call recording.
Vetting a provider before you share a list
Questions to ask in the first call
Ask which lawful basis and data source apply to each contact, how the agency records your instructions, and whether it will act as your processor or as a separate controller for any task. For live calls, ask how it screens against both the Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS), and how it records and shares objections and opt-outs. Ask who its sub-processors are and where data is stored.
Ask how the agency will help with subject access requests, what response times it commits to, and how quickly it will notify you of a breach so you can meet your own legal duties.
Documents to request
Request their processor terms, a current security summary, and their breach notification procedure. Ask for a sample suppression file showing how opt-outs and complaints are handled, plus evidence of the data source and lawful-basis assessment and the agency's TPS and CTPS screening process. If they cannot produce these before you share a list, do not share the list.
Scoring rubric for provider vetting
| Area | What good looks like | Weight |
|---|---|---|
| Lawful basis | Documented per contact, with date and source | 20 |
| Contract | Full Article 28 terms, signed before transfer | 20 |
| Suppression | TPS screening and opt-out log with audit trail | 15 |
| Security | Access controls, encryption, breach procedure | 15 |
| Sub-processors | Named, located, and covered by terms | 10 |
| Subject requests | Named owner and agreed response window | 10 |
| Training | Staff briefed on marketing and data rules | 10 |
Score each area out of ten, multiply by the weight, and total the result. Anything below 70 means fixing the gaps before the first call is made.
Common questions
Can an agency rely on legitimate interests for cold email?
It can, but you must show a balancing test and a clear opt-out route. The agency cannot make that judgement for you as controller.
Do we still need a contract if the agency only makes calls?
Yes. Any processing of personal data on your behalf needs a written processor contract under Article 28 of the UK GDPR.
What happens if the agency suffers a breach?
It must notify you without undue delay. You then decide whether to notify the ICO within 72 hours of becoming aware.
Does this apply across the UK?
The Data Protection Act 2018 and UK GDPR apply UK-wide. This is general guidance only, and individual cases need a qualified adviser.
