Check your appointment setting agencies disclosure policy

PECR : The Privacy and Electronic Communications Regulations 2003, which govern electronic marketing and cookies.

CAP Code : The Committee of Advertising Practice code, enforced by the Advertising Standards Authority.

TPS : The Telephone Preference Service, a register for people who have objected to marketing calls.

CTPS : The Corporate Telephone Preference Service, a register for corporate numbers that have objected to marketing calls.

UK GDPR : The UK General Data Protection Regulation, which governs the processing of personal data.

Lawful basis : The reason under the UK GDPR that permits personal data to be processed.

CLI : Caller line identification, the number shown to someone receiving a call.

Suppression list : A record of numbers or people who have objected and should not be contacted again.

Read the terms as a campaign map

Use the glossary as a routing tool: classify the contact, the information used, and any claims made before choosing caller instructions. A campaign can involve live marketing, personal data and advertising at once, so assess each activity rather than treating everything as one legal question.

Apply the PECR live-call requirements, including consent and screening, to the calling activity rather than to the list in general. The UK call rules explain the relevant requirements. The statutory wording is in the Privacy and Electronic Communications Regulations. Check TPS and CTPS status as applicable, alongside the agency's own suppression records.

For lists and call logs, identify the personal data handling requirements, including a lawful basis, privacy information and storage limitation. Check whether the agency must pay the ICO data protection fee and appear on its register of fee payers; exemptions apply. The Data Protection Act 2018 supplements the UK GDPR.

The CAP Code is relevant when an agency promotes its own services or makes advertising claims. The ASA publishes a list of non-compliant online advertisers that can include B2B lead-generation and appointment-setting firms. Its rules on recognising marketing communications provide a further reference for CAP Code recognition.

Put representation before persuasion

A caller should make the agency's role and the client's role clear before moving into the pitch.

The prospect needs to know which agency is speaking, which client commissioned the contact and why the call is being made. A single instruction set should apply to employees, contractors and offshore dialling teams.

Subcontracting does not remove the agency's responsibility for its callers. Keep caller instructions distinct from the privacy notice: one governs what happens in conversation, while the other explains how personal data is handled. The UK compliance guide can help keep those documents consistent.

At the start, identify the caller and both organisations, name the company paying for the contact, and give a clear reason for approaching the prospect. If a call is recorded, say so at the outset and explain why. Make relevant privacy information available, and ensure the caller scripts state that a working CLI must not be withheld.

A displayed number should let the recipient contact the agency or opt out. Give people a simple way to object and prepare callers to respond consistently. If someone objects to marketing, end the call and record the objection that day; the objection process should also explain how the suppression list is updated.

Do not suggest a previous relationship unless the records support that statement. Check product claims in the script against evidence supplied by the client before launch. The advertising rules help establish the limits for claims made during a B2B pitch.

Keep proof attached to each contact

A useful record should let the agency reconstruct a call and explain why that number was contacted. Link the person or number to the caller, campaign instructions and any objection. Records scattered across locations that nobody checks cannot reliably show what happened or support a response to a concern.

Log the date, time, number, caller and outcome, including any objection. Retain evidence of consent or another applicable basis for each list, and document the reasoning when relying on legitimate interest. The record should make it possible to understand both the contact and the basis on which it was made.

Set a retention period for each record type, justify it by its purpose and legal needs, and review it. At the end of that period, delete or anonymise the record. Keep only the objection details needed to honour a request, rather than leaving suppression information in an unchecked spreadsheet.

Use retrieval as a practical test: can the team produce the evidence behind an individual call within an hour? An agency making 900 calls a month should be able to find the log for any number. If it cannot, clarify where records sit and who is responsible for locating them.

Recheck the vocabulary when work changes

Review caller instructions when the client, list source or script changes, not only on a calendar date. A change may affect what callers disclose, which numbers can be contacted, what evidence must be retained or which claims they make. Update the instructions and brief the people making calls.

The agency owns the policy for its callers, while the client should approve the script and product claims. Record that approval in the contract. Agency due diligence can help make responsibilities clear before a campaign begins.

An annual review can provide a backstop, but it should not replace checks triggered by change. PECR and the CAP Code apply across the UK, and the ICO handles data protection for all four nations. One policy can therefore cover a business operating in England, Scotland, Wales and Northern Ireland.

This is general guidance, not advice for an individual case. If a campaign raises a specific question about its lawful basis, consent or claims, seek advice from a qualified adviser before relying on standard instructions or a caller script.