Cold calls or consent first, what appointment setting agencies UK regulations require

What to take away

A Manchester software firm buying 5,000 cold call records for its outsourced SDR team still needs a lawful basis under the UK GDPR and the Data Protection Act 2018 before the first dial, and the agency cannot supply one on the client's behalf.
Calls to individuals need consent or the narrow soft opt-in, while corporate calls run on an opt-out basis and numbers on the TPS or CTPS must not be called.
Email outreach sits on a different footing to calls, but the rules on who is liable for a breach do not move.
Employment status for agency staff is a client risk too, because a tribunal can look through the contract to the reality of control.
Advertising claims an agency makes about its own results fall under the CAP Code, and the ASA expects evidence before publication.

Consent, soft opt-in and the first dial

For appointment setting agencies the legal rule turns on who is being called. Calls to individuals and sole traders need consent or the narrow soft opt-in, while calls to corporate subscribers run on an opt-out basis. Numbers registered with the Telephone Preference Service or the Corporate Telephone Preference Service must not be called at all: under the Privacy and Electronic Communications (EC Directive) Regulations 2003, organisations are legally required to refrain from calling a registered number. Most sales directors assume the agency carries the compliance load, but buying a list rarely satisfies the soft opt-in, and the agency must itself be registered with the ICO and pay the data protection fee.

A non-compliant one reuses a bought list without checking the basis.

A compliant campaign starts with a source map and a valid basis under the UK GDPR and the Data Protection Act 2018.

For email, the ICO's guidance on direct marketing using electronic mail sets out the consent and soft opt-in tests and how they apply to corporate subscribers. A valid soft opt-in wording example is: "We will email you about similar products. You can opt out at any time." Context matters: the contact must arise from a sale or negotiations.

A numbered sequence for onboarding an agency

Map every data source the agency will use and record the lawful basis for each before any contact. Evidence: a data source map naming each list, its origin and lawful basis.
Check the agency's privacy notice names your firm as controller or joint controller where that is the reality. Evidence: the current privacy notice and a signed controller or joint controller schedule.
Confirm the suppression process, including how a refusal reaches your CRM within 24 hours. Evidence: a suppression log with timestamps. A 24-hour target is practical because it covers an overnight batch and one working day, but prompt suppression is the legal test.
Put the employment status of staff working solely on your account in writing, addressing control and substitution. Evidence: the written status assessment and PAYE evidence.
Agree the evidence file for any performance claim the agency publishes about your campaign. Evidence: the claim file with source data and calculation method.
Review the arrangement quarterly against current ICO guidance and your legitimate interests assessment. Evidence: a dated review note and updated legitimate interests assessment.

Steps two and four are where most disputes start. An agency that controls the data independently cannot be directed like an employee.

Who controls the data?

Does the agency control the data independently?

Yes

Cannot be directed like an employee

Can be directed like an employee

Onboarding an agency: six steps

Map data sources and lawful basis
Check privacy notice controller status
Confirm suppression within 24 hours
Put employment status in writing
Agree evidence for performance claims
Review quarterly against ICO guidance

Sector-specific rules and disclosure duties are set out in the appointment setting agencies UK rules and compliance guide, which is worth reading alongside a draft supplier agreement.

Employment status and the contract

The written statement duty sits in the Employment Rights Act 1996, and the GOV.UK guidance on contracts of employment and working hours sets out what that statement must contain and the difference between an employee, a worker and a self-employed contractor. Agency SDRs who work only on your account, at your premises or on your systems can fall into the worker category even when the paperwork says otherwise. Off-payroll working rules, known as IR35, matter where an agency engages its own SDRs through personal service companies, and the size of the client decides who carries the status determination.

A tribunal finding can produce arrears of holiday pay and national insurance exposure that no agency indemnity fully covers. Ask for the agency's own contracts and its PAYE evidence before you sign.

A compliant clause names the agency as processor or joint controller. It gives you audit rights over data sources and suppression logs, and caps indemnities so they do not purport to transfer PECR liability.

Advertising claims by agencies

Agencies market themselves with figures: meetings booked, conversion rates, pipeline value. Those claims are advertising, and the CAP Code section 3 (Misleading advertising) requires them to be substantiated before they appear. The ASA publishes CAP webinars covering how the rules apply to performance claims, useful when assessing a pitch deck.

The same logic applies to your own outbound messaging. If your agency writes a claim about your product, you are the advertiser and you own the evidence. Our breakdown of appointment setting agencies advertising rules explains how the CAP Code treats testimonials, comparisons and typical results.

Records, retention and audit evidence

Keep a written record of every lawful basis decision, suppression request and consent captured, with timestamps. The ICO enforces PECR and can impose monetary penalties for serious breaches, and a short audit trail is far cheaper than an investigation. Set retention by purpose, not convenience: if call recordings are kept for quality, a typical retention period is 90 days, but the right period is what purpose and necessity require.

Common questions

Buyers ask the same questions each time they weigh an agency's cold-calling duties against consent.

Does the agency or the client hold the legal risk?

Both can. The client is normally the controller and carries the primary duty for the lawful basis, while the agency has its own obligations as a processor or joint controller. Indemnities shift cost, not liability.

Do business-to-business cold calls need consent?

Not always: corporate calls run on an opt-out basis unless the number is registered with the Corporate Telephone Preference Service, which must be screened. For individuals the soft opt-in is narrow and list purchases rarely qualify. Check the rules for the subscriber type before any campaign goes live.

Can an agency publish conversion statistics in its marketing?

Yes, provided it holds evidence for the claim and can show it on request. Unsubstantiated figures breach the CAP Code.

Is an agency SDR ever my employee?

Possibly, if you control how, when and where they work. Employment status follows the reality of the relationship, not the label on the contract.

This is general guidance only. Individual cases need a qualified adviser. PECR and the CAP Code apply across the UK, but enforcement routes and court procedure differ in Scotland and Northern Ireland, and Wales shares the England and Wales jurisdiction for most civil claims.