Rules and ethics
What the UK rules on appointment setting agencies mean for outsourced sales teams
A practical guide to the law and ethics governing appointment setting agencies in the UK, from cold calling rules to contracts and company transparency.
What to take away
- Appointment setting agencies in England answer to PECR, the UK GDPR, the CAP Code and the Companies House register of people with significant control.
- Live cold calls to individual subscribers need prior consent, TPS screening is mandatory, and CTPS objections from companies must also be honoured.
- Client and agency usually act as controllers, so commissioning a campaign does not remove your exposure to the ICO.
- A five-step vetting check, a defined qualified appointment and a liability cap cover most of the practical risk.
Who regulates appointment setting agencies in England
Four duties sit behind every campaign: who you may contact, what you may say, what you must disclose, and how you keep the data.
The ICO enforces PECR and the UK GDPR. The ASA polices the CAP Code. Companies House polices the people with significant control register, which names the agency's real owners.
The Financial Conduct Authority applies where an agency books meetings for regulated financial firms.
Consent, TPS and CTPS screening for cold calls
Under PECR, unsolicited live marketing calls must not be made to numbers registered with the TPS or to people who have objected; prior consent is required for automated calls. Numbers on the TPS must be screened out before dialling. Sole traders and unincorporated partnerships sit on the individual side of that line.
The rules for live calls, automated calls, email and cookies come from the Privacy and Electronic Communications (EC Directive) Regulations 2003.
Corporate subscribers get more latitude. A live call to a limited company does not need consent, but the caller must identify itself and supply a contact address or number. CTPS registration changes that, because a company that has objected should not be called.
Cold email works to a different test. The soft opt-in applies only where details came from a sale or negotiations for a sale, the products are similar, and an opt-out was offered.
Legitimate interests can support some business-to-business outreach, but the assessment must be documented. Ask to see it. Our guide to appointment setting agencies UK regulations sets out the consent-first position for B2B calling.
Compliance rules at a glance: who regulates what
Compliance rules at a glance
| Area | Rule and regulator | What it means in practice |
|---|---|---|
| Live cold calls | PECR 2003, ICO | Identify the caller, give contact details, screen TPS and CTPS |
| Cold email | PECR 2003 and UK GDPR, ICO | Soft opt-in or consent, with an opt-out in every message |
| Advertising claims | CAP Code, ASA | Substantiate meeting volumes, results and testimonials |
| Company ownership | Companies House, PSC regime | Keep and file a register of people with significant control |
| Data handling | UK GDPR, ICO | Lawful basis, privacy notice, retention, subject rights |
| Contract terms | Common law, Consumer Rights Act 2015 | Clear scope, payment triggers and liability caps |
Compliance areas and where risk sits
Area
- Live cold calls
- PECR 2003, ICO
- Cold email
- PECR, UK GDPR
- Advertising claims
- CAP Code, ASA
- Company ownership
- Companies House, PSC
- Contract terms
- Common law, CRA
- Data handling
- UK GDPR, ICO
Rule or regulator
- Live cold calls
- Fines, reputational damage
- Cold email
- ICO complaints, domain blocking
- Advertising claims
- ASA ruling, Trading Standards
- Company ownership
- Penalties, disqualification
- Contract terms
- Disputes, unpaid invoices
- Data handling
- Fines, compensation claims
Risk
- Live cold calls
- Cold email
- Advertising claims
- Company ownership
- Contract terms
- Data handling
The sanctions are concrete. The ICO can issue reprimands, enforcement notices or monetary penalties, with the PECR ceiling set at £500,000. The ASA refers advertisers who ignore rulings to Trading Standards, under its published trading standards referrals process.
What an agency must disclose on a call
Every call must name the organisation on whose behalf it is made, and give an address or freephone number if asked. Dialling under the client's brand is fine when the caller can explain the relationship.
The ICO's guide to PECR sets out that identification duty and what a caller must supply on request. A script that invents urgency breaks it. Our note on appointment setting agencies disclosure policy shows how to write a standard that holds on every call and email.
Vet an agency with five compliance checks
- Ask for the privacy notice the agency uses for its own outreach. No notice means no lawful basis you can inspect.
- Ask how data is sourced, then read the legitimate interests assessment or the consent records.
- Ask for the TPS and CTPS screening process and a sample suppression list.
- Check the PSC register at Companies House against what the sales team claims.
- Request sample scripts and email sequences, then look for unverifiable claims.
Vetting an agency on compliance
- Ask for the agency's privacy notice
- Ask how it sources data and lawful basis
- Ask how it handles opt-outs and TPS screening
- Check the PSC register at Companies House
- Review email sequences and call scripts
- Ask about dialler and email tool compliance
An agency that answers all five quickly, and whose documents match the answers, is worth shortlisting.
Example contract clauses for outsourced sales
Most disputes begin with a loose definition or a payment trigger the agency does not control.
"Qualified Appointment" means a booked meeting of at least 20 minutes between the Client's named representative and a prospect who holds the agreed job title, works for a company in the agreed size band and has confirmed a current need.
The Agency's total liability is capped at the fees paid by the Client in the three months before the claim, excluding death, personal injury and fraud.
Payment models vary. A client paying a £400 monthly retainer plus £80 per held meeting (illustrative figures) should state what happens when a meeting is cancelled within 24 hours. Our review of appointment setting agencies commercial contracts covers data ownership and termination.
Common questions
Do appointment setting agencies need consent to cold call businesses?
For limited companies and LLPs, PECR allows a live call without prior consent if the caller identifies itself and honours a CTPS objection. Sole traders and some partnerships need consent first, and TPS screening always applies.
Who is liable if a campaign breaches PECR?
Both parties can be. The agency usually acts as controller for the campaign it designs, while the client that commissioned the calls can also face ICO action.
Can an agency use a bought list for email outreach?
Rarely. Consent or a valid soft opt-in is needed, and a bought list seldom meets the soft opt-in because the agency did not collect the details itself.
What should a compliant contract contain?
A defined qualified appointment, the payment trigger, cancellation rules, data ownership, a liability cap and termination rights that work both ways.
In this guide
- Cold calls or consent first, what appointment setting agencies UK regulations requirePECR consent, employment status and advertising claims: how appointment setting agencies UK regulations apply to outsourced sales teams in England.
- What are the advertising rules for appointment setting agencies?A checklist on advertising rules for appointment setting agencies: CAP Code claims, ICO direct marketing duties and the contract terms behind what you promise.
- Data protection before sharing prospect data with an agencyData protection checks before sharing prospect data with an appointment-setting agency: lawful basis, UK GDPR terms, PECR screening and provider vetting.
- How to review appointment setting agencies commercial contractsA practical guide to the contract terms that appointment setting agencies and clients should agree, from appointment definitions to data and exit clauses.
- Check your appointment setting agencies disclosure policyA practical appointment setting agency guide to disclosure policies, covering caller identity, TPS and CTPS screening, call recording, scripts and records.
