What UK GDPR and PECR require from appointment-setting agencies

What to take away

The lawful bases an appointment-setting agency can rely on under UK GDPR

Every call your team makes is processing personal data. That is true even when the number belongs to a limited company, because the person answering is an identifiable individual.

The Data Protection Act 2018 is the primary legislation governing data protection in appointment setting, sitting alongside the UK GDPR, so start there before you write a script.

You need one lawful basis from Article 6 of the UK GDPR for each purpose. In practice, appointment-setting firms use three: consent, legitimate interests, and occasionally contract where an existing customer relationship covers the outreach.

Special category data, which is rare in B2B sales but appears in some public sector and healthcare lists, needs an Article 9 condition as well.

The purpose matters more than the channel. Building a list, enriching it, calling it, emailing it and passing it to a client are separate processing activities. Each needs a basis, and a basis that works for a warm follow-up may not work for a cold list bought last week.

Consent

Consent under the UK GDPR must be freely given, specific, informed and unambiguous. It needs a clear affirmative action and it must be as easy to withdraw as to give. For B2B outreach, consent is rarely practical: the person who agrees to a call may leave, and the new holder has not consented to anything.

Where you do rely on consent, record when it was given, what wording the contact saw, and which campaign it covers. Blanket consent captured years ago for unspecified marketing will not hold up.

Legitimate interests

Legitimate interests is the workhorse basis for B2B prospecting. It requires a three-part test, covered in the next section, and it demands a written record. If you cannot produce that record, you are relying on a basis you cannot evidence.

Contract and legal obligation

Contract covers processing needed to deliver a service a client has bought, such as managing a meeting booking. Legal obligation covers things like tax and accounting records. Neither justifies cold prospecting on its own.

The ICO publishes guidance on sending direct marketing and choosing a basis, and it is worth reading before you write your legitimate interests assessment rather than after a complaint lands.

How the legitimate-interest test works for B2B cold outreach

The legitimate-interest test has three parts, and all three must pass. They are not a formality. The ICO has been clear that a balancing exercise done badly is worse than no exercise at all, because it shows you knew the risk and did not address it.

1. Identify the legitimate interest. For an appointment-setting agency this is usually the commercial interest of the client, the agency, or both, in reaching business decision-makers with a relevant service.

The third limb is where most agencies come unstuck. A finance director at a mid-sized manufacturer in the West Midlands may reasonably expect approaches from suppliers. A sole trader in a regulated sector, or someone who has already opted out, does not.

The ICO guidance on choosing a lawful basis for direct marketing sets out how to document this. Write the assessment before the campaign, date it, name the person who signed it off, and review it when the audience or the offer changes.

What a defensible assessment looks like

A good legitimate interests assessment is short and specific. It names the audience, the data fields, the source of the data, the channel, the frequency, the opt-out route and the reasoning for the balance. It records what you considered and rejected.

Generic assessments copied from a template fail the test because they do not describe the actual processing. If your assessment would read the same for a software firm and a care home group, it is not doing any work.

The necessity limb in practice

Necessity does not mean the processing must be the only possible option. It means there is no obviously less intrusive way to achieve the same aim. Segmenting by role and sector, and limiting contact frequency, strengthens this limb considerably.

Agency owners often ask whether a soft opt-in helps. It applies to email marketing to existing customers about similar products, and it does not rescue cold prospecting. Do not stretch it.

What PECR says about calls and emails to corporate subscribers

The The Privacy and Electronic Communications (EC Directive) Regulations 2003 governs electronic marketing communications including cold calling and email. It sits on top of the UK GDPR and adds its own rules, so satisfying one regime does not satisfy the other.

PECR draws a distinction that matters enormously to outsourced sales teams: individual subscribers versus corporate subscribers. A corporate subscriber is a company, a limited liability partnership, a partnership, or a public body. A sole trader and an unincorporated partnership are treated as individuals.

Live calls

Live marketing calls to corporate subscribers are permitted without prior consent, provided the caller does not know or have reason to believe the subscriber objects. You must still identify your organisation and give a contact address or freephone number on request.

Live calls to individual subscribers need consent, unless the soft opt-in applies. That is why a list of limited company numbers is a different proposition from a list of sole traders. Check the entity type, not just the trading name.

Automated calls

Automated calling systems that play a recorded message need prior consent for both individual and corporate subscribers. If your dialler plays a message before a human joins, treat it as an automated call and get consent.

Email

Email marketing to corporate subscribers is permitted without consent in narrow cases. The recipient's details must have been obtained in the course of a sale or negotiations for a sale, the messages must concern similar products, and a simple opt-out must be offered at collection and in every message. Otherwise you need consent.

That narrow route rarely fits a purchased or scraped B2B list. If you cannot show how the address was collected, assume consent is required. The rules on consent and cold contact are set out in more detail in our guide, Cold calls or consent first.

Screening and the TPS

Before calling, screen against the Telephone Preference Service and the Corporate Telephone Preference Service. A corporate subscriber registered on the CTPS is treated as objecting, so a call to that number breaches PECR unless consent exists.

Screening must happen close enough to the call to be meaningful. A list screened a year ago is not screened. Re-screen before every campaign and keep the screening file.

ICO guidance on business-to-business marketing and data brokers

The Business-to-business marketing | ICO rules are central to outsourced sales agency compliance, and they answer most of the questions agency owners actually ask. The guidance confirms that B2B marketing is still direct marketing, so UK GDPR duties apply even where PECR is more permissive.

It also covers the practical points that trip up sales floors: naming the caller, honouring opt-outs promptly, and not treating a switchboard as consent from the person you eventually reach. A receptionist passing on a message is not a lawful basis.

Buying data from brokers

If you buy a list, the broker is a source and you are a controller for your own use of it. Due diligence is your responsibility. Ask for the source of each field, the basis on which it was collected, when it was last screened, and whether consent was captured.

Brokers often describe data as B2B when it contains sole traders, partnerships and personal email addresses. Sample the file and check entity types before it reaches a dialler. Poor prospect data handed over without provenance is the single most common cause of complaints against agencies.

Controllers and processors

If you run campaigns on a client's behalf, establish in writing who is controller and who is processor. Usually the client is controller and the agency is processor, which means you act on documented instructions and cannot repurpose the data for your own marketing.

Where the agency uses the data for its own purposes, it becomes a controller for that processing and needs its own lawful basis. Blurring the two is a governance failure that shows up quickly in an ICO inquiry.

International transfers

Some agencies route data through platforms hosted outside the UK. Transfers need a lawful mechanism, such as an adequacy finding or the International Data Transfer Agreement. Check where your CRM and dialler actually store data, not where the vendor is headquartered.

Records, opt-outs and the direct marketing checklist

Records are what separate a compliant agency from one that merely believes it is compliant. If the ICO asks why you called a number, you need an answer that is not a reconstruction.

Keep the lawful basis for each campaign, the legitimate interests assessment, the source of the data, the screening date, the script, the opt-out log and the retention period. Store them where you can retrieve them by campaign and by contact.

Opt-outs

An opt-out is not a preference to note and ignore on the next campaign. It must suppress the contact across every list and every client campaign you run, unless the contact later gives clear consent to be contacted again.

Suppression should be checked at the point of dialling, not only at the point of list build. A contact who opted out yesterday must not receive a call today because the list was compiled last month.

Retention and deletion

Set retention periods for call recordings, contact records and campaign files, and delete on schedule. Keeping everything indefinitely fails the storage limitation principle and increases the harm if there is a breach.

The ICO direct marketing checklist

Work through this before each campaign and keep the completed version.

Use the same checklist for client campaigns and for your own prospecting. The obligations do not change because someone else pays for the dialler minutes.

Enforcement action and decision notices that set the bar

The Enforcement action | ICO record is the clearest signal of where the bar sits. Fines and decision notices against nuisance callers show what happens when screening, consent and opt-out handling fail at scale.

Penalties under PECR are issued against the caller and, in many cases, against the company that commissioned the calls. Agencies that assume the client carries all the risk are wrong: the ICO can pursue the party that instigated the contact.

Patterns in the cases

The recurring failures are consistent. No screening against the TPS or CTPS. No evidence of consent. Opt-outs recorded but not applied. Data bought from a broker with no provenance. Directors who cannot explain who was responsible for compliance.

Each of these is a process failure, not a legal technicality, and each is fixable before a campaign starts. The cost of fixing it is a few hours of documentation.

What good looks like

A compliant agency can produce, on request, the basis for a specific call, the screening record for that number, the script used, and the opt-out log. It can name the person accountable for data protection and show that staff are trained.

The ICO expects accountability to be demonstrable, not asserted. That means policies that match practice, training records, and a complaints route that actually works.

Practical governance for agency owners

Appoint a named data protection lead, even if you do not need a statutory DPO. Review the legitimate interests assessments quarterly, or whenever the audience or offer changes. Audit broker-supplied data on arrival.

Train the sales floor on what to say when someone asks how their data was obtained. A scripted, honest answer is far better than a transfer to a manager who does not know. The wider framework that governs these engagements is covered in our guide to the UK rules on appointment setting.

Working with clients

Put the compliance split in the contract. State who screens, who holds the lawful basis, who handles opt-outs, and who responds to a subject access request. Where the client supplies the data, get warranties on its provenance and keep them on file.

If a client asks you to call a list you cannot verify, decline in writing. The fee is not worth an enforcement notice, and the ICO will look at what you knew at the time.

Common questions