GDPR and B2B cold calling: a practical guide

This is a practical guide, not legal advice. Check the ICO’s guidance or a solicitor for your situation.

Ask an outbound team about compliance and most will mention the TPS. Fewer will mention GDPR, yet it applies to every call they make to a named person. Screening tells you whether you may dial a number. Data protection law governs everything around it: where the contact came from, why you hold it, what you tell the person and what you do when they say no.

This guide walks through UK GDPR as it applies to B2B cold calling, with a note on calling into the EU, and ends with a checklist you can adopt as it stands.

Two sets of rules, one phone call

In the UK, a B2B sales call sits under two overlapping regimes:

• PECR, the Privacy and Electronic Communications Regulations 2003, sets the specific rules for marketing calls: TPS and CTPS screening, honouring requests not to be called, and presenting caller ID. Our guide to TPS and CTPS covers these in detail.
• UK GDPR and the Data Protection Act 2018 govern the personal data you use to make the call: the name, job title, phone number and any notes about the person.

Complying with one does not mean you comply with the other. A number can be clear of the TPS and still be one you have no business holding, and a perfectly sourced contact can still be on the CTPS.

Business contact details are personal data

A common myth is that GDPR does not apply to B2B. It does, whenever the data relates to an identifiable person. “Sarah Patel, Head of Operations, 07700 900123” is personal data, even though it is about her job. A switchboard number with no name attached is not, but outbound teams rarely call those by choice.

That makes your organisation a controller for the contact data in your CRM and dialler. You decide why and how it is used, so you are responsible for having a lawful basis, being transparent and respecting the person’s rights.

Choosing a lawful basis

Article 6 of UK GDPR lists six lawful bases. For B2B cold calling, two are realistic:

• Consent is possible but rarely practical. It must be specific, informed and freely given, and you would need it before the first call, which defeats the purpose of cold outreach.
• Legitimate interests, under Article 6(1)(f), is the usual basis. Recital 47 says that direct marketing may be regarded as carried out for a legitimate interest, and the ICO accepts it for B2B calling where the balance is right.

Note the word “may”. Legitimate interests is not automatic. It is the most flexible lawful basis, and in exchange you are expected to show your working.

The three-part test and your LIA

The ICO describes legitimate interests as a three-part test. Write your answers down in a Legitimate Interests Assessment (LIA) before you start calling, and review it whenever your targeting or data sources change.

1. Purpose

Is there a legitimate interest behind the processing? Promoting your products and services to businesses that could use them is a recognised commercial interest. Be specific about which roles, which industries and which offer.

2. Necessity

Is processing this person’s data necessary for that purpose, and is there a less intrusive way to achieve it? Reaching the person responsible for a buying decision usually needs their name, role and a direct number. Their home address or personal social media does not.

3. Balancing

Do the person’s interests, rights and freedoms override yours? Ask whether they would reasonably expect the call. A head of sales receiving a call about a sales tool is well within expectations. A junior employee called about something unrelated to their role is not. Weigh up the safeguards you have in place, such as screening, a clear opt-out and short retention.

A good LIA is a page or two, not a dissertation. It should record what you decided, why, and the safeguards that tip the balance. If the ICO ever asks, it is the first document you will want to hand over.

Telling people: Article 14 notices

When you collect data directly from someone, Article 13 requires you to give them privacy information at the time. Cold outreach usually relies on data from elsewhere, such as a data provider, a website or a directory, so Article 14 applies instead.

Under Article 14 you must give the person privacy information within a reasonable period of obtaining their data, and at the latest within one month. If you use the data to contact them, you must provide it at the latest at the first communication. For a cold call, that means at or before the first call.

The notice should cover who you are, why you are processing their data, your lawful basis and legitimate interest, the categories of data, where you got it, how long you keep it, and their rights, including the right to object. A common approach is a short public page: the rep mentions it on the call, and it is linked in any follow-up email.

There is a limited exemption where providing the information would involve disproportionate effort, but it is hard to rely on for direct marketing. Plan on providing the notice.

The right to object is absolute

Most GDPR rights involve some balancing. The right to object to direct marketing does not. Under Article 21(2) and (3), anyone can object to the use of their data for direct marketing at any time, and once they do, you must stop using it for that purpose. No assessment, no counter-arguments.

Article 21 also requires you to bring this right to the person’s attention explicitly, at the latest at the first communication, presented clearly and separately from other information.

For a calling team that means:

• When someone says “don’t call me again” or “take me off your list”, treat it as an objection and stop immediately.
• Suppress rather than delete. Keep just enough (usually the name and number) on a suppression list so the person is never re-imported and called again.
• Apply it across the organisation, to every rep and every tool, not only the person who took the call.

The same request is also a PECR “do not call” instruction, so one well-run suppression list can serve both regimes.

Minimise, keep accurate, delete on time

Three principles from Article 5 do a lot of practical work in outbound:

• Data minimisation. Hold only what you need to make relevant calls: name, role, company, business contact details and notes about the conversation. Resist enriching everything just because a tool can.
• Accuracy. People change jobs constantly. Calling a former employee on a number that now belongs to someone else wastes time and is a data protection problem. Correct or remove stale records, and act on “wrong number” outcomes.
• Storage limitation. Set retention periods and enforce them. A contact who never engaged does not need to sit in your CRM for five years. Suppression entries are the exception, because you keep them to honour the objection.

Sourcing data responsibly

If you buy or license contact data, you inherit its problems. Before you sign with a provider, ask:

• Where does the data come from, and can they show provenance for individual records?
• What lawful basis do they rely on, and have they carried out their own LIA?
• Have they given the people in their database the privacy information Article 14 requires, and is their notice public?
• How do they handle objections and removals, and how quickly do those reach customers?
• How often is the data verified and refreshed?

Keep the answers on file. Due diligence on your suppliers is part of showing that your own processing is lawful.

Recording calls

Call recordings are personal data too, and often richer than the CRM record. If you record calls:

• Tell people at the start of the call that it is being recorded and why, for example for training and quality.
• Identify your lawful basis. For coaching and quality, legitimate interests is common, and it belongs in your LIA.
• Set a retention period and delete recordings when it ends.
• Limit access to the people who need it, and treat requests for a copy of a recording as subject access requests.

Calling EU numbers

For contacts in the European Union, the EU GDPR applies in much the same way as UK GDPR: lawful basis, transparency, the right to object and the other principles above. The rules for the call itself come from each country’s implementation of the ePrivacy Directive, and they vary. Some countries run their own opt-out registers, and some are much stricter about unsolicited B2B calls; Germany, for example, generally expects at least presumed consent. Check country rules before calling EU numbers, and do not assume UK practice carries over.

What is at stake

UK GDPR fines can reach £17.5 million or 4% of global annual turnover, whichever is higher, and the ICO can order you to stop processing. Most outbound teams are more likely to meet complaints, subject access requests and reputational damage than a headline fine, but the controls that prevent one also prevent the others.

A practical compliance checklist

1. Map your data: where each contact came from and when.
2. Write and date a Legitimate Interests Assessment covering your outbound calling.
3. Publish an Article 14 notice and point people to it no later than the first call.
4. Tell people about their right to object, clearly, at the first contact.
5. Keep one suppression list for objections and do-not-call requests, checked before every dial.
6. Screen against TPS and CTPS as well. GDPR compliance does not replace PECR.
7. Collect only what you need, and correct inaccurate records.
8. Set retention periods for contacts and recordings, and enforce them.
9. Announce call recording at the start of the call.
10. Carry out due diligence on data providers and keep the evidence.
11. Check local rules before calling any EU country.

How Decibel helps

Decibel covers the parts a product can cover and gives you the documents for the rest. You can download an LIA template to adapt for your own outreach, and our Article 14 notice is public for the people in our database. With recording notices switched on, the person you call hears a recording announcement when they answer. Recordings are kept according to your plan, one year on Pro, and anyone can ask to be removed through our opt-out page. Data is hosted in the UK, and every dial is screened against TPS, CTPS and your workspace do-not-call list.

As a customer you are still a controller for your own outreach, so the LIA and the decisions in it are yours to own. The tools just make it easier to live up to them on every call.