TPS and CTPS: the UK cold calling rules, explained

This is a practical guide, not legal advice. Check the ICO’s guidance or a solicitor for your situation.

Cold calling businesses is legal in the UK. It is also regulated, and most of the rules that matter to an outbound team sit in one place: the Privacy and Electronic Communications Regulations 2003, usually shortened to PECR. If your reps call people who have not asked to hear from you, PECR decides who they may call, what they must show when they do, and what happens when they get it wrong.

This guide covers the two registers at the centre of those rules, the Telephone Preference Service (TPS) and the Corporate Telephone Preference Service (CTPS), and turns them into a routine your team can follow every day.

The short version

• Do not make unsolicited live marketing calls to a number on the TPS or CTPS, unless that subscriber has told you they do not object to your calls.
• Do not call anyone who has told you not to call them, whether or not they are registered. Keep your own do-not-call list.
• Screen your data against both registers at least every 28 days, and ideally at the moment you dial.
• Always present a number people can call back. Never withhold it.
• Say who you are calling from, and give an address or freephone number if asked.

What PECR regulation 21 says

Regulation 21 deals with unsolicited calls made for direct marketing purposes. In plain terms, you must not make such a call to a line where:

• the subscriber has previously told you that they do not want marketing calls from you on that line; or
• the number is listed on the register kept under regulation 26, which in practice means the TPS and the CTPS.

There is one exception for registered numbers: where the subscriber has told you that, for the time being, they do not object to your calls on that line. There is also a short lag built in, because a new registration only takes effect 28 days after it is made. That is where the 28-day screening rhythm comes from.

Regulation 21 covers live calls made by a person. Automated, pre-recorded calls fall under a separate rule and need prior consent, which is a much higher bar. Everything in this guide assumes a real rep on a real call.

TPS and CTPS: who is on which register

PECR splits subscribers, meaning the person or organisation that holds the contract for the line, into two groups. Which register applies depends on who that subscriber is, not on whether the number is a landline or a mobile.

The practical point: you cannot assume a business number is safe to call because it belongs to a business. A sole trader’s number is screened against the TPS, a limited company’s against the CTPS, and many switchboards and direct dials are registered. Screen against both registers every time, since you will rarely know for certain which kind of subscriber holds the line.

What counts as a marketing call

Direct marketing under PECR covers more than selling. The ICO treats any communication that promotes the products, services, aims or ideals of an organisation as marketing. For a B2B outbound team, that means:

• sales calls and appointment-setting calls are marketing;
• calls offering a demo, a trial or an invitation to an event are marketing;
• “research” calls that are really a route into a sales conversation are marketing too.

Genuinely neutral calls, such as chasing an unpaid invoice or confirming an order the customer placed, are not marketing. But if part of the purpose of a call is to promote something, treat the whole call as a marketing call.

The “do not object” exception

A registered number is not off limits forever. If the subscriber has specifically told you that they are happy to receive calls from you, you can call them even though they are on the TPS or CTPS. Two cautions:

• It has to come from them, to you. A tick box on someone else’s website, or permission given to a data supplier, is not the same as the subscriber telling your organisation.
• Record it. Note who said it, when and for which number, so you can show it later. The permission is “for the time being”, so if they withdraw it, it is gone.

Your own do-not-call list matters as much

The second half of regulation 21 is easy to forget. If someone tells you not to call them again, you must not, whatever the registers say. That applies to your whole organisation, not only the rep who took the call.

A practical setup is a single suppression list that every rep and every tool checks before dialling, updated the moment someone says “please don’t call me again”. Make the do-not-call outcome one click, so nobody has to remember to update a spreadsheet at the end of the day.

How often to screen

The TPS advises screening your data against the registers at least every 28 days. A newly registered number becomes effective 28 days after registration, so a list screened in January is not safe to call in March. Organisations licensed to use the TPS data download updated files regularly, and most calling and data tools that offer screening rely on one of those licensed feeds. The TPS website explains the options for organisations that call.

Every 28 days is the minimum. Screening at the moment of dialling is better, because it closes the gap altogether and means imported lists, old CRM records and a rep’s own contacts are all checked the same way.

Caller ID and identifying yourself

Two more PECR requirements apply to every marketing call, whether the number is registered or not:

• Present your number. Calling line identification must be shown on marketing calls. You cannot withhold your number, and the number you present should be one the person can call back, ideally reaching someone who can deal with an opt-out.
• Say who you are. The caller must give the name of the organisation the call is made for and, if asked, a valid address or a freephone number.

Neither is difficult, but both are easy to break with the wrong setup. Personal mobiles set to withhold, or a shared number nobody ever answers, are common ways to fall foul of the rules without meaning to.

Mobiles, directors and sole traders

B2B teams increasingly call mobiles, because that is where decision makers actually answer. This is where the TPS catches people out.

Mobile numbers can be registered on the TPS. If a director’s mobile is held in their own name as an individual subscriber and registered, it is on the TPS, even if they mostly use it for work. An unsolicited sales call to that number breaches regulation 21, however business-focused the conversation. A mobile on a company contract belongs to a corporate subscriber and could be on the CTPS instead.

Sole traders and ordinary partnerships outside Scotland are individual subscribers, so their numbers sit on the TPS, not the CTPS. If you sell to small businesses, trades or professional practices, expect a higher share of TPS hits.

The safe rule is the simple one: screen every number against both registers, whatever it is and whoever you think holds it.

What happens if you get it wrong

The ICO enforces PECR. It receives complaints from the public, many of which are passed on by the TPS, and it regularly fines organisations for making unsolicited marketing calls to registered numbers. Historically the maximum PECR fine was £500,000. The Data (Use and Access) Act 2025 brings PECR fines up to UK GDPR levels, which means up to £17.5 million or 4% of global annual turnover, whichever is higher. The ICO can also issue enforcement notices requiring you to stop.

Ofcom is the other regulator to know. Its persistent misuse rules target abandoned and silent calls, which mostly come from predictive diallers that ring more numbers than there are agents free to answer. Ofcom’s policy expects the abandoned call rate to stay at or below 3%, with an information message played when a call is abandoned. A power dialler that dials one number at a time, with the rep on the line when it connects, does not create abandoned calls in the first place.

Then there is the commercial cost. A prospect who receives an unwanted call on a registered number is unlikely to become a customer, and a complaint can follow your company name around.

A practical screening checklist

1. Screen every list against both TPS and CTPS before it reaches your dialler, including CSV imports and old CRM data.
2. Re-screen at least every 28 days, or check each number at the point of dialling.
3. Keep one organisation-wide do-not-call list and check it before every call.
4. Log “do not call” requests immediately, with the date and the number.
5. Record any “I don’t object to your calls” permission from a registered subscriber: who, when and which number.
6. Present a callable caller ID on every call. Never withhold.
7. Train reps to name the company and give an address or freephone number when asked.
8. Avoid predictive dialling unless you can stay within Ofcom’s abandoned call rules.
9. Keep evidence of screening dates, suppression lists and call logs in case the ICO asks.

How Decibel handles it

We built Decibel so these steps happen automatically rather than from memory. Every dial is checked against TPS and CTPS on our servers as part of placing the call, so it cannot be skipped from the browser. If a number is listed, the call is blocked and the rep sees why. Each workspace has its own do-not-call list, which takes effect the moment a rep logs that outcome. Caller ID is always presented, with no option to withhold, and CSV imports are screened row by row in the same way as contacts from our database. More detail is on our compliance page.

Whatever tools you use, the principle is the same: put the rules where the calls happen, so compliance does not depend on someone checking a spreadsheet at the end of a long day.