Cold Calling Laws in the UK

Which laws cover cold calling in the UK?

Two sets of rules apply. The Privacy and Electronic Communications Regulations (PECR) cover marketing calls: who you can call, what you have to say and which calls are banned. UK GDPR and the Data Protection Act 2018 cover the personal data behind each call, such as a contact's name, job title and direct number.

The same rules apply in England, Scotland, Wales and Northern Ireland, and the Information Commissioner's Office (ICO) enforces both. Doorstep selling falls under different rules and isn't covered here.

Is B2B cold calling legal in the UK?

Yes. The ICO says the rules for live marketing calls to businesses are the same as for calls to individuals. You can call a business unless its number is registered with the TPS or CTPS, or it has told you not to call. If a registered business has told you it's happy to hear from you, you can call it.

For a B2B list, screen every number against both registers. Companies register with the CTPS, but sole traders and some partnerships register with the TPS, as individuals do.

TPS and CTPS: who's on which register?

• TPS: individuals who have opted out of live marketing calls, including sole traders and some partnerships.
• CTPS: companies and other corporate bodies, such as limited liability partnerships, Scottish partnerships and government bodies.
• Your own do-not-call list: anyone who tells you not to call again goes on it, whether or not they're on a register.

What you must do on every call

• Say who's calling, and who you're calling for.
• Show your number, or another number people can call you back on.
• Give a contact address or freephone number if asked.
• Stop calling anyone who asks you to.
• Give privacy information, including where you got the person's details, by the time of your first contact. If you record calls, say so at the start.

Calls that need consent

• Automated marketing calls with a recorded message need specific consent to that type of call. General marketing consent isn't enough.
• Calls about claims management services need the person's specific consent, even if they aren't on the TPS.
• Calls about pensions are only allowed from a scheme's trustees or managers, or firms authorised by the FCA, and only with consent or to existing customers.

UK GDPR and your call list

A named contact at a company is personal data, so you need a lawful basis to call them. For B2B calls it's usually legitimate interests: a genuine business reason the person would reasonably expect, weighed against their rights. Anyone can object to direct marketing at any time, and once they do, you must stop.

Penalties for breaking the rules

Since 5 February 2026, the ICO can fine organisations up to £17.5 million or 4% of global turnover for breaking PECR, under the Data (Use and Access) Act 2025. The previous maximum was £500,000. The ICO has said its PECR guidance is under review because of the Act, so check it again before a large campaign.

Are there legal calling hours in the UK?

No. PECR doesn't set calling hours for marketing calls. For B2B calls, normal business hours are the practical choice, because that's when decision-makers are at their desks.

Can you call a lead in the UK who asked you to?

Allowed if they told you they don't object to your calls · Until they withdraw it

• The TPS and CTPS rules apply to unsolicited marketing calls. If someone on the TPS has told your company that they don't, for the time being, object to your calls, you can call them (PECR, regulation 21(4)). They can withdraw that at any time.
• The ICO puts it as specific consent to calls from you, and says this applies even to existing customers on the TPS. Keep a record of when and how they asked.

Source: PECR, regulation 21 · ICO: Telephone marketing · Do not call exemptions by country

What has changed in the UK?

• 5 February 2026

  The maximum fine for breaking PECR, which includes the TPS and CTPS rules, rose from £500,000 to £17.5 million or 4% of global turnover under the Data (Use and Access) Act 2025.