ListarProductsPricingToolsSign in

UK B2B cold calling: PECR, the CTPS and what you must screen

Updated

You can make live marketing calls to UK businesses without their consent. What you cannot do is call a number sitting on a preference register, and the register that applies depends on the legal form of the business, not on whether the call is B2B.

A limited company, a PLC or an LLP is a corporate subscriber and belongs on the CTPS. A sole trader or an ordinary partnership is an individual subscriber and belongs on the consumer TPS, even though they are plainly a business. The ICO's position is that you screen against both registers before any live marketing call, plus your own do-not-call list.

This page is informational and is not legal advice. We are a data provider, not a law firm. The maximum PECR penalty rose from £500,000 to £17.5 million or 4% of global annual turnover on 5 February 2026, so take your own advice before scaling a UK calling programme.

The distinction that decides everything

PECR splits the world into two kinds of subscriber, and the split is about legal personality.

Subscriber type Which businesses Register to screen Default position for live calls
Corporate subscriber Limited companies, PLCs, LLPs, Scottish partnerships, corporation soles, some government bodies, any body corporate with separate legal status CTPS May be called without prior consent if not registered
Individual subscriber Sole traders, ordinary English, Welsh and Northern Irish partnerships, other unincorporated bodies of individuals TPS Treated as an individual, with the greater protections that implies

This is the single most common misunderstanding in UK B2B calling. The belief that B2B is always opt-out is only true for corporate subscribers. A two-partner consultancy or a sole-trader contractor sits on the consumer register, and calling a TPS-registered individual subscriber without consent is a breach regardless of the fact that you were calling about their business.

Because you usually cannot tell the legal form from a phone number, the ICO's guidance resolves it the practical way: screen against both the CTPS and the TPS, since some businesses register with one and some with the other.

What Regulation 21 actually requires

Four obligations attach to every live marketing call to a UK number.

Automated and recorded-message calls are a different and stricter regime again: those require specific consent to automated calls, which ordinary cold outbound does not have.

The 28-day rule, and why it means screening late

Regulation 21(3) provides that a call is not a breach of the register rule if the number had been on the register for less than 28 days on the day of the call.

Read the other way round, which is the way that matters operationally: a number that went onto the register 29 days ago is fully protected, and a list you screened five weeks ago may contain numbers you are no longer permitted to call.

That is why screening is something you do close to the calling block and again before each run, not once when the list is built. A quarterly wash is not a compliance process.

One further practical detail: CTPS registrations require annual renewal while TPS registrations do not, so the corporate register moves differently from the consumer one.

PECR and UK GDPR are two separate gates

Clearing one does not clear the other, and they ask different questions.

PECR asks whether you may use this channel to this number. That is the register question above.

UK GDPR asks whether you may process this person's personal data at all. It applies as soon as you can identify an individual, so a named contact with a direct line is in scope. The ICO's position is that if you hold no name, for example calling "the IT department" on a switchboard number, UK GDPR does not apply to that processing.

Where it does apply, you need a lawful basis. For B2B prospecting that is normally legitimate interests under Article 6(1)(f), and relying on it means carrying out and documenting a Legitimate Interests Assessment that weighs your commercial interest against the individual's privacy rights. You also owe privacy information: where the data came from, what you are doing with it, and how to object.

"Publicly available" is not a lawful basis. A number published on a company website is still personal data, and the question of whether you may call it is answered by PECR and UK GDPR, not by how easy it was to find.

A useful contrast that catches people out in the other direction: the PECR rule on direct marketing by electronic mail does not apply to corporate subscribers at all. So B2B email to a limited company does not need consent under PECR, while a live call to the same company does need a register check. The two channels are governed differently, and a process built for one will not satisfy the other.

What changed in February 2026

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and the bulk of its data protection provisions came into force on 5 February 2026.

For anyone running a calling programme, one change dominates: the maximum PECR fine rose from £500,000, a cap that had stood since 2003, to £17.5 million or 4% of global annual turnover, whichever is higher. That is a 35-fold increase in the fixed cap and aligns PECR penalties with UK GDPR.

For context on what enforcement has actually looked like, the ICO issued roughly £4.63 million in PECR fines across 49 actions from March 2022 onwards, averaging around £95,000. The new ceiling has not yet been tested on a marketing-calls case, but the exposure calculation has changed materially, particularly for smaller companies now facing a turnover-based percentage rather than a flat cap.

The Act also strengthened the ICO's investigatory powers, including the ability to compel witness interviews and to require reports from controllers and processors.

What this means when you buy UK mobile data

Two requirements fall out of the above, and neither is a data quality question.

You need to know the legal form of the company, because it decides which register applies. A vendor that resolves companies against the register of companies can tell you whether you are looking at a limited company or a sole trader. A vendor working from a reconstructed directory usually cannot.

You need screening to happen near the call, not near the purchase. Enrichment and TPS or CTPS screening are separate operations with different clocks. A vendor supplying numbers is not supplying screening, and no vendor can supply consent.

Ask any UK data supplier three things: where each number came from and on what date, whether the company's legal form is a field you receive, and whether they can produce source documentation per record on demand. The ICO's interest, when a complaint arrives, is in provenance.

Where Listar stands

Listar is a data provider. We supply verified mobile numbers with their line type, and we do not supply TPS or CTPS screening, and we cannot supply consent.

Every delivered number carries the verification that produced it: a waterfall across more than 35 sources for coverage, then four verification layers including an attachment check confirming the line is in use and tied to the person on the record. On our own measurement, 95% of delivered mobiles were confirmed attached to the right person, from 10,000 real calls across 100 files of 100 numbers each, between May and September 2026. Internal, not audited, denominator is numbers delivered.

Our United Kingdom coverage is expanding; France, where companies are resolved against the official national registers, is where it is strongest today.

FAQ

Is cold calling businesses legal in the UK? Yes. Under PECR you may make live marketing calls to a business without its consent, provided the number is not on the TPS or the CTPS, the business has not objected to your calls, you identify yourself, you present your number and you give contact details on request.

Do I need to screen B2B numbers against the TPS as well as the CTPS? The ICO's guidance says to screen both before making live marketing calls, because some businesses register on the corporate register and some on the consumer one. Which register a business belongs on depends on its legal form, which you usually cannot tell from the number.

Are sole traders covered by the CTPS? No. Sole traders and ordinary partnerships are individual subscribers under PECR and register on the TPS, with the same protections as consumers. This is the most frequent compliance gap in UK B2B calling.

How recently must a list be screened? Regulation 21(3) protects a number once it has been on the register for 28 days, so screening more than 28 days before a call leaves a window of numbers you may no longer call. Screening before each calling run is the practice that follows.

Can I rely on legitimate interests to call a UK business contact? It is the usual lawful basis for B2B prospecting under UK GDPR, and relying on it requires a documented Legitimate Interests Assessment and the provision of privacy information. It does not remove the separate PECR obligation to screen the registers.

What is the maximum fine for a PECR breach? Since 5 February 2026, £17.5 million or 4% of global annual turnover, whichever is higher. Before that date the cap was £500,000.

Does the same rule apply to B2B email? No, and this catches people out. The PECR electronic mail rule does not apply to corporate subscribers, so B2B email to a limited company does not require consent under PECR, while a live call to that company does require a register check.

Sources

All guides

Listar AI