Marketing Calls: PECR and GDPR Rules for Live and Automated Efforts

Update: October 2026

Two sets of UK rules apply to marketing calls. The Privacy and Electronic Communications Regulations 2003 (PECR) control the call itself. The UK GDPR and the Data Protection Act 2018 apply whenever you use personal data to make it.

This guide covers live calls, automated calls, the TPS and CTPS, the stricter rules for pensions and claims management, and the Data (Use and Access) Act 2025 changes to PECR. It is based on the ICO’s guide to telephone marketing and its guidance on live marketing calls.

Key Takeaways

• For most live marketing calls, you do not need consent under PECR. You must screen numbers against the TPS and CTPS, respect anyone who has objected, display your number and say who is calling.

• Automated marketing calls need specific consent to that type of call. Claims management calls also need consent, and pension scheme calls are allowed only under a strict exception.

• The UK GDPR applies alongside PECR. You need a lawful basis, you must tell people you intend to call them, and you must stop using their data for marketing if they object.

PECR and the UK GDPR Apply at the Same Time

PECR covers live telephone calls made for direct marketing. The ICO says PECR sits alongside the UK GDPR, and that complying with one helps with the other.

If you use personal data to make a call, both apply. An example of personal data is a list that includes a person’s name. The same is true if you collect personal data during the call.

The Data (Use and Access) Act 2025 changed PECR in several ways. The ICO’s summary of the changes to PECR says the definition of a call now includes attempts to make a connection, not only calls that are connected. It also says the Act brought the data protection definition of direct marketing into PECR and, in most cases, brought PECR enforcement powers in line with the UK GDPR.

The ICO’s pages on marketing calls carry a notice that they are under review because of the Act. Check the ICO’s planned guidance page before you rely on a specific passage.

Live Marketing Calls Have a Short List of Prohibitions

The rules on live calls are in PECR regulations 21, 21A, and 21 B. In general, you do not need consent to make most live marketing calls. You must not make unsolicited live calls:

• to anyone who has told you they do not want your calls;

• to a number registered with the TPS or CTPS, unless the person has told you they agree to your calls;

• about claims management services, unless the person has specifically consented; or

• about pension schemes, unless you meet the strict exception described below.

A call is solicited if the person specifically asked you to call with marketing information. Agreeing to receive calls, or not objecting to them, does not make a call solicited. It stays unsolicited for PECR purposes, and you apply the normal rules.

You are responsible for the call if you are the caller or the instigator. The ICO says you are likely to be an instigator if you encourage, incentivise or ask someone else to make calls carrying your marketing message. If you use a call centre, check its compliance and put a written contract in place.

Every Live Call Must Identify the Caller

On every live marketing call, solicited or not, you must:

• display your number or a valid alternative contact number, and never withhold it;

• say who is calling, for example the name of your organisation; and

• give contact details or a Freephone number if asked.

The TPS and CTPS Act as a General Objection

The Telephone Preference Service (TPS) is a statutory register of people who do not want live marketing calls. The Corporate TPS (CTPS) does the same for companies, limited liability partnerships, Scottish partnerships and government bodies. Adding a number is free, including mobile numbers.

A new registration takes 28 days to take effect, which affects bought lists. The ICO says that if a third party claims to have screened a list, you should check that the screening was recent. A check made more than 28 days earlier may miss registrations that have since become active.

Screening applies to numbers from every source. The ICO states that a publicly available number, or one in a telephone directory, does not override a TPS or CTPS registration or a previous objection. You also need your own do-not-call list, and you should keep objectors on it. If you only delete their details, a later list can bring the same number back.

For business calls, sole traders and some partnerships register with the TPS, and companies and other bodies register with the CTPS. Screen B2B lists against both.

Calling a TPS Number Needs the Person’s Own Notification

Regulation 21(4) lets you call a registered number if the subscriber has notified you they do not object to your calls for the time being. The ICO says this standard is, in practice, very close to consent. The notification must name you, be a clear signal and involve a positive action. You also need a record of it.

Failing to tick an opt-out box does not count. The ICO’s example is a form with an opt-out tick box. You cannot call people who did not tick it and whose numbers are on the TPS.

Registration also overrides earlier customer relationships. If someone you called before joins the TPS later, you can no longer call them unless they had already specifically told you they wanted your calls.

Automated Calls Need Specific Consent

Regulation 19 governs automated marketing calls, meaning calls made by an automated dialling system that plays a recorded message. These need the person’s specific consent to that type of call.

General marketing consent is not enough. Neither is consent to live calls. The consent must cover automated calls.

Every automated call must include your name and a contact address or Freephone number. You must also allow your number, or an alternative contact number, to be displayed. The ICO’s checklist adds that you stop automated calls when consent is withdrawn.

Consent here has the UK GDPR meaning: freely given, specific, informed and unambiguous, with a clear affirmative action. Our guides to valid consent and to writing a consent request cover how to word and record it.

Claims Management and Pension Calls Have Stricter Rules

For claims management services, you can only make live marketing calls if the person has specifically consented. In that case, you do not screen against the TPS because consent is mandatory.

You may call pension schemes only if you meet an exception. You must be a trustee or manager of an occupational or personal pension scheme, or be authorised by the Financial Conduct Authority. You must also either have the person’s consent or meet all three of these criteria:

• you have an existing client relationship with them, which cannot be one set up mainly so that you could make the call;

• they might reasonably envisage such a call from you; and

• you gave them the chance to opt out of such calls when you collected their details and in every communication.

The ICO also points out that other regulators have their own rules. For example, the FCA bans certain types of cold calling, so check the standards that apply to your sector.

The UK GDPR Adds Fairness, Transparency and a Lawful Basis

If you use personal data to make marketing calls, the ICO says the calls must be fair, lawful and clear to the people called, and must respect people’s rights.

Transparency means telling people when you collect their number that you want to make marketing calls. Fairness means not using a number for something people would not expect. The ICO’s example is a bank that holds information about shareholders of corporate customers for anti-money laundering reasons. Using it to market personal accounts is unfair unless the bank has their consent.

On a lawful basis, the ICO says consent and legitimate interests are the most likely options. Consent suits claims management calls and calls where someone agrees to override their TPS registration. Legitimate interests may work for calls to numbers that are not on the TPS or CTPS and where no one has objected.

People have an absolute right to object to using their personal data for direct marketing. If someone objects, you must stop using their data for that purpose, with no grounds to refuse. Our guide to buying data lawfully explains the extra checks that apply to purchased lists.

A Short Checklist Keeps Each Campaign Compliant

Before a call campaign starts, confirm the following:

• Numbers are screened against the TPS and CTPS as close to the call date as possible.

• Numbers are screened against your own do not call list.

• Consent is on record for any claims management or automated calls.

• Pension calls meet the exception, with authorisation and either consent or the three criteria.

• Your number displays and callers identify the organisation.

• Your privacy information tells people you may call them.

• Objections and withdrawals reach the suppression list quickly.

Other Countries Set Their Own Rules

PECR is UK law. In the EU, Article 13 of the ePrivacy Directive and national laws govern unsolicited communications, so the rules on live marketing calls differ between member states. Check the law of each country where you call. A cross-border campaign should apply the strictest relevant standard.

Conclusion

Marketing calls are lawful when you screen, identify yourself, respect objections and treat automated, claims management and pension calls under their stricter rules. The ICO’s guidance remains the reference point while it revises its pages for the Data (Use and Access) Act.

We are publishing this update because the Data (Use and Access) Act changed the definition of a call and PECR enforcement, and many call scripts and screening routines predate it. Review your process against the checklist above, and speak to our GDPR consultants if you want a campaign checked before it launches.

Frequently Asked Questions

Do We Need Consent to Make Marketing Calls?

Not for most live calls. The ICO says you can call people and businesses that haven’t objected and whose numbers aren’t on the TPS or CTPS. Consent is required for automated marketing calls and for live calls about claims management services. Pension scheme calls require consent or meet the strict relationship test.

Do We Need to Screen Against the TPS and CTPS?

Yes, for most live marketing calls. The ICO says you must check numbers against the registers and not call any listed number unless the person has specifically told you they agree to your calls. For B2B calls, check both registers and your own do not call list.

Can We Call Existing Customers?

Not if their number is on the TPS or CTPS, unless they have notified you that they do not object to your calls. The ICO states that a customer relationship does not override the registration, apart from the strict pension exception. You also cannot call anyone who has objected.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.