Business Calling Rules in the UK: PECR, Ofcom, and the ICO

Businesses that call people in the United Kingdom operate under a different set of rules from those in the United States. Instead of the TCPA and the Telemarketing Sales Rule, UK calling is governed mainly by the Privacy and Electronic Communications Regulations (PECR), data protection law, and rules set by the communications regulator, Ofcom. Enforcement is shared between Ofcom and the Information Commissioner's Office (ICO).

This article explains how these rules fit together, what they require, and what they mean for anyone making business calls to people in the UK.

This article is for general information only and isn't legal advice. Businesses should seek legal advice about how the rules apply to their specific situation.

The Main Rules and Regulators

PECR

The Privacy and Electronic Communications Regulations 2003 set out the core rules on electronic marketing in the UK, including marketing calls, texts, and emails. They originally put an EU directive into UK law and have remained in force since the UK left the EU, with amendments over time.

PECR covers who can be called for marketing purposes, when consent is needed, what callers must tell people, and how caller ID must be presented.

UK GDPR and the Data Protection Act

The UK GDPR and the Data Protection Act 2018 govern how personal data, including names, phone numbers, call recordings, and call notes, is collected and used. PECR and data protection law work together. A call might meet PECR's specific marketing rules, but the business must also handle the person's data lawfully.

The Information Commissioner's Office (ICO)

The ICO is the UK's data protection regulator. It enforces both PECR and data protection law, investigates complaints about nuisance marketing calls, and can issue fines and enforcement notices.

Ofcom

Ofcom regulates the UK's communications sector. In calling, its role focuses on persistent misuse of phone networks, such as silent and abandoned calls, and on rules for phone companies, including how caller ID is displayed and which calls networks must block.

What Counts as Marketing?

PECR's rules on calls apply to direct marketing, which in the UK is interpreted broadly. It includes any communication promoting products or services, but also:

• Fundraising calls from charities.
• Calls promoting political parties or campaigns.
• Calls promoting an organization's aims or values, even where nothing is being sold.

Calls that don't promote anything, such as genuine market research or service calls about an existing account, order, or appointment, generally aren't marketing. However, calls presented as research that are really used to sell, a practice sometimes called "sugging" (selling under the guise of research), are treated as marketing.

Rules for Live Marketing Calls

Live marketing calls are calls made by a real person, rather than a recording or automated system.

Who can be called

A business must not make live marketing calls to:

• Numbers registered with the Telephone Preference Service (TPS) or the Corporate Telephone Preference Service (CTPS), unless the person has specifically told that business they don't object to receiving its calls.
• Anyone who has told the business they don't want its calls, regardless of whether they're registered with TPS.

Businesses are expected to screen their call lists against the TPS and CTPS before calling, and to keep their own lists of people who've asked not to be called.

Calling numbers not on TPS

For numbers that aren't registered with the TPS or CTPS, PECR doesn't require consent for live marketing calls. However, the business still needs a lawful basis under data protection law to use the person's personal data. Many businesses rely on legitimate interests, which requires them to consider whether the call is something the person would reasonably expect and whether it would cause them unwarranted intrusion.

People always have the right to object to direct marketing, and that objection must be respected immediately and permanently.

Identifying the caller

On every live marketing call, the business must:

• Say who is calling, identifying the business.
• Provide a contact address or freephone number if the person asks for it.

Displaying caller ID

Businesses making marketing calls must display a valid caller ID number that the person can call back. Hiding or withholding the number, or displaying a number that can't be used to reach the business, is not allowed.

Rules for Automated Marketing Calls

Automated marketing calls, where a recorded or synthesized message is played rather than a person speaking live, face stricter rules.

They can only be made to people who have given specific prior consent to receive automated marketing calls from that organization. General consent to marketing isn't enough, and it doesn't matter whether the person is registered with TPS. The message must also identify the business and provide a contact address or freephone number.

This consent requirement applies to calls using AI-generated voices as well, where the call is for marketing purposes.

Rules for Particular Sectors

Some types of cold calls face additional restrictions.

Claims management

Live calls about claims management services, such as calls about personal injury claims or mis-sold financial products, can only be made to people who have specifically consented to receive such calls from that business. A person not being on TPS isn't enough.

Pensions

Since 2019, cold calls about pensions are banned unless the caller is authorized by the Financial Conduct Authority or is the trustee or manager of a pension scheme, and the person has specifically consented to the call or has an existing relationship with the caller that means they'd reasonably expect it. The ban was introduced to tackle pension scams, which had caused serious financial harm.

The government has also announced plans to extend cold calling bans to a wider range of financial products and services.

Ofcom's Rules on Persistent Misuse

Ofcom has powers to act against the persistent misuse of phone networks, meaning behavior that causes people unnecessary annoyance or anxiety. Its policy focuses in particular on silent and abandoned calls, which are common side effects of automated dialing.

Under Ofcom's policy:

• Abandoned calls should be no more than 3% of live calls per campaign over any 24-hour period.
• When a call is abandoned, a short information message must play within two seconds of the call being answered, identifying the business and providing a number to call back.
• If a call to a number is abandoned, that number shouldn't be called again within 72 hours unless a live person is guaranteed to be available.
• Unanswered calls should ring for at least 15 seconds before being ended.
• When answering machine detection wrongly treats a real person as a machine, these calls should be counted in the abandoned call rate.
• Callback numbers must be valid and must not be charged at premium rates.
• Silent calls, where the person answers and hears nothing at all, are a particular concern, and businesses must take steps to prevent them.

Ofcom can fine businesses up to £2 million for persistent misuse.

Caller ID and Call Blocking

Ofcom also sets rules for phone companies, including requirements around how caller ID is presented. Phone companies must provide accurate caller ID where technically possible, and must block calls that display invalid or clearly misused numbers, such as numbers that don't exist or aren't allocated. Ofcom has been strengthening these rules over time to tackle spoofing, where scammers fake caller ID to make calls appear to come from trusted numbers.

For legitimate businesses, this means using genuine, valid numbers that belong to them, properly set up through their phone provider.

Call Recording

Businesses in the UK can record calls in certain circumstances, such as keeping records of transactions, checking compliance with rules, or quality control and training. They're expected to inform callers that recording may take place, and recordings must be handled in line with data protection law, including keeping them secure, keeping them only as long as necessary, and responding to requests from people who want copies of their recordings.

Some regulated businesses, particularly in financial services, are required to record certain calls under Financial Conduct Authority rules.

Data Protection on Calls

Beyond PECR, data protection law affects business calls in several ways. Businesses must have a lawful basis for using people's personal data, including data obtained from third parties. They must tell people how their data is used, usually through a privacy notice. They must keep data accurate, secure, and no longer than needed. And they must respect people's rights, including the right to access their data and the right to object to direct marketing.

Businesses that buy or rent call lists should carry out thorough checks on where the data came from and whether it was collected lawfully, since they remain responsible for the calls they make.

Enforcement and Penalties

The ICO regularly takes enforcement action against businesses that make unlawful marketing calls, including issuing monetary penalties and enforcement notices requiring them to stop. Historically, fines under PECR could reach £500,000. The Data (Use and Access) Act 2025 raised the maximum PECR fines to the same level as UK GDPR fines, meaning up to £17.5 million or 4% of global annual turnover, whichever is higher, with the changes being brought into force in stages.

Ofcom can fine businesses up to £2 million for persistent misuse of phone networks.

People who receive nuisance or unlawful marketing calls can complain to the ICO, and those affected by silent or abandoned calls can report them to Ofcom. These reports help regulators identify and pursue offenders.

Good Practice for Calling in the UK

A few principles help businesses stay within UK rules:

• Screen every list against TPS and CTPS, and keep your own "do not call" list.
• Get specific consent before making automated marketing calls, claims management calls, or calls to TPS-registered numbers.
• Check sector-specific rules, especially in pensions and financial services.
• Identify the business clearly and provide contact details if asked.
• Display a valid, callable number on every call.
• Keep abandoned call rates within Ofcom's limits, and play the required information message.
• Avoid silent calls and repeated calls to the same number after an abandoned call.
• Handle personal data lawfully, including data from third-party lists.
• Tell callers about recording and keep recordings secure.
• Stop calling immediately when someone objects.

Rules Built Around Respect

The UK's approach to business calling rests on a clear principle: people have the right to decide whether they want marketing calls, and those calls must never cause unnecessary distress. PECR protects people's choices, data protection law protects their information, and Ofcom's rules protect them from silent, abandoned, and misleading calls. Businesses that follow these rules not only avoid penalties, they also make sure their calls reach people who are willing to hear from them.

Related articles

• The TCPA Explained: The Main US Law on Phone Calls and Texts
• The Telemarketing Sales Rule: What It Requires and Who It Covers
• Do Not Call Registries: How They Work in the US and UK