TPS and CTPS compliance: how UK businesses avoid cold-calling fines in 2026

UK cold-calling rules are stricter than most sales teams realise. The Telephone Preference Service (TPS) and its corporate equivalent (CTPS) are not voluntary — they're backed by the Privacy and Electronic Communications Regulations 2003 (PECR), enforced by the ICO, and the fines are real. ICO has handed out multiple six-figure penalties to UK SMEs in the last five years for ignoring the rules.

Honest guide to what TPS, CTPS and PECR actually require in 2026, when you can call business numbers, the B2B vs B2C rules that catch sales teams out, and the screening workflow every UK outbound team needs.

The basics

TPS is the UK's "do not call" register for consumer numbers. CTPS is the equivalent for business numbers. Both are operated by Mediasifter Ltd under contract with Ofcom. They're free for consumers and businesses to join.

Under PECR Regulation 21, it is illegal for a UK business to make an unsolicited live marketing call to:

• Any number registered on the TPS, unless you have prior consent specifically for that business
• Any number registered on the CTPS, unless you have prior consent specifically for that business

"Marketing call" here means any call promoting your product or service, soliciting sales, or attempting to arrange a meeting or demo. It includes "intros" and "quick chats." The intent test is what matters, not the wording.

The B2B rules that catch people out

A lot of UK sales teams assume CTPS doesn't apply to B2B. It does. The exception is narrow:

• Sole traders and (most) partnerships are treated as individuals — protected by the TPS, not the CTPS.
• Limited companies, LLPs and corporate bodies are protected by the CTPS.

For a sales team in practice, this means: screen consumer numbers against TPS, screen business numbers against CTPS, and screen sole-trader contacts against both for safety.

When you can call

You can call a registered number lawfully in three cases:

• They've given prior consent. They ticked a box on your form, signed up to your newsletter with an explicit phone-marketing opt-in, or otherwise actively asked to hear from you. The consent must be specific to your business, not a generic "third-party partners." Document it — date, source, exact wording.
• Existing customer (soft opt-in). Under specific conditions you can call existing customers about similar products or services. Strict requirements apply — the customer must have been given a clear opt-out at the point of original purchase and a clear opt-out in every subsequent communication. This is narrow and lawyer-tested in your industry.
• Not a marketing call. Service calls, customer care, follow-up on a quote they requested, booking confirmations — these aren't marketing under PECR. Strictly informational follow-up is fine.

The penalties

• PECR direct breach — ICO can fine up to £500,000.
• UK GDPR breach — overlapping breaches (unlawful processing of phone-number data, no lawful basis for the calling) can reach £17.5m or 4% of global turnover.
• Director personal liability — since 2018, ICO can pursue directors personally for serial PECR breaches.
• Reputational damage — ICO enforcement notices are public.

ICO maintains a public list of organisations fined under PECR — it's the kind of thing that turns up on the first page of Google for your company name.

The screening workflow every sales team needs

1. Get a TPS Assured licence

To screen against TPS / CTPS you need a licensed access arrangement. The official route is TPS Assured, the operator-side service from Mediasifter. There are also authorised data partners (Equifax, Capita, others) who provide the matching service as part of their data products.

2. Screen your list before each campaign

Don't reuse a 6-month-old screened list. The TPS adds thousands of new numbers every week. Re-screen at minimum monthly, ideally daily for active outbound campaigns.

3. Honour internal do-not-call requests

When a prospect says "don't call me again", your CRM has to remember. Forever. Add a do-not-call flag, screen all outbound against it before dialling. ICO treats repeat-contact-after-opt-out as an aggravating factor.

4. Document everything

• When was the list screened?
• Against which register?
• By which licensed service?
• What was the source of any consent claimed?

If ICO comes asking, "we screen monthly through TPS Assured, here are the date-stamped logs" is the answer that ends the conversation. "We meant to" is the answer that opens an enforcement notice.

5. Train your team — and your AI dialler

Predictive diallers, AI auto-dial tools, and outsourced call centres all need the same compliance posture. Your liability doesn't transfer to the dialler vendor; it stays with you.

A note on AI-generated cold-calling in 2026

AI voice generation has industrialised cold-calling at low cost. ICO has been clear: AI-driven calls are still calls, PECR still applies, and using AI to scale is an aggravating factor in enforcement decisions. Don't assume new technology bypasses old rules — it doesn't.

The alternative: stop cold-calling

The honest answer for most UK SMEs in 2026 is that outbound cold-calling has diminishing returns and large regulatory tail-risk. Inbound — where the prospect ringsyou — has none of these problems. An 0800 freephone number, call-tracking across paid channels, and a hosted PBX that handles inbound well frequently delivers more booked meetings than an outbound team — without the PECR exposure.