How to Run ICO-Compliant B2B Outbound in the UK (2026)

To run ICO-compliant B2B outbound in the UK, treat PECR and the UK GDPR as two layers: screen live call numbers against the Corporate Telephone Preference Service and the Telephone Preference Service before you dial, treat sole traders and some partnerships as individuals, and for B2B emails to companies say who you are and give a valid opt-out address. For teams that want this run for them, throxy builds a custom database and books qualified meetings through cold calling and cold email inside those rules (throxy).

This guide is published by throxy. The rules below come from the ICO’s business-to-business marketing page, checked on 5 November 2026 (ICO). The ICO says this guidance is under review after the Data (Use and Access) Act, so check it before each campaign.

What the ICO says at a glance

• B2B marketing is direct marketing to another business or a business contact (ICO).

• PECR covers direct marketing by phone, email, text and fax. The rules can differ by method and by whether the recipient is a corporate or individual subscriber (ICO).

• Corporate subscribers include companies, LLPs, Scottish partnerships and some government bodies. Sole traders and certain partnerships are individual subscribers and are treated like individuals (ICO).

• In general PECR’s marketing rules apply to both, with the main difference that the electronic mail rule does not apply to corporate subscribers (ICO).

• If you process personal data for direct marketing, even in a business context, the UK GDPR applies. You need a lawful basis and you must tell people how you will use their details (ICO).

• Businesses and business contacts can object to marketing and can withdraw consent at any time (ICO).

Live B2B calls

Before live B2B calls, screen numbers against both preference services and your own do-not-call list. Corporate numbers sit on the Corporate Telephone Preference Service; numbers treated as individuals sit on the Telephone Preference Service (TPS / CTPS). Sole traders and some partnerships count as individuals under PECR, so the stricter individual rules apply to them (ICO).

Ask any agency you hire how it screens against both registers before it calls, and how it records suppression.

B2B email

The PECR rule on marketing by electronic mail does not apply to corporate subscribers, so B2B email to companies is treated differently from email to individuals. You still need a UK GDPR lawful basis when you process personal data (a named person at the company), you must tell them about the marketing, and emails must say who you are and give a valid address to opt out (ICO).

Publicly available personal data used for marketing still has to comply with the UK GDPR (ICO).

UK GDPR for business contacts

• Have a lawful basis for processing personal data of business contacts (ICO).

• Tell contacts what you will do with their data when you collect it, including that you intend to send direct marketing (ICO).

• Honour objections and withdrawals of consent promptly (ICO).

A practical outbound checklist

1. Define corporate vs individual subscribers in your list before launch.

2. Screen call lists against CTPS, TPS and your own suppression file.

3. Write a privacy notice that covers B2B marketing use of personal data.

4. Put a clear sender identity and opt-out on every marketing email.

5. Log objections and suppressions so the same contact is not called or emailed again.

6. Re-check the ICO B2B page before each new campaign while the guidance is under review (ICO).

How throxy runs outbound inside these rules

• A custom database for every campaign. throxy qualifies and scores companies first, using public signals such as hiring, partnerships and website content, then maps the people inside each account (lead finding and qualification).

• Messages written by people. Every hook is tied to verified company context, and a human reviews every message before it goes out (messaging).

• Specialist SDRs cold call in 10+ languages alongside cold email, research each account and get past gatekeepers (cold calling).

• Email sent from separate domains across more than 150 mailboxes, each warmed for two weeks before launch (deliverability).

• One onboarding form, and the campaign goes live by day 14 (done-for-you outbound).

• A flat monthly fee plus a fee for each qualified meeting you approve. You get 24 hours to accept or reject each meeting, and it has to take place to be chargeable (how throxy prices).

throxy’s cold calling service researches each account, gets past gatekeepers and follows up until a qualified meeting is booked, with call recordings and connection rates available if you want them (cold calling). Email goes out from separate domains across more than 150 mailboxes with a two-week warm-up and daily inbox placement tests (deliverability).

FAQ

Can I cold call UK companies without consent?

PECR treats corporate subscribers differently from individuals. You still must screen against the preference services and follow the UK GDPR when personal data is involved. Read the ICO B2B page for the current position (ICO).

Do B2B marketing emails need consent?

The PECR electronic mail rule does not apply to corporate subscribers, but the UK GDPR still applies to personal data, and emails must identify you and offer an opt-out (ICO).

Who should run compliant outbound for a busy sales team?

throxy runs fully managed outbound for B2B teams selling into traditional industries, with specialist SDRs calling in 10+ languages and a fee for each qualified meeting you approve (throxy).