Many sales teams buy part of their pipeline. They buy data, leads, or appointments that a lead generator says are already booked. The question is the same each time: can you call these numbers if they are on the TPS or CTPS? This guide sets out what PECR requires, why bought consent rarely covers your call, and what to check before anyone dials. It uses a November 2026 ICO fine as the worked example.

The short answer

You can make an unsolicited marketing call to a registered number only if the person has told your organisation that they do not, for the time being, object to your calls. A lead generator's promise does not count. Neither does a consent form that names a discount club, a publisher or "partners" but not you. If you cannot show that evidence for a lead, treat the number like any other cold number. Screen it against TPS and CTPS, and do not call it if it is registered.

What regulation 21 actually requires

Regulation 21 of the Privacy and Electronic Communications Regulations (PECR) covers live marketing calls. It bars unsolicited marketing calls to numbers on the TPS register, which holds the numbers of individuals, and the CTPS register, which holds corporate numbers. The exception that matters for bought leads is regulation 21(4). The ICO puts it plainly: it is against the law to make a live marketing call to anyone registered with the TPS "unless the individual has informed the specific organisation that they do not object".

Two words in that sentence do the work. "Specific" means your organisation, by name. "Informed" means the person told you. You should be able to show when and how. The rule applies to the call, wherever the number came from. Buying a lead does not change what the law asks of the caller.

Regulation 21(3) gives a new registration 28 days before it applies to your calls. So a number that was clean when you bought it can become unlawful to call four weeks later. Re-screen before your data is 28 days old, and allow a day for the register's daily update. The 28-day TPS rule explains both meanings of the 28 days.

Most bought leads come with some form of consent. A person filled in a form on a comparison site, a survey or a competition entry, and ticked a box. That consent belongs to whoever the form named. If your company was not named, the person has not told you anything. A list of "carefully selected partners" that leaves you out does not fix that.

The same applies when the consent was for something else. Joining a discount club is not the same as agreeing to a sales call from a firm the person has never heard of. Our guide to calling a TPS number with consent sets out what valid consent looks like and how to record it.

Prebooked and warm are the seller's words

Lead generators sell "prebooked appointments", "warm leads" and "opted-in data". These are product names. They describe what the seller says happened, not what you can prove. An appointment is only as good as the record behind it. You need to know who booked it, when, on what call or form, and whether the person agreed to hear from your firm.

If the seller cannot give you that record, you are relying on their word. If the ICO asks you for evidence, their word is not evidence. A call that starts by confirming an appointment can still be a marketing call. In the case below, the ICO treated every call it counted as direct marketing.

Who carries the fine

Regulation 21(1) applies to anyone who makes a marketing call or instigates it. The ICO's summary of the case below says the company was fined for "instigating" the calls. So a firm can be fined for calls made for its business, even when another business sourced the data or booked the appointment.

Contracts help you here. A written agreement that says how leads are generated, what consent wording is used and that your firm is named gives you something to check against. A verbal understanding gives you nothing to show. Monitoring helps too. If you never look at how a supplier works, you cannot know whether its leads are lawful to call.

Worked example: Bluon Energy, November 2026

On 4 November 2026 the ICO published a £105,000 fine against Bluon Energy Ltd, a solar company. The penalty notice (PDF) is dated 29 September 2026. The ICO analysed the call records and screened the numbers against the TPS itself. It found 194,379 calls to TPS-registered numbers between April 2024 and April 2025, made from an account that Bluon paid for. That is almost 500 calls a day to TPS numbers. They led to 61 complaints, about one for every 3,200 calls by our own arithmetic.

Bluon bought data from third parties, including "prebooked solar leads". After one lead generator incorporated, Bluon paid it about £120 per lead. Between 26 September and 6 December 2024 that generator supplied 327 prebooked leads, for which Bluon paid £41,270. The contracts with suppliers were agreed verbally. There was no written agreement on how leads were generated, and Bluon did no monitoring once a supplier was engaged.

For one supplier, the consent came from a separate website. People who consented there joined a discount club, and their details were shared with a list of named third parties. Bluon was not on that list.

Bluon did not screen against the TPS. Its position was that it ran no marketing list and only called people who had agreed in advance to a telephone appointment. Its lawyers described the first call as a confirmation call. The ICO asked for evidence that the people called had not objected to calls from Bluon. The notice records that Bluon "provided no such evidence". Bluon tried to get consent records from its supplier, without success. The ICO was satisfied that all 194,379 calls were direct marketing, and found the breach negligent.

After the investigation began, Bluon stopped calling numbers where consent had not been verified. It asked suppliers for written evidence of consent, and contracted a TPS-checking service to check every number from third parties. Those steps appear in the checklist below.

The conduct predates 5 February 2026, so the notice cites the old £500,000 maximum. For conduct from that date the cap for a business is £17.5 million or 4% of worldwide annual turnover, whichever is higher. More cases are in our ICO PECR fines round-up.

A checklist for lead buyers

  • Get a written contract. It should name your organisation, say how leads are generated, set out the consent wording, and require the supplier to hand over consent records on request.
  • Ask for evidence for each lead. Where the consent was given, when, the exact wording shown, and proof that your organisation was named.
  • Check a sample yourself. Before a new supplier goes live, and regularly after that, pick some leads and ask for the full record. If the supplier cannot produce it, treat the batch as cold.
  • Screen what you cannot evidence. Any number without a consent record that names you is checked against TPS and CTPS before anyone calls it. Registered numbers are not called. Screening every bought number is the safer default. A consent record only shows what the person said when they gave it.
  • Re-screen before 28 days pass. A clean number can join the register after you buy it, and the registration applies to your calls 28 days later. See how often to check the TPS.
  • Keep records. Store the consent record, the screening result and its date with the contact, so you can answer an ICO request for evidence.
  • Honour opt-outs. Once someone tells you to stop calling, stop, whatever the supplier's file says.

Where TPSClear fits

TPSClear is a TPS and CTPS list cleaner licensed by the DMA. In HubSpot it screens each phone number when it arrives or changes, so a bought lead is checked before it reaches a dial list. The optional nightly re-check picks up any number last checked 27 or more days ago. For lists outside a CRM, you can upload a CSV on your account page or use the API. Pay-as-you-go prices are on the pricing page.