What the Data Use and Access Act 2025 changed for cold calling and PECR

The short version

The Data (Use and Access) Act 2025 did not ban cold calling. For sales teams it changed three things in PECR: an attempted call now counts as a call, the maximum fine rose from £500,000 to £17.5 million or 4% of worldwide turnover, and the regulator got the Data Protection Act 2018 enforcement powers. The TPS and CTPS rules for live calls, including the 28-day grace period, are word for word what they were.

The PECR changes sit in Part 5, Chapter 2 of the Act, sections 109 to 116, with Schedules 12 and 13. Most of them came into force on 5 February 2026 under the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, S.I. 2026/82. This is a plain-English summary of what I read on legislation.gov.uk, not legal advice. If you need the underlying rules first, start with PECR explained.

Calls that ring out now count

Section 110 amends the definitions in regulation 2. The definition of "call" now ends: "and a reference to making a call includes a reference to attempting to establish such a connection". A new regulation 2(1A) says that for "an unsuccessful attempt to make a call", a reference to the recipient is read as a reference to the intended recipient. Both parts came into force on 5 February 2026.

Regulation 21 itself was not touched, but the word it turns on got wider. Regulation 21(1) stops you "making unsolicited calls for direct marketing purposes" to a number on the TPS or CTPS register. On my reading, a dial to a registered number that rings out or is dropped by your dialler is now a call for that purpose. The argument that an unanswered attempt was not a call is gone.

This matters most for teams on power or predictive diallers, which attempt far more connections than they complete. I cover dialler rules in more depth in AI cold callers and auto-diallers under PECR.

Section 110 also added a definition of "direct marketing" to regulation 2: "the communication (by whatever means) of advertising or marketing material which is directed to particular individuals". That part has been in force since 20 August 2025 (S.I. 2025/904).

Fines: the new ceiling

Section 115 and Schedule 13 replace PECR Schedule 1. PECR breaches are now enforced through penalty notices under section 155 of the Data Protection Act 2018, and paragraph 18 of the new Schedule 1 applies "the higher maximum amount" under section 157 to regulations 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23 and 24. Section 157(5) sets that amount:

The 4% limb only bites above £437.5 million of turnover, so for most sales teams the working ceiling is £17.5 million, 35 times the old cap. A ceiling is not a tariff; the ICO's PECR fines and cases shows what has actually been charged.

Directors and managers are still exposed. Paragraph 15 of the new Schedule 1 lets the regulator give a penalty notice to an officer of a company or Scottish partnership where the company has been fined for breaching any of regulations 19 to 24 and the failure "took place with the consent or connivance of the officer" or "was attributable to any neglect on the part of the officer". That officer power existed before (since December 2018); what changed is the ceiling it sits under.

New enforcement powers and the transition

The substituted Schedule 1 applies the 2018 Act's information notices (section 142), assessment notices (section 146), interview notices (section 148A), enforcement notices and penalty notices to PECR. An interview notice can require a named person to answer questions. Since 30 September 2026 the body holding these powers is the Information Commission, though most people still call it the ICO.

The transition rules are in S.I. 2026/82. Regulation 11(1): where a breach occurred before 5 February 2026, enforcement "must be taken under those Regulations as they had effect immediately before that date", so the £500,000 cap still governs older conduct. Regulation 8(1) lets the regulator use the new investigatory powers "regardless of when the conduct to which the exercise of that power relates occurred", but regulation 8(2) says that does not authorise a sanction for pre-February conduct. In practice, an investigation opened today can question you about 2025 calls with the new tools, then fine you for them under the old cap.

Section 116 adds regulations 32A to 32C: the regulator must encourage representative bodies to write PECR codes of conduct, and under regulation 32C adherence to an approved code "may be used by a person as a means of demonstrating compliance". I have not seen an approved PECR code yet.

Cookies: regulation 6 in brief

Section 112 and Schedule 12 rewrite regulation 6 and add Schedule A1, a list of exceptions to the ban on storing or reading information on a device. Consent remains the main route. Two new exceptions need no consent but do need clear information and a free way to object: statistics collected to improve your own service or website (paragraph 5), and storage that adapts a website's appearance or function to the user's preferences (paragraph 6). None of the exceptions covers advertising or retargeting, so ad pixels still need consent, and regulation 6 breaches carry the same £17.5 million ceiling.

What did not change for sales calls

Reading the current text of regulation 21 against the Act, these are unchanged:

• TPS and CTPS screening. Regulation 21(1)(b) still bars unsolicited marketing calls to a number listed on the register kept under regulation 26. Regulation 26 keeps one register for individual and corporate subscribers, so B2B calls to CTPS numbers are covered as before.
• The 28-day grace period. Regulation 21(3) still says you have not breached the rule where the number "has been listed on the register for less than 28 days preceding that on which the call is made".
• Do-not-call requests. Regulation 21(1)(a) still bars calls to anyone who has told you not to call, which means keeping your own suppression list next to the TPS.
• Caller ID. Regulation 21(A1) still requires you to present a number you can be contacted on, or not block the calling line identity.
• Consent to call a TPS number. Regulation 21(4) still requires the subscriber to have told you they do not object to your calls. There is no soft opt-in for calls. The new charity soft opt-in in section 114 amends regulation 22, which covers electronic mail only.
• Who is a corporate subscriber. Section 110 does not touch the regulation 2 definitions of "individual" or "corporate subscriber", so sole traders and most partnerships are still screened against TPS, not CTPS.

I also looked for a new duty on phone networks to report unlawful marketing calls to the regulator. There is none in sections 109 to 116 or Schedules 12 and 13 as enacted.

What it means for a sales team

• Screen before the dial, not before the connect. If your dialler attempts numbers before anyone checks them, every attempt to a number that has been on the TPS or CTPS register for 28 days or more now counts as making a call under regulation 21, whether or not anyone answers. Screening has to happen upstream of the dialler queue.
• Keep the evidence. Interview and information notices mean the regulator can ask how and when each number was checked. A dated screening record per number answers that; a spreadsheet cleaned last quarter does not.
• Re-screen inside 28 days. The grace period did not move, so a list checked more than 28 days ago can hold numbers that are now enforceable. TPSClear checks a number when it is added or changed in the CRM, and its optional nightly re-check picks the number up again on day 27.
• Price the risk with the new ceiling. I set out what screening costs in what TPS screening costs. The rules themselves are summarised on the compliance page.

One-line answer

The Data (Use and Access) Act 2025 left the TPS, CTPS and 28-day rules for sales calls unchanged, but from 5 February 2026 an attempted call counts as a call, the PECR fine ceiling is £17.5 million or 4% of turnover, and the regulator has interview, information and assessment notices to investigate how you screen.