Recruiters in the UK can cold call both clients and candidates, but PECR applies to the marketing calls. Screen hiring managers' numbers against the CTPS and the TPS, and screen candidates' numbers against the TPS. Honour every "please don't call me again" and give your agency's name on the call. Get a candidate's agreement before you pitch them to a client. Regulation 28 of the Conduct of Employment Agencies and Employment Businesses Regulations 2003 limits what you can disclose about them.

This is a plain-English summary, not legal advice.

Two kinds of recruitment call

A recruitment desk makes two kinds of outbound call. The first is business development: ringing a company to win it as a client. The second is the candidate call: ringing a person about work. The rules overlap, but they land differently on each.

This piece is about a recruiter calling on its own behalf. The word "agency" also gets used for outsourced telemarketing firms that dial for several clients at once, and those have their own problems with separate suppression and consent files. That case is covered in TPS compliance for agencies with multiple clients.

Calling clients: business development is direct marketing

PECR defines direct marketing as "the communication (by whatever means) of advertising or marketing material which is directed to particular individuals" (regulation 2). A call to a hiring manager to sell your recruitment service is advertising your service to a particular person. So it is a direct marketing call, and regulation 21 applies to it.

Regulation 21(1) has two bans. You must not make an unsolicited marketing call to a line whose subscriber has told you not to call it (21(1)(a)). And you must not make one to a number listed on the register kept under regulation 26 (21(1)(b)). That register is run as the TPS for individual subscribers and the CTPS for corporate ones. A newly listed number binds you once it has been on the register for 28 days (regulation 21(3)). A call you attempt counts too, even if nobody picks up, because "a reference to making a call includes a reference to attempting to establish such a connection" (regulation 2).

Which register applies depends on who holds the phone contract. PECR's subscriber is "a person who is a party to a contract with a provider of public electronic communications services" (regulation 2). A company's switchboard and its company-contract mobiles are corporate lines, so the CTPS applies. A hiring manager who gives you their own personal-contract mobile is an individual subscriber on that line, so the TPS applies, even though you are calling about company business. The general rules for company calls are in the B2B CTPS rules explained.

Small hirers: sole traders and partnerships

Plenty of hirers are not companies. In PECR, "individual" includes "an unincorporated body of such individuals", and a corporate subscriber is limited to companies, Scottish partnerships and other bodies with their own legal personality (regulation 2). So PECR treats a sole trader, and a partnership outside Scotland, as an individual. A sole-trader builder or a two-partner practice outside Scotland belongs on the TPS, not the CTPS. A desk that only screens client numbers against the CTPS will miss them. Sole traders and partnerships: TPS or CTPS works through each business type.

Calling candidates

A candidate's mobile is almost always on their own contract, so it is an individual's line and the TPS is the register that matters. Does the TPS cover mobile numbers covers how mobiles are listed.

Whether every call to a candidate about a vacancy is a direct marketing call is not settled by the wording of regulation 2. In practice, you cannot tell at dial time which side a given call falls on, and many candidate calls also promote the agency's own service. The simple approach is to screen candidate numbers the same way you screen client numbers.

Three situations come up often:

  • The candidate who applied and asked you to call. Regulation 21(1) is about unsolicited calls. Ringing someone back because they asked you to is a different case from ringing a name pulled from a list. Record the request on the candidate's record so the next consultant knows.
  • The TPS-registered candidate who is happy to hear from you. If a subscriber on the TPS tells your agency they do not, for the time being, object to your calls, you may call them on that line (regulation 21(4)). That permission is for "that caller" only, which means your agency and not the next agency they register with. They can withdraw it at any time, and then you must stop (regulation 21(5)). Calling a TPS number with consent covers what a usable agreement looks like.
  • The candidate who says stop. Once a subscriber has told you not to call a line, regulation 21(1)(a) bars marketing calls to it, whether or not the number is on any register. Put one do-not-call flag on the person, so a second consultant on the same desk does not ring them next week.

What to say on the first call

Four things to cover on the call:

  • Show a number. On any marketing call, solicited or unsolicited, you must either let your calling number display or present a number on which you can be contacted (regulation 21(A1)).
  • Give your agency's name. Regulation 24 requires the caller's name on every regulation 21 call, and an address or a free-to-call number if the person asks for one. Have both ready.
  • Tell a sourced candidate where you got their details. When you found someone on a job board, through a referral or online, UK GDPR Article 14 applies. Among other things, you have to tell them who you are and how to contact you, the legitimate interest you rely on, and where their details came from. Article 14(3) says to do this within a reasonable period, and at the latest within one month of getting their details. If you use the details to contact them, it must be done by the first communication at the latest. In practice, that means a line in your opener: who you are, where you found their details, that they can object, and where to find your privacy notice. Send the notice by email as well.
  • Tell them they can object. Article 21(4) says the right to object must be "explicitly brought to the attention of the data subject" at the latest at the first communication, "clearly and separately from any other information".

If they do object to direct marketing, that right is absolute. Under Article 21(2) and (3), once someone objects, their data "shall no longer be processed for such purposes". Stop marketing to them on every channel, not only by phone.

Candidate data and legitimate interests

Most recruiters hold sourced candidates' and hiring managers' details without consent, relying on legitimate interests under UK GDPR Article 6(1)(f). That basis has a balancing test built into it: it applies "except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject".

Since 5 February 2026, Article 6(11)(a) lists processing "necessary for the purposes of direct marketing" as an example of something that "may" be a legitimate interest. The word is "may". It helps, but you still have to do the balancing test for your own use of the data.

Pitching a candidate to a client

This is the rule that bites hardest on business development. Many client calls open with a candidate: the speculative CV, or "I have a strong candidate I think you should meet". Describing a named or identifiable candidate to a hirer discloses information about them.

In Great Britain, the rule is in the Conduct of Employment Agencies and Employment Businesses Regulations 2003. Regulation 28(1) says neither an agency nor an employment business may disclose information relating to a work-seeker without their prior consent. There are three exceptions, and one is disclosure "for the purpose of providing work-finding services to that work-seeker". The text does not say whether a speculative pitch to a hirer the candidate has never heard of falls within it. I would ask the candidate first, every time, and note their answer on the record.

Regulation 28(2) is stricter still. An agency must not disclose a work-seeker's information to their current employer without their prior consent, and cannot make its services conditional on that consent. So before you mention a candidate on a client call, check the company you are ringing is not where they work now.

The regulations use their own words for the two sides: the client is the "hirer" and the candidate is the "work-seeker" (regulation 2).

What a breach costs

For conduct from 5 February 2026, a breach of regulation 21 can be fined up to £17.5 million or, for an undertaking, 4% of worldwide turnover if that is higher. Sometimes a company is fined for a failure that happened with an officer's consent or connivance, or through their neglect. A penalty notice can then also go to that officer, which includes a director or manager.

A checklist for a recruitment desk

  1. Screen every number against both the TPS and the CTPS before it is dialled, client and candidate alike.
  2. Re-screen before the last result is 28 days old.
  3. Keep one do-not-call flag per person, shared across the whole desk.
  4. Record the date and wording when a TPS-registered candidate agrees to be called, and remove it when they withdraw.
  5. Show a contactable number and give the agency's name on every call.
  6. Tell sourced candidates where you got their details and that they can object, on the first call.
  7. Get the candidate's agreement before you pitch them to any client, and never pitch them to their current employer without it.

TPSClear checks each number against the TPS and the CTPS in one lookup and writes the verdict onto the CRM record. It runs inside HubSpot, through Zapier or n8n, or through the API. Voll Studios Ltd, the company behind TPSClear, is licensed by the DMA as a TPS and CTPS list cleaner, and screening runs on the DMA's official register data. The free CTPS checker checks a single number.