An agency that dials for five clients runs five compliance programmes, not one. Each client brings its own data, its own consent history, its own suppression list and its own exposure to a complaint. The agency sits in the middle of all of them, holding the phone. This piece sets out how to keep the five apart, what each one costs, and what the contract between agency and client needs to say.

Who the caller is when an agency dials for a client

PECR's rule on live marketing calls (regulation 21) bars unsolicited marketing calls to numbers on the TPS, the register for individual subscribers, and the CTPS, the register for corporate subscribers. The rule reaches both the organisation whose products are being sold and the organisation that picks up the phone. An outsourced call centre or agency is in scope as the party making the call, and the instructing client is in scope as the party that set the campaign going and supplied the data; the guide covers that in who has to comply.

For an agency, this means a client warranty that the data is clean does not transfer the risk. If the list was never screened, the agency made the unlawful call. If the list was screened by the client in January and dialled by the agency in April, the agency made the call on stale data. The agency has to be able to show, for every dialled number, that it was screened against both registers close to the time of the call, whoever supplied the list.

The penalty regime makes this concrete. For conduct from 5 February 2026 the ICO can fine up to £17.5 million, or 4% of worldwide turnover for an undertaking, for a breach of the calling rules. Once a company has been fined, a director or manager can be fined personally where the breach happened with their consent, connivance or neglect. An agency director who signs a contract saying "the client is responsible for TPS" and then dials unscreened data has not moved the exposure anywhere.

Two things sit on top of the TPS and CTPS check, and both are client-specific. The first is consent. A TPS-listed number can be called only where that subscriber has told the organisation they are happy to be called for marketing. There is no soft opt-in for live calls: an existing customer relationship with Client A does not license a marketing call to that customer's TPS-registered number, and it certainly does not license a call on behalf of Client B. Consent is given to a named organisation for a purpose, so it cannot be pooled across the agency's book.

The second is the do-not-call list. When a person tells an agent "stop calling me", that request binds the organisation the agent was calling for. If the agency holds one combined suppression list, it will either over-suppress (a person who opted out of Client A's calls gets struck off Client B's list too, which is defensible but costs the client contacts) or, worse, under-suppress when the combined list is rebuilt and an opt-out is lost. Keep one list per client, apply it before every dial, and record the date, the number and what was said.

In practice this means three fields on every record the agency dials for a client: the TPS and CTPS verdict with its timestamp, a consent reference that points to evidence the client holds, and the client's own opt-out flag. A number is dialled only when the first says clear or the second is populated, and never when the third is set.

Keeping each client's data separate

The simplest architecture is one CRM instance, or one workspace, per client. Everything else follows: the suppression list is per workspace, the screening log is per workspace, the export the client asks for at audit time is one export. Agencies that run all clients in one database with a "client" column spend their time proving that a filter was applied correctly on a given day, and that is a harder conversation with an auditor than "here is the client's workspace".

Separation also protects the agency from a contamination problem. If a record from Client A's list is uploaded into Client B's campaign by mistake, the person called has no relationship with Client B, no consent on file, and a complaint goes to the ICO with Client B's name on it. Per-client workspaces make that mistake a deliberate act rather than a mis-click.

One rule that follows from separation: the agency does not screen a list once and reuse the verdicts across clients. The check is cheap and the royalty is counted per client anyway, so run it in each client's workspace. The audit trail then lives where the auditor will look for it.

The 28-day re-screen runs per list, not per agency

The industry standard set by the DMA, which operates the TPS, is that screening data is no more than 28 days old when you rely on it. The background is in the 28-day rule explained. For an agency the point is that the clock runs per list. Client A's list screened on the 1st and Client B's list screened on the 15th have different re-screen dates, and an agency-wide "we re-screen on the first Monday of the month" will leave one of them stale.

The agencies that do this well do not run a calendar at all. They screen at the moment a record enters the client's workspace, re-screen when the phone number changes, and let a nightly job pick up anything last checked 27 or more days ago. The 28-day debate then becomes academic because no record is ever near the limit.

The TPS royalty as a per-client cost line

Since 1 September 2026 the DMA charges a usage-based royalty on TPS and CTPS screening: 10p per 1,000 records processed, counted per client, per month, and capped at £3,300 per client per year. Licensed list cleaners declare the volume they process for each client every month and recharge it. The detail is in the TPS royalty fee.

For an agency the words that matter are "per client". The DMA bills per client, per month, and caps per client, so settle with your screening provider before the first month whether each of your clients is declared under its own name or the agency is the declared client; the answer decides whose cap applies. The cost is small (100,000 records screened for a client in a month is £10), but it belongs on the client's invoice as a line of its own, with the volume beside it, because that line is also evidence that screening happened.

One exemption applies. A client that holds its own current direct TPS licence does not pay the royalty through a list cleaner, on proof of the licence. If a client tells you it is a direct licensee, ask for the licence and keep a copy with the contract.

What to put in the client contract

Most agency contracts carry a one-line warranty that the client's data is "compliant". That line is close to worthless for the reasons above. The contract should instead say who does what, and leave a record of it.

  • Who screens. Name the party that screens every number against both registers before the agency dials it, and the tool or licensed provider used. If the agency screens, say that the client supplies raw data and the agency returns verdicts.
  • Consent evidence. If the client supplies records marked as consented, the client holds the evidence (date, wording, channel) and produces it within a stated number of working days on request. Numbers with no consent reference are treated as unsolicited and screened.
  • Opt-outs. Any opt-out taken on a call is written to the client's own suppression list the same day and passed back to the client in the next data return, so the client's other channels can honour it.
  • Re-screen cadence. State that no number is dialled on a verdict older than 28 days, and who runs the re-screen.
  • Royalty. State that the DMA royalty is recharged at cost per client, with the monthly volume shown, and that a client holding a direct TPS licence supplies a copy to claim the exemption.
  • Audit access. Each party can ask for the screening log for any period within the retention window, and the log is handed over in a readable format within a stated time.
  • Data separation. The client's data is held in its own workspace and is not merged with any other client's data for screening, dialling or reporting.

An audit trail the client can take away

When a complaint lands, the ICO works backwards from the call. The question is whether the organisation took reasonable steps before dialling, and the only convincing answer is a record made at the time. For an agency that record has to be separable by client, because the client will be asked for it as well and the two accounts need to match.

The minimum per dialled number is the number itself in a consistent format, the TPS verdict, the CTPS verdict, the date and time of the check, the source of the register data, and the identity of the client the call was made for. Add the consent reference where one exists and the opt-out flag with its date. Keep the log for at least as long as a complaint can arrive and be investigated, and state the retention period you use in the contract.

If the agency's tooling writes the verdict and timestamp onto the record in the client's workspace, the export is a report rather than a reconstruction. If the verdicts live in a spreadsheet on a laptop, the auditor has to take the agency's word for the date.

How this looks in practice

For HubSpot agencies the clean shape is one portal per client with TPSClear installed in each. Every number is screened when it is added or edited, the verdict and timestamp are written to the contact, the nightly re-check runs per portal, and the royalty figure is counted per portal. Agencies on other stacks use the API or Zapier from each client's own workspace. Voll Studios Ltd, the company behind TPSClear, is licensed by the DMA as a TPS and CTPS list cleaner, and register data is supplied through our licensed data partners.

What to do next

Map each client to its own workspace, its own suppression list and its own screening log, and rewrite the client contract so that the warranty line becomes a list of who does what. If you are setting the operational rules for the floor, the call-centre compliance checklist covers the dial-time side. For the full picture of the law, start with the complete guide to TPS compliance.