Separate the calling rule from the data-processing rule
PECR governs particular electronic-marketing practices. UK GDPR governs personal-data processing where applicable. A campaign may need to satisfy both, and the legal basis used for data processing does not automatically permit a call prohibited by PECR. [2]
Start with the contact method: a live person speaking is different from an automated recorded marketing message. Identify the actual seller, purpose and recipient type. A message described as customer care may still contain marketing that changes the analysis.
Document this classification before approving the script. It is more useful than adding a privacy statement to a campaign whose underlying calling permission has not been checked.
Live marketing calls require screening and respect for objections
ICO guidance explains that many live marketing calls can be made without consent where the relevant conditions are met. Prior objections and Telephone Preference Service or Corporate Telephone Preference Service registrations matter, with specific agreement and special-category rules requiring attention. [1]
Build the applicable screening into the operational process, not merely the contract. Keep an internal suppression record and ensure new lead imports do not reintroduce people or organisations that have objected. The actual caller and instigator should understand their responsibilities.
Do not assume that a public business number is unrestricted. A number appearing on a website may still be subject to applicable marketing rules, and a named business contact can involve personal data.
Automated calls and sensitive categories need separate review
Automated recorded marketing calls are subject to different consent requirements from ordinary live calls. Certain campaign categories, including those identified in ICO guidance for claims management or pensions, also require closer attention. A generic “live calls are allowed” statement cannot be applied to every service. [1] [2]
Review what the technology actually does. A platform described as assisted calling may introduce a recorded or synthetic message before an agent joins. The campaign must be assessed on its real operation, not only the supplier’s product name.
Where a rule depends on a specific exemption or permission, preserve the basis relied upon and have qualified UK counsel confirm that it fits the facts.
Identity and objection handling must be intelligible to the recipient
An outsourced agent should accurately identify the organisation on whose behalf the call is made and handle a request to stop contact properly. The customer should not be given an invented seller identity or sent through an unnecessarily obstructive process to register an objection.
Test the workflow across the client and Pakistani BPO: who records the request, how it is transmitted and what prevents another campaign from contacting the same person contrary to the applicable rules? A policy is ineffective if the next shift cannot see the suppression update. [1]
Keep the response factual and courteous. Do not train agents to disguise a marketing call as an urgent official or mandatory notice to avoid an immediate refusal.
Data roles and overseas access cannot be solved by a label
Determine whether the parties act as controllers, processors or in another relevant arrangement by examining their actual decisions and activities. Contract wording should reflect that reality rather than simply calling every supplier a processor to minimise apparent responsibility.
Making personal data accessible to a separate overseas organisation can engage the UK restricted-transfer framework. Assess the actual transfer and appropriate safeguards, which may include the relevant contractual instrument and risk assessment. A general NDA is not a substitute for that analysis. [3]
Limit access to the authorised work and establish approved tools, retention, incident escalation and subcontractor controls. These practical measures should support the legal arrangement rather than exist only in a policy that staff cannot follow.
Worked example: a UK client supplies a purchased list
Imagine a UK company sends a list of named professionals and says that consent is unnecessary because the offer is business-related. The Pakistani provider should ask about the source, recipient type, applicable screening, objections, purpose and data-processing role.
The answer may not require consent for every ordinary live call, but it still requires a lawful and properly controlled process. A B2B label does not resolve all personal-data and PECR questions. If the campaign changes to automated recorded calls, the original review must be revisited. [1]
Preserve the client’s instructions and the basis for approval. Where information is missing, obtain clarification before launch rather than hoping that the offshore location removes exposure.
Check current guidance and assign continuing responsibility
ICO has identified guidance review following the Data (Use and Access) Act. This article is a screening guide based on the materials reviewed on 29 October 2026, not an assurance that every future campaign can rely on unchanged wording. Check operative rules and guidance when launching or materially changing a campaign. [1]
The contract should allocate screening, permission evidence, data rights handling, incidents and regulatory cooperation. Staff training should cover the actual script and objection process, not only abstract privacy language.
Coordinate UK-law advice with Pakistan-side PECA and voice-operation requirements. Neither jurisdiction’s compliance should be presented as a replacement for the other. [4]
Legal assistance for this issue
Legal Bridge LLP can review the Pakistan-side service agreement and local legal exposure. A UK campaign should also receive appropriately qualified UK advice on PECR, data protection and any sector-specific requirements.
