Voice AI for UK B2B sales: Ofcom rules and what changed after Brexit

Since Brexit, the UK runs UK GDPR, a near-identical but legally separate framework from EU GDPR, alongside the Privacy and Electronic Communications Regulations and Ofcom's telecoms rules. A B2B calling programme built purely around EU GDPR compliance is not automatically compliant for UK contacts, and the two regimes have started to diverge in small but relevant ways since the split. Treating "GDPR compliant" as a single box that covers both the EU and the UK is the most common mistake in cross-Channel calling programmes.

UK GDPR and PECR, not just GDPR

UK GDPR mirrors EU GDPR closely, retained in UK law after Brexit with the ICO, the Information Commissioner's Office, as the enforcing authority instead of an EU data protection authority. Alongside it, PECR governs electronic communications specifically, including unsolicited calls, and predates GDPR. For B2B calling, PECR's rules on unsolicited direct marketing calls apply, with an important carve-out: calls to a corporate subscriber, a limited company or public body number, are generally exempt from PECR's stricter consent requirements, whereas calls to sole traders and partnerships are treated more like consumer calls.

That distinction matters practically. A campaign calling limited companies has more latitude under PECR than one calling sole traders, freelancers, or partnerships, who fall closer to individual consumer protections. Segment your contact list by business structure, not just by "B2B," before setting consent requirements.

The Telephone Preference Service and corporate numbers

The TPS is the UK's do-not-call register, and it applies to individual subscribers, sole traders, and partnerships who have registered, but not to numbers registered to limited companies specifically for business use. Screening against the TPS is still worth building into any UK campaign that might reach sole traders or partnership contacts, even though pure limited-company B2B calling sits outside its scope.

Ofcom's rules on calling identification and behaviour

Ofcom requires that calls display a valid, reachable number, not a spoofed or unreachable one, and this applies to AI-placed calls the same as human-placed ones. Configure the calling platform to use verified, callback-capable numbers rather than a rotating pool of throwaway numbers, both for Ofcom compliance and because a recognisable, consistent number improves answer rates over time as recipients start to recognise it.

What changed since Brexit, and what to watch

UK data protection reform has moved at its own pace since 2021, with proposals to simplify parts of UK GDPR that diverge from the EU version, though the core principles, lawful basis, transparency, data minimisation, remain closely aligned for now. The practical implication for a calling programme: build to UK GDPR and PECR as their own compliance track, not as an assumed subset of EU compliance, and revisit the specifics periodically since this is an area still actively evolving post-Brexit.

Building a UK-compliant calling setup

1. Segment contacts by business structure, limited company versus sole trader or partnership, since PECR treats them differently.
2. Screen sole trader and partnership contacts against the TPS before calling; limited company numbers used for business purposes are generally exempt.
3. Use verified, reachable caller ID numbers on every call, in line with Ofcom's identification rules.
4. Apply UK GDPR's lawful basis requirements independently, rather than assuming EU GDPR compliance automatically covers UK contacts.

Calling hours and UK business norms

There is no single statutory calling-hour window for B2B calls in the UK the way there is for consumer telemarketing, but 8am to 6pm on business days is the conventional, well-received norm, and calling significantly outside it reads as poor practice even where it is not strictly unlawful. UK business calling culture also tends to favour a brief, polite opening before getting to the point, closer to the direct end of European norms but with more emphasis on courtesy phrasing than, for example, a typically more blunt German opening.

What to measure

Connect rate segmented by business structure, since sole trader and limited company contacts often behave differently in response to calls. TPS-screening coverage, confirming every eligible contact was checked before the campaign ran. And complaint or opt-out rate, watched closely given the ICO's active enforcement posture on nuisance calls in recent years.

Frequently asked questions

Is EU GDPR compliance enough for calling UK contacts?

Not automatically. UK GDPR and PECR are their own legal framework post-Brexit, closely aligned with EU GDPR today but enforced separately by the ICO, and worth building to as a distinct compliance track.

Do I need to screen against the TPS for all UK B2B calls?

Only where the contact could be a sole trader, partnership, or individual subscriber. Numbers registered specifically to limited companies for business use generally sit outside TPS and PECR's stricter requirements, but confirm the specifics for your contact list with counsel.

What number should the agent display when calling UK contacts?

A verified, reachable number in line with Ofcom's caller identification rules, ideally a consistent number rather than a rotating pool, which also improves answer rates over time.

Does this apply to calls placed from outside the UK to UK contacts?

Yes. UK GDPR and PECR apply based on where the recipient is, not where the calling business or platform is located.

This is not legal advice; a UK calling programme should be reviewed against current ICO and Ofcom guidance for your specific contact list. See how UK-specific calling rules are configured on the AI voice agent platform.