PECR for GTM engineers: building compliant UK outbound

A workflow sending marketing into the UK is only compliant if it knows, for every record, two things: what kind of subscriber it is dealing with, and whether that number is on the TPS or CTPS register. Under PECR, limited companies can be emailed without prior consent if you identify yourself and offer an opt-out. Sole traders and some partnerships are treated as individuals and need consent. Marketing calls to businesses must be screened against both the TPS and CTPS. A GTM engineer has to build those rules into the system as data fields and gates, because an agent will not infer them.

This applies to any team prospecting into UK businesses, wherever the team itself is based. And it matters more now than it did two years ago, for two reasons. The fines went up, and the tools got fast enough to break the rules at scale in an afternoon.

Why is this a GTM engineering problem, not a legal one?

Because the workflow makes the decision. ZoomInfo's description of the agents it bought with DoubleO.ai on 30 September 2026 included taking a closed deal and finding ten lookalike competitors to approach with tailored messaging. Clay reported on 10 September 2026 that one of its GTM engineers cut account research from more than 85 minutes to under five with four AI agents.

That speed is the point of GTM engineering. It also means a compliance mistake in the logic is repeated on every record the system touches, with nobody reading each email before it goes.

Since 5 February 2026, under the Data (Use and Access) Act 2025, the maximum PECR fine is £17.5 million or 4% of annual global turnover, whichever is higher. The old cap was £500,000.

What are the UK rules for marketing emails?

The rules sit in regulation 22 of PECR. The ICO's guidance makes three distinctions a workflow needs to capture:

1/ Corporate subscribers. You can send marketing emails to a company, limited liability partnership, Scottish partnership or government body. You must identify yourself and give a valid way to opt out. The ICO calls keeping a "do not email" list of businesses that object "good practice and good business sense".

2/ Individual subscribers. "Sole traders and some partnerships are treated as individuals," the ICO says, so you can only email them with specific consent or under the soft opt-in for existing customers.

3/ The soft opt-in does not cover prospects. The ICO is explicit that it "does not apply to prospective customers or new contacts (eg from bought-in lists)".

There is also no email equivalent of the TPS. The ICO says no central register is needed because you should not be emailing individuals without consent in the first place.

Data protection law still applies on top of PECR. The ICO notes you may need to consider it when emailing named employees at a company, such as firstname.lastname addresses.

What are the UK rules for marketing calls?

Live marketing calls are covered by regulation 21. You must not call a number registered with the TPS or CTPS unless that person has specifically consented to calls from you, and that applies even to existing customers. You must also not call anyone who has told you they do not want your calls.

For B2B, the ICO's guidance is direct: sole traders and some partnerships register with the TPS, while companies register with the CTPS, so "you will therefore need to screen against both the TPS and the CTPS registers, as well as your own 'do not call' list." You must display your number and say who is calling.

Automated calls with recorded messages are stricter. Under regulation 19 they need specific consent for that type of call. General marketing consent is not enough.

Why do small-business lists cause the most trouble?

Because the line between a company and an individual runs straight through them. A consultancy run as a limited company and one run by a sole trader can look identical in a prospect list: same kind of website, same job title, same generic email address. Under PECR they sit on opposite sides of the email consent rule.

Standard enrichment data does not help much here. It is built around company records, headcounts and LinkedIn pages, and it rarely records legal entity type. A workflow that treats every business as a company will email sole traders it has no right to email, and it will do it every time it runs.

Teams prospecting into the UK from abroad have an extra risk: rules written for their home market get copied into the workflow unchanged. Build the UK logic as its own rule set, keyed on the country of the record, not the country of the sender.

How do you build compliance into the workflow?

Treat it as a data model problem first, then a gating problem. Five fields and gates cover most of it.

1/ Legal entity type on every record. Limited company, LLP, sole trader, partnership or unknown. Unknown should be handled like an individual until confirmed. Companies House is the obvious source for incorporated businesses.

2/ Channel permissions derived from entity type. Email allowed or blocked, calls allowed or blocked, written by a rule rather than decided by an agent each time.

3/ TPS and CTPS screening on every number before it reaches a dialler or a rep task, refreshed regularly rather than once at import. The ICO's checklist starts with "We screen numbers against the Telephone Preference Service (TPS) or for corporate subscribers the Corporate Telephone Preference Service (CTPS)."

4/ A suppression list that every channel checks. Do-not-call and do-not-email entries from replies, unsubscribes and calls, synced back into the CRM so a new campaign cannot re-contact someone who objected.

5/ A human approval step on any change to targeting or messaging logic. Clay described on 21 October 2026 how its own GTM engineers put a person between an agent's proposed workflow change and the live system. The same review is where a compliance check belongs.

Then run the arithmetic on what one wrong rule costs. A workflow sending 40 emails a day to a list where a fifth of records are sole traders misclassified as companies sends eight unlawful emails a day, about 40 a working week, without anyone noticing. That is the scenario these gates exist to stop.

What should you check before you switch anything on?

Ask three questions of any outbound system, whether you built it or bought it.

1/ Can it tell me the legal entity type of the next record it will contact?

2/ When was that phone number last screened against the TPS and CTPS?

3/ If someone opted out yesterday, which systems already know?

If any answer is "not sure", the problem is the data, not the copy.

This is a summary of published ICO guidance, not legal advice. For anything specific to your business, read the ICO's guidance on electronic and telephone marketing in full or take legal advice.

A note on Peach Data

Peach Data builds go-to-market engineering systems for sales and marketing teams: the data foundation, the workflows and the agents behind outbound and inbound. We started as a verified data business, so every build starts with the data layer. peachdata.co.uk