"How did you get my number?"

Every other objection is handled with technique. This one is handled first with the law. That is what makes it unusual: a smooth but evasive answer puts you in the wrong, where a flat but accurate one gets you out of trouble.

An objection with legal consequences

When someone asks where you got their number, they are exercising a right, not looking for a way off the phone, even when it sounds like one. Under the UK GDPR, where personal data has not been collected from the person themselves, they are entitled to be told which source it came from. Article 14 puts that on you as an obligation to volunteer. The right of access covers the same ground on request.

The practical consequence is blunt. You have to be able to answer, there and then, with a specific source. If you cannot, the problem is not your script. It is your data.

What the law requires you to be able to answer

Two regimes apply at once, and salespeople usually know about one of them. The UK GDPR governs the data. PECR governs the call itself. The ICO enforces both, and it is your organisation that is on the hook, not the person holding the handset.

On the data side, business prospecting normally rests on legitimate interests. That basis is not a free pass. It comes with obligations someone can check.

• A lawful basis you have written down, with the balancing exercise recorded rather than assumed, and the processing listed in your records.
• Telling people what you are doing, including where their data came from.
• The right to object, which is absolute for direct marketing under Article 21: the person does not have to give a reason, and you have to stop using their data for that purpose.
• A genuine link to the person’s professional role, which is what makes the balancing exercise stand up in the first place.
• Telling people before you record, with a lawful basis for the recording and a retention period you have actually set.

On the call side, PECR adds an obligation that sits before the dial, not after it. You must not make an unsolicited live marketing call to a number registered with the Telephone Preference Service, or with the Corporate TPS for business numbers, unless that subscriber has told you they are happy to hear from you. Screening the list against both registers is the step that makes the call lawful, and it is the step that gets skipped.

Two details decide most cases. First, a registration takes effect some weeks after it is made, which is why a list is re-screened on a regular cycle rather than once at import. Second, the split is not the one people expect: it runs on the type of subscriber, not the type of number. Sole traders and many partnerships are treated as individual subscribers, so their business line belongs on the TPS side of the check, not the CTPS side. A B2B list that has only been screened against the CTPS is not fully screened.

PECR also expects a marketing call to identify who is calling, to give a contact address on request, and to present a number that can be called back. None of that is onerous. All of it is the kind of thing that surfaces in a complaint.

The answer, word for word

It runs in three beats: the source, the professional reason, the way out. Fifteen seconds in total.

Note what the good answer does not do. It does not apologise, it does not argue, and it does not try to get back to the pitch before the question has been answered. The order matters as much as the content: source first, then the reason, then the exit. Reverse any two of those and it reads as a manoeuvre.

Three sources, three wordings

In all three cases the provider’s name has to be available to you. “A third party” with no name reads as a dodge, and it reopens the question instead of closing it. If your enrichment supplier is one you would not name on a call, that is worth knowing before the call rather than during it.

Picking the call back up

The recovery works because nothing has been left hanging. If you answer the question and then pause, the silence reads as guilt. Answer, then move, in the same breath.

The four answers that make it worse

• “It’s publicly available.” Sometimes true, never sufficient. The fact that data is public says nothing about your right to reuse it, and it does not answer the question that was asked.
• “Marketing handles that.” You have just announced that nobody knows, which is precisely what they were afraid of.
• “We bought a list.” Worth avoiding, not because buying data is unlawful but because the phrase evokes a trade in people. Say “a business data provider”, and name it. Bought data also carries its own problem: you have to satisfy yourself that the provider had a lawful basis to supply it, and that responsibility does not transfer to them.
• Dodging and pressing on. The question will come back, in a markedly less friendly tone, and often to someone else in your company.

If they ask you never to call again

Deal with it on the spot, confirm it out loud, and end the call politely. Do not try one last angle. Objecting to direct marketing is an absolute right, and working around it is not a grey area.

One technical point gets missed constantly. A record that is simply deleted comes back with the next import, and the second call lands far worse than the first. The practice the ICO expects is a suppression list: keep the minimum needed to recognise the person, for the single purpose of never contacting them again, and check every new file against that list before it is imported. Deleting is not the safe option here. Suppressing is.

The objection has to travel, too. It applies to the CRM, the dialler and the enrichment files alike, and to any list you share with a partner or an agency. If your suppression list lives in one system and your calling happens in another, you have a gap that will be found. The person can also register with the TPS or the CTPS independently of anything they said to you, which is the other reason list screening is a recurring job rather than a one-off.

Fixing the problem upstream

This objection thins out sharply once the source of every contact is stored alongside the contact. That is a data hygiene question more than a scripting one: a file imported with no source field will always produce calls you cannot defend, however good the wording on the page.

Three habits do most of the work. Record where each number came from at the point of import, with the date. Screen against the TPS and the CTPS on a fixed cycle rather than at import only. Keep the suppression list in the system that actually places the calls, not in a spreadsheet somebody maintains by hand. None of it is complicated, and all of it turns a potentially awkward exchange into fifteen seconds of straight talk.

Two other objections deserve the same word for word preparation: “we already do it in house” and “you’ve caught me at a bad time”. Both appear, along with this one, in block 5 of the one page call plan.