Cold outreach without becoming spam

A list that’s sharp

Sharp means: for each company you can say in one sentence why you’re ringing them. Not "is a plumbing firm", but something that’s going on now.

You can find that without expensive tools. They’re advertising for staff on their site, so they’re growing. They’ve just opened a second branch. They work in a trade where a rule is changing. They work alongside someone you also know. More on where those signals come from in where a small business finds its leads.

If you can’t write that sentence, take the company off your list. That feels like reducing your chances and it’s the opposite: you’re removing the conversations that would have gone nowhere anyway.

A landline and a mobile are not the same call

This is the part that catches people out in Ireland, and it has nothing to do with how big the company is. Regulation 13 of the ePrivacy Regulations (S.I. No. 336 of 2011) treats the two kinds of number under two opposite rules.

A landline is permitted unless. Under Regulation 13(5) you must not make an unsolicited marketing call where either the subscriber has told you they don’t consent, or the number is recorded as opted out in the National Directory Database. If neither applies, the call is allowed. Note what the Regulation doesn’t say: it says "a subscriber or user", with no exception for companies. A limited company’s office line is covered the same way a household’s is.

A mobile is forbidden unless. Regulation 13(6) sits on top of that and reverses it: you must not make a marketing call — or let an automated calling machine make one — to the mobile telephone of a subscriber or user unless they have told you they consent to receiving such calls on their mobile, or that consent is recorded in the National Directory Database against that mobile number. A mobile therefore has to clear both gates, and the second one is consent. There is no business exception here either: a sole trader whose only number is an 08x number, and a sales director’s work mobile, are both in the consent regime.

So the same prospect can be two different legal questions depending on which of their numbers you dial. Ringing the switchboard is one thing; ringing the mobile on the signature of their last email is another, and for that one you need consent you can point to.

One more rule for the call itself: Regulation 13(10)(a) requires you to give the name of the person making the call and, if applicable, the name of the organisation the call is made on behalf of. That’s the whole requirement — there is no Irish rule obliging you to display your number.

What the National Directory Database actually is

It’s worth being precise, because the name suggests a do-not-call list and it isn’t one. The NDD is defined in the Regulations as the record of all subscribers of publicly available telephone services in the State — fixed, personal and mobile — who have not refused to be included in it. It exists to feed directories and directory enquiries. The marketing preference is a field in that record, added under Regulation 14(3).

Two separate lists come out of that field, and they point in opposite directions. The first is the opt-out register: fixed-line subscribers who told their provider they don’t want marketing calls, plus every ex-directory number, which goes on automatically. The second is a list of mobile subscribers who have opted in; everybody not on it has not consented. That’s the same split as Regulations 13(5) and 13(6), seen from the database side.

Business numbers are in there. The Data Protection Commission’s own NDD guidance says both residential and business numbers are listed and both can have a marketing preference recorded. Registering is free and goes through the line provider, not the database — the NDD doesn’t take instructions from subscribers directly — and ComReg says a changed preference can take up to five working days to appear.

You cannot tell from a number whether it carries an opt-out, and a subscriber can only ask for a copy of their own entry. So checking is not something you can improvise: it runs through a licence.

How a small business actually checks it

ComReg publishes the route under the heading "Information for Direct Marketers": you contact the organisation that manages the database. Since 1 July 2024 that’s PXS, directed by ComReg for a three-year term under Decision D19/24. They publish an application form for a Direct Marketing Database Licence, in two versions — single use, for cleansing your own lists, and multi use, for cleansing your own and third parties’ lists as well.

Read the first paragraph of that form before anything else. The data supplied under the licence may only be used for suppression. It is not a calling list you’ve bought; it’s a list you check your own list against and then delete from it what matches. People get this backwards, and getting it backwards is the expensive version.

Honest gap: the price isn’t published. Regulation 14(6)(a) says access is on payment of such fee as the operator requires, and Regulation 14(7) says those fees have to be cost-recovery and approved by ComReg — so there is a number, but it isn’t in the Regulations, on the form, or on ComReg’s page. You have to ask for a quote, and the same goes for how long it takes to set up. Don’t plan a calling week around an answer you haven’t got yet.

There’s one piece of slack built into the law. Regulation 13(9) says you don’t breach the NDD limb if the call is made within 28 days after the registration was received and recorded. That protects you against an opt-out newer than your copy of the list — which in practice sets your refresh rhythm, because a suppression file older than 28 days stops protecting you. It does nothing for the mobile rule, which doesn’t depend on an NDD entry at all.

The first twenty seconds

On the phone, the opening decides everything. Three things, in this order:

1. Who you are and why you’re ringing them in particular. The first half is also a legal requirement; the second half is the whole art. "I saw you’re looking for two more engineers" is a reason; "we help businesses like yours" isn’t.
2. A question, not a speech. You don’t know whether their problem is your problem. Ask. That saves you time and saves them a pitch.
3. An explicit way out. "If this isn’t relevant, do say and I won’t keep you." That sounds like undermining yourself and does the opposite: it removes the pressure, and people who don’t feel pressure keep talking.

Email: the looser side here, with its own rules

Unlike the calling rules, business email in Ireland is the permissive end. Regulation 13(2) takes an address that reasonably appears to be used mainly for the recipient’s commercial or official activity out of the consent rule, provided your message relates solely to that activity, and Regulation 13(4) makes it explicit for organisations: prohibited once they’ve told you they don’t want it, not before. The conditions that go with that — a valid contact address, a working way to stop, no disguised sender — and where the line sits for a one-person business are all in can you send that email.

One thing that belongs here rather than there: a text message. Under Regulation 13(7), an SMS you send for a non-marketing reason but which carries marketing information in it needs consent. "Just following up on our call" with an offer attached is a marketing message, whatever the first line says.

How often to come back

One attempt is too few. Most people are simply busy the first time, and that says nothing about their interest.

A workable rhythm: three attempts, each with something new, spread over a month or six weeks. A call, then something they can use, then one more call.

"Something new" is the condition. Asking the same question three times isn’t persistence, it’s a nuisance — and it’s also the point at which people start remembering you as the annoying one who rang.

What to do with a no

If they asked you not to contact them again, that’s not a preference, it’s Regulation 13(5)(a): the call becomes prohibited from that moment, whatever the database says. It goes on your own do-not-call list and it stays there, and it has to survive a change of CRM, a change of staff and a new list bought from somewhere else.

A softer no is different. Record the reason and the date, and move them to the slow rhythm: twice a year. Don’t drop them, but do let go — cold contacts are nearly always a timing problem. The company that signed with someone else last week will be reconsidering in two years, and then the only question is whether you’re still in view.

Worth knowing about the other direction too: the DPC’s guidance is that where someone has an existing relationship with you and hasn’t told you to stop, a call can rest on the consent arising from that relationship even if a preference is recorded in the NDD. That’s a reason to keep your own records straight, not a loophole — the Regulations hang it on whether the call was requested, and you’re the one who’d have to show that.

What getting it wrong costs

Breaching Regulation 13 is a criminal offence, not an administrative slip, and each call counts as a separate offence under Regulation 13(13)(b). On summary conviction that’s a class A fine, meaning up to €5,000; on conviction on indictment, up to €250,000 for a company and €50,000 for an individual.

And the burden is the wrong way round from what most people assume. Regulation 13(14) puts the onus of establishing that the person unambiguously consented on the defendant. If your evidence of consent for that mobile number is a memory of a conversation, you don’t have evidence of consent.

Where it really falls over

Not on the conversations. On the record-keeping. Ring thirty companies without writing down what was said and after two weeks you don’t have a list, you have a feeling. And since consent is something you may have to prove, "I think they said it was fine" is worth nothing twice over.

Three lines per conversation, a next step with a date, and the source of any consent written next to the number it applies to. That’s the whole system, and without that part cold outreach is one-off work that builds nothing.