Before you even start contacting people on a list you have purchased from a third-party, ask yourself this: “Did the data provider obtain that information consensually – and did the individuals on that list consent to being contacted by parties other than the data provider itself?” 

If the answer to both questions – or either of them – is “no”, then you will be breaking the law under the GDPR. Consent must be acquired for each individual action: the data provider must have obtained that information consensually – and the data subjects must have consented to their data being used by parties other than the data provider. 

Also, if you record calls it falls under the Data Protection Act (DPA) of 1998 and is classified as a form of data processing. The DPA states that individuals must be informed of how and why their data is being processed – which, in this instance, mean telling the individuals what the call is for or going to be used for.