Taking this on a slight tangent...

We get endless unwanted sales calls at work, mostly due to a former director who gave the number out willy nilly. Previously, we just ask them not to call again and they reply with 'OK, we'll remove your details from our system', and that was that.

I don't know whether it's me noticing it more now with all the GDPR stuff, but now when you ask them not to call again, they almost all say 'OK, we'll update our records and make a note not to call again' instead of saying they will remove you from their systems but they will still hold all your information/data.

Seems you have to explicitly state that you want all your details held by them to be destroyed.

Does GDPR apply? If they are just calling a business number, probably not. If they have details for a named individual it probably does.

Further complicated by the fact that some names, e.g. Directors, will be on a public record anyway.

A useful starting point: https://ico.org.uk/for-organisations...gdpr-and-pecr/

They always ask for the former director by name and calls such as home appliance warranty, private medical cover etc. are most common, so that's probably the case.