DND scrub for purchased lists: not the same as consent
A DND scrub checks one thing: whether a number sits on the registry. It says nothing about consent, which a purchased list never carries.
· 4 min read
The phrase businesses reach for, and what it actually means
A business about to run its first outbound calling campaign is told, usually by whoever is selling it a number list or a dialer platform, that the list has been 'scrubbed against DND.' The phrase gets used as a kind of clearance — as though it settles the question of whether the calls are permitted.
It settles a narrower question than that, and knowing exactly which question is the difference between a campaign that's actually compliant and one that only sounds like it is.
What a scrub mechanically does, and what it doesn't
Under TRAI's Telecom Commercial Communications Customer Preference Regulations, a scrub is the process of checking a list of phone numbers against the National Customer Preference Register — the DND registry — before a commercial call or message goes out, so that numbers registered as fully or partially opted out are filtered before dialling rather than after a complaint arrives. Telecom operators run this scrubbing as part of the Distributed Ledger Technology infrastructure the regulations require: an entity sending commercial communication registers as a Principal Entity, and messages or calls routed through the network are checked against the recipient's DND preference and blocked if they don't match a valid basis to proceed.
What a scrub confirms, mechanically, is one fact: whether this particular number is currently on the DND registry, and if so, for which categories. It says nothing about whether the business calling has any relationship with, or permission from, the person who owns that number.
Why 'we bought the list' fails before the scrub even runs
This is exactly where a purchased list falls short, and it falls short before the scrub becomes relevant to the question of whether the calls are legal at all. Consent, in TRAI's framework, is what a business needs to have obtained directly from the person being called — either inferred from an existing relationship with that specific business, or explicit and separately verified through a registered Consent Registrar. A purchased list of numbers, however it was compiled, carries no such relationship and no such verified permission with it; a list vendor's claim that the numbers were 'opted in' somewhere is not the same as this specific business having obtained consent for its own outreach.
A number can pass a DND scrub cleanly — meaning it isn't on the registry at all, or the campaign category happens to be one the registry doesn't block — and a call to it can still be entirely unauthorised, because passing the scrub answers 'is this number blocked by the registry' and not 'has this business been given permission to call it.' Both checks have to clear independently; neither substitutes for the other.
The traceability chain a scrub sits inside
The scrub sits inside a broader traceability requirement worth understanding on its own terms, because it explains why buying a list from a broker is a weak position even before consent is considered. TCCCPR's registration structure limits how many intermediaries can sit between the Principal Entity actually sending the communication and the telecom service provider delivering it, specifically so a call or message can be traced back to who caused it to be sent.
A business that outsources its calling to a list broker or an unregistered intermediary, rather than registering itself and any legitimate partner properly on the DLT platform, is not just risking a consent problem — it is operating outside the traceability structure the whole framework is built around, which is its own separate compliance failure independent of whether any individual number was reachable.
What passing a scrub actually tells a business
None of this makes a DND scrub pointless — it is a genuinely necessary, mandatory step, because DND registrations change daily and a list clean when it was compiled is not necessarily clean by the time a campaign actually runs. A business that skips scrubbing entirely and dials a static list will, over time, reach numbers that have since registered a DND preference the business had no way of knowing about.
The honest way to describe a clean scrub result is narrower than 'we're covered': it means the numbers currently being called are not blocked by the recipient's own registered preference at this moment, for this category. Whether the business has any right to be calling them in the first place is a separate question the scrub was never designed to answer.
A workable habit instead of a one-time check
A workable practice treats consent and DND status as two independent checks, both re-verified close to the point of dialling rather than once when a list is first assembled: does this business have a valid, current consent basis — inferred from a real, existing relationship, or explicit and registered for this specific purpose — for this specific number, and separately, does the current DND scrub clear it for this category today.
A calling platform can automate both checks structurally, refusing to queue a call that fails either one rather than leaving it to whoever is running the campaign that week to remember to check — but the underlying two-part discipline is what actually matters, regardless of which tool is enforcing it. A business unsure whether a specific list or campaign clears both bars is better served checking with a telecom compliance professional before a large send than assuming a vendor's scrub receipt has already answered the harder question.
Common questions
If a list vendor says their numbers are opted in, is that enough consent for us to call them?
Not on its own. TRAI's framework requires consent to run between the specific business making the call and the person being called — either inferred from an existing relationship or explicit and registered through a Consent Registrar for that business's own outreach. A vendor's general claim about how a list was compiled does not transfer a verified consent record to a different business calling from it.
Does scrubbing a list against DND make a calling campaign compliant?
It clears one requirement — that the numbers being dialled aren't currently blocked by their own registered DND preference for the relevant category. It does not establish that the business has consent to call those numbers in the first place, which is a separate, independently required condition under TCCCPR.
How often does a list need to be re-scrubbed?
DND registrations can change at any time, so a list scrubbed once and then used repeatedly over weeks or months is not reliably clean for the later calls. The safer practice is scrubbing close to the point of dialling for each calling run, rather than treating one scrub as a permanent clearance for the whole list.
Can we call a number on the DND registry if we have their explicit consent?
Yes — a validly obtained and currently valid explicit consent, verified and recorded through a registered Consent Registrar for the relevant category, allows a business to contact a number even if it's on the DND registry for that category. The consent has to actually meet TRAI's requirements for what counts as explicit and be current for the specific purpose, not simply asserted by the calling business.