The DNC Safe Harbor Worksheet

Most agents working purchased data believe the requirement is “scrub every 31 days.” The 31 days is real, but it is one item in a six-part safe harbor. Do only that one and you have a cleaner file and no defense.

Below is each condition as the regulation states it, what it means for a small operation, and what “documented” has to look like. Everything here is cited to 16 CFR 310.4.

1. Condition 1310.4(b)(3)(i)

   Written procedures

   You have established and implemented written procedures to comply with the do-not-call rules.

   What documented means: A single document naming who pulls the scrub, how often, where the file lives, and what happens when someone asks to stop. One page is a written procedure. Nothing in your head is.

2. Condition 2310.4(b)(3)(ii)

   Training

   You have trained your personnel, and any entity assisting in your compliance, in those procedures.

   What documented means: If you are a one-person operation, this is a dated note that you read and adopted the procedure. If you use a VA, a dialer vendor or an overseas caller, they are covered by this condition too — and they are the most commonly missed part of it.

3. Condition 3310.4(b)(3)(iii)

   An internal do-not-call list

   You maintain and record a list of numbers you may not contact, built from people who told you directly to stop.

   What documented means: A suppression list your dialer actually reads before it dials. This request binds you regardless of any registry, and it does not expire. It is the cheapest condition to satisfy and the most expensive to neglect, because the evidence of the request is usually sitting in your own CRM.

4. Condition 4310.4(b)(3)(iv)

   A scrub no older than 31 days — and the records

   You use a process employing a version of the registry obtained from the Commission no more than thirty-one days before the call, and you maintain records documenting that process.

   What documented means: Dated scrub receipts, kept. This is the condition most agents think is the whole rule, and it is the only one with two halves: the clean file and the proof of how it got clean. A clean file with no dated record is a scrub you cannot demonstrate.

5. Condition 5310.4(b)(3)(v)

   Monitoring and enforcement

   You monitor and enforce compliance with the procedures you established.

   What documented means: A recurring check that the process actually ran — the scrub happened on schedule, the suppression list was applied, the exceptions got looked at. A procedure nobody checks is condition one without condition five.

6. Condition 6310.4(b)(3)(vi)

   The call was an error

   Any call that slipped through was the result of error, not of failing to obtain the information needed to honor a stop request.

   What documented means: This one you cannot prepare in advance; it is the test the other five let you pass. If conditions one through five are real and documented, a call that gets through reads as an error. If they are not, it reads as a process that was never built.

The 31-day clock, applied to aged data

People register on the Do-Not-Call list every day, so a file cleaned six weeks ago is no longer clean. Aged data carries that problem twice: a 90-day-old record has had three months of registrations land on it since it was generated. Re-scrub before you work a batch, then every thirty-one days for as long as you keep working it — not once at purchase.

Calling hours are a separate rule

The registry governs who you may call, not when. 16 CFR 310.4(c) restricts calls to a residence to between 8:00 a.m. and 9:00 p.m. local time at the called person’s location — not yours — and several states are stricter. Aged lists are almost always multi-state, so a perfectly scrubbed file dialed at 7:45 a.m. in a time zone you did not check is still a violation.

Which law you are reading

Everything above is the FTC’s Telemarketing Sales Rule. The TCPA is a separate statute with its own rules at the FCC (47 CFR 64.1200), and the TSR’s own footnotes say that complying with one does not discharge your obligations under the other. When a vendor says a product makes you “DNC compliant,” ask which regime they mean.

Operational guidance, not legal advice — liability for every call sits with you, the caller. Confirm specifics with a TCPA attorney; Henson Legal is the firm we point people to.

Working out whether to scrub free or paid? Read the free-versus-paid breakdown — including where litigator scrubbing fits, and where it does not.