الصفحة الرئيسية › مكتبة القوانين › UK PECR
GB
UK PECR
Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended
مؤكَّد من مصدرين. آخر تحقق 11 أكتوبر 2026
موعد المراجعة الكاملة التالية: . نتابع أخبار الجهات الرقابية شهريًا، وتُسجَّل التغييرات في سجل التغييرات.
الاستشهاد بهذه الصفحة: GlanceDesk Jurisdiction, “UK PECR (United Kingdom)”, glancedeskjurisdiction.com/laws/uk-pecr, last verified 11 October 2026.
United Kingdom الخصوصية
- الحالة
- In force since 11 Dec 2003. Heavily amended; DUAA 2025 PECR changes in force in two stages (20 Aug 2025 and 5 Feb 2026).✓
- على من ينطبق
- Any organisation that markets by phone, email, text or fax, or stores or reads data on users' devices (cookies, SDKs, pixels, apps, smart devices). Also providers of public electronic communications networks and services (security, traffic and location data, breaches). Applies even where no personal data is processed. UK-based services must comply even if hosted abroad; PECR has no specific rule bringing in overseas services just because UK users can reach them.✓
- حدود الحجم
- None stated. No size or turnover threshold appears in PECR.✓
- الجهة الرقابية
- Information Commission (took over from the Information Commissioner on 30 Sep 2026; still known as 'the ICO').✓
- الإبلاغ عن الخروقات أو الحوادث
- Public electronic communications service providers (telecoms, ISPs) must notify the Information Commission of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware. Give reasons if later. Notify affected subscribers/users without undue delay if likely to harm them. Keep a breach log. The old 24-hour deadline ended on 20 Aug 2025. Late notification can attract a £1,000 fixed penalty.✓
- مهلة الرد على طلبات البيانات الشخصية
- N/A. PECR sets no access-request deadline. Requests about personal data follow UK GDPR (1 month).✓
- مسؤول حماية البيانات
- N/A. PECR does not require a DPO. UK GDPR rules apply where personal data is processed.✓
- الممثل المحلي
- N/A. PECR has no UK representative requirement (UK GDPR Art 27 may apply separately).✓
- نقل البيانات إلى الخارج
- N/A. PECR has no transfer rules. Transfers of personal data follow UK GDPR Chapter V.✓
- ملفات تعريف الارتباط والموافقة
- Do not store or read data on a device without prior UK GDPR-standard consent unless an exception applies. Exceptions (since 5 Feb 2026): sending a communication; strictly necessary for a service the user asked for (incl. security, fraud prevention, saving inputs); statistics to improve your own service; adapting site appearance or function to user preferences; locating a user who needs emergency help. The statistics and appearance exceptions need clear information and a simple, free way to object. Advertising and tracking cookies still need consent. Electronic marketing to individuals needs consent, except the soft opt-in for existing customers and, since 5 Feb 2026, for charities.✓
- أقصى عقوبة
- Up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, for breaches on or after 5 Feb 2026. Earlier breaches stay under the old £500,000 cap. Directors can be fined for some marketing breaches. Reg 5A breach-notice failures are dealt with by fixed penalty, not a full penalty notice.✓
المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.
ما يجب عليك فعله✓
- Get opt-in consent before setting non-essential cookies or similar tech.
- Use the analytics and preference exceptions only with clear notice and an easy, free opt-out.
- Get consent before email/SMS marketing to individuals, unless the soft opt-in applies.
- Offer an opt-out at collection and in every marketing message.
- Screen marketing calls against the TPS/CTPS and never make unconsented automated calls.
- Telecoms providers: report personal data breaches to the ICO within 72 hours and log every breach.
- Update fine-risk assessments: PECR now carries UK GDPR-level penalties.
التغييرات الأخيرة
DUAA 2025 (Royal Assent 19 Jun 2025). 20 Aug 2025: PECR breach deadline moved from 24 to 72 hours. 5 Feb 2026: new cookie exceptions (Sch A1), charity soft opt-in, UK GDPR-level fines and enforcement powers, wider 'call'/'communication' definitions (sent-but-unreceived messages count), codes of conduct. 30 Sep 2026: the Information Commission replaced the Information Commissioner.✓
شريك
Termly
Set up a cookie consent banner and cookie policy for EU, UK and US visitors.
Set up your cookie banner with Termlyرابط شريك: قد نحصل على عمولة إذا اشتريت، دون أي تكلفة إضافية عليك. ولا يؤثر ذلك أبدًا في محتوانا القانوني. الإفصاح عن روابط الشركاء
المصادر
- المصدر الأساسي: https://www.legislation.gov.uk/uksi/2003/2426/contents
- المصدر الثاني: https://www.dpocentre.com/blog/marketing-compliance-under-duaa-and-pecr/
- الجهة الرقابية: Information Commission (took over from the Information Commissioner on 30 Sep 2026; still known as 'the ICO').
المصادر المستخدمة في التحقق المستقل (26)
- https://www.legislation.gov.uk/uksi/2003/2426/regulation/1
- https://www.legislation.gov.uk/uksi/2026/82/made
- https://www.pinsentmasons.com/out-law/news/guidance-on-e-mail-marketing-and-cookies-law
- https://www.osborneclarke.com/insights/regulatory-outlook-september-2025-data-law
- https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/what-are-pecr
- https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-pecr-rules/
- https://www.dpocentre.com/blog/marketing-compliance-under-duaa-and-pecr/
- https://www.legislation.gov.uk/uksi/2003/2426/contents
- https://www.gov.uk/government/news/information-commission-succeeds-the-ico-as-uks-data-protection-regulator
- https://www.legislation.gov.uk/uksi/2003/2426/regulation/31
- https://www.lewissilkin.com/insights/2026/09/29/what-the-icos-transformation-into-the-information-commission-means-for-your-orga-102o3ni
- https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/communications-networks-and-services/security-breaches/
- https://www.legislation.gov.uk/uksi/2003/2426/regulation/5A
- https://www.legislation.gov.uk/uksi/2003/2426/schedule/A1
- https://www.legislation.gov.uk/uksi/2003/2426/regulation/6
- https://www.legislation.gov.uk/uksi/2003/2426/regulation/22
- https://ico.org.uk/for-organisations/guide-to-pecr/cookies-and-similar-technologies/
- https://brodies.com/insights/ip-technology-and-data/storage-and-access-technologies-ico-publishes-updated-guidance-on-the-use-of-cookies-and-other-tracking-technologies/
- https://www.withersworldwide.com/en-gb/insight/read/soft-opt-in-now-in-force-for-uk-charities
- https://www.legislation.gov.uk/uksi/2003/2426/schedule/1
- https://www.legislation.gov.uk/ukpga/2018/12/section/157
- https://www.mishcon.com/news/unlawful-cookies-a-new-avenue-for-the-ico-to-issue-fines
- https://www.legislation.gov.uk/uksi/2003/2426/regulation/19
- https://www.legislation.gov.uk/uksi/2003/2426/regulation/21
- https://gpg-pdf.chambers.com/Advertising-and-Marketing-2025/309/
- https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/privacy-and-electronic-communications
= مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق
معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على contact@