Home › Compare laws side by side › UK PECR vs EU GDPR

UK PECR vs EU GDPR

Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended (United Kingdom) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.

Topic	UK PECR United Kingdom ✓ Confirmed by two sources	EU GDPR European Union (EEA) ✓ Confirmed by two sources
Status	In force since 11 Dec 2003. Heavily amended; DUAA 2025 PECR changes in force in two stages (20 Aug 2025 and 5 Feb 2026).✓	In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓
Who it applies to	Any organisation that markets by phone, email, text or fax, or stores or reads data on users' devices (cookies, SDKs, pixels, apps, smart devices). Also providers of public electronic communications networks and services (security, traffic and location data, breaches). Applies even where no personal data is processed. UK-based services must comply even if hosted abroad; PECR has no specific rule bringing in overseas services just because UK users can reach them.✓	Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓
Size thresholds	None stated. No size or turnover threshold appears in PECR.✓	None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓
Regulator	Information Commission (took over from the Information Commissioner on 30 Sep 2026; still known as 'the ICO').✓	National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓
Breach or incident reporting	Public electronic communications service providers (telecoms, ISPs) must notify the Information Commission of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware. Give reasons if later. Notify affected subscribers/users without undue delay if likely to harm them. Keep a breach log. The old 24-hour deadline ended on 20 Aug 2025. Late notification can attract a £1,000 fixed penalty.✓	Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓
Deadline to answer personal data requests	N/A. PECR sets no access-request deadline. Requests about personal data follow UK GDPR (1 month).✓	1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓
Data protection officer	N/A. PECR does not require a DPO. UK GDPR rules apply where personal data is processed.✓	DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓
Local representative	N/A. PECR has no UK representative requirement (UK GDPR Art 27 may apply separately).✓	Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓
Sending data abroad	N/A. PECR has no transfer rules. Transfers of personal data follow UK GDPR Chapter V.✓	Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓
Cookies and consent	Do not store or read data on a device without prior UK GDPR-standard consent unless an exception applies. Exceptions (since 5 Feb 2026): sending a communication; strictly necessary for a service the user asked for (incl. security, fraud prevention, saving inputs); statistics to improve your own service; adapting site appearance or function to user preferences; locating a user who needs emergency help. The statistics and appearance exceptions need clear information and a simple, free way to object. Advertising and tracking cookies still need consent. Electronic marketing to individuals needs consent, except the soft opt-in for existing customers and, since 5 Feb 2026, for charities.✓	Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓
Maximum penalty	Up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, for breaches on or after 5 Feb 2026. Earlier breaches stay under the old £500,000 cap. Directors can be fined for some marketing breaches. Reg 5A breach-notice failures are dealt with by fixed penalty, not a full penalty notice.✓	Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓

= confirmed by two independent sources, at least one official.

Facts marked “Being verified” are still being confirmed and are not given as answers.

Who each law applies to

UK PECR: Any organisation that markets by phone, email, text or fax, or stores or reads data on users' devices (cookies, SDKs, pixels, apps, smart devices). Also providers of public electronic communications networks and services (security, traffic and location data, breaches). Applies even where no personal data is processed. UK-based services must comply even if hosted abroad; PECR has no specific rule bringing in overseas services just because UK users can reach them.
EU GDPR: Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.

What you must do under UK PECR

Get opt-in consent before setting non-essential cookies or similar tech.
Use the analytics and preference exceptions only with clear notice and an easy, free opt-out.
Get consent before email/SMS marketing to individuals, unless the soft opt-in applies.
Offer an opt-out at collection and in every marketing message.
Screen marketing calls against the TPS/CTPS and never make unconsented automated calls.
Telecoms providers: report personal data breaches to the ICO within 72 hours and log every breach.

Full UK PECR page, sources and checklist

What you must do under EU GDPR

Identify a lawful basis for every processing purpose and record it.
Publish a clear privacy notice covering purposes, recipients, retention and rights.
Keep a record of processing activities and sign Art 28 contracts with processors.
Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
Answer access, erasure and other rights requests within one month.

Full EU GDPR page, sources and checklist

Partner

Termly

Set up a cookie consent banner and cookie policy for EU, UK and US visitors.

Set up your cookie banner with Termly

Partner link: we may earn a commission if you buy, at no extra cost to you. It never affects our legal content. Affiliate disclosure

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.