UK PECR

United Kingdom Privacy

Status

In force since 11 Dec 2003. Heavily amended; DUAA 2025 PECR changes in force in two stages (20 Aug 2025 and 5 Feb 2026).✓PECR reg 1; SI 2025/904; SI 2026/82 reg 2 · Sources: legislation.gov.uk, legislation.gov.uk, pinsentmasons.com, osborneclarke.com

Who it applies to

Any organisation that markets by phone, email, text or fax, or stores or reads data on users' devices (cookies, SDKs, pixels, apps, smart devices). Also providers of public electronic communications networks and services (security, traffic and location data, breaches). Applies even where no personal data is processed. UK-based services must comply even if hosted abroad; PECR has no specific rule bringing in overseas services just because UK users can reach them.✓PECR regs 5-8, 6, 19-24; ICO 'What are PECR?' and 'What are the PECR rules?' · Sources: ico.org.uk, ico.org.uk, pinsentmasons.com, dpocentre.com

Size thresholds

None stated. No size or turnover threshold appears in PECR.✓PECR (SI 2003/2426) has no provision on this; see UK GDPR · Sources: legislation.gov.uk, ico.org.uk, dpocentre.com

Regulator

Information Commission (took over from the Information Commissioner on 30 Sep 2026; still known as 'the ICO').✓PECR regs 31-33 & Sch 1 (as amended by SI 2026/386 and SI 2026/1015, from 30 Sep 2026); DUAA 2025 s.117 · Sources: gov.uk, legislation.gov.uk, lewissilkin.com

Breach or incident reporting

Public electronic communications service providers (telecoms, ISPs) must notify the Information Commission of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware. Give reasons if later. Notify affected subscribers/users without undue delay if likely to harm them. Keep a breach log. The old 24-hour deadline ended on 20 Aug 2025. Late notification can attract a £1,000 fixed penalty.✓PECR reg 5A(2), (3), (3A), (8) (amended by DUAA 2025 s.111, in force 20 Aug 2025 via SI 2025/904); reg 5C · Sources: legislation.gov.uk, ico.org.uk, osborneclarke.com

Deadline to answer personal data requests

N/A. PECR sets no access-request deadline. Requests about personal data follow UK GDPR (1 month).✓PECR (SI 2003/2426) has no provision on this; see UK GDPR · Sources: legislation.gov.uk, ico.org.uk

Data protection officer

N/A. PECR does not require a DPO. UK GDPR rules apply where personal data is processed.✓PECR (SI 2003/2426) has no provision on this; see UK GDPR · Sources: legislation.gov.uk, ico.org.uk

Local representative

N/A. PECR has no UK representative requirement (UK GDPR Art 27 may apply separately).✓PECR (SI 2003/2426) has no provision on this; see UK GDPR · Sources: legislation.gov.uk, ico.org.uk, ico.org.uk

Sending data abroad

N/A. PECR has no transfer rules. Transfers of personal data follow UK GDPR Chapter V.✓PECR (SI 2003/2426) has no provision on this; see UK GDPR · Sources: legislation.gov.uk, ico.org.uk

Cookies and consent

Do not store or read data on a device without prior UK GDPR-standard consent unless an exception applies. Exceptions (since 5 Feb 2026): sending a communication; strictly necessary for a service the user asked for (incl. security, fraud prevention, saving inputs); statistics to improve your own service; adapting site appearance or function to user preferences; locating a user who needs emergency help. The statistics and appearance exceptions need clear information and a simple, free way to object. Advertising and tracking cookies still need consent. Electronic marketing to individuals needs consent, except the soft opt-in for existing customers and, since 5 Feb 2026, for charities.✓PECR reg 6 & Sch A1 paras 2-7 (DUAA 2025 s.112 & Sch 12, from 5 Feb 2026, SI 2026/82 reg 2(w), (z13)); reg 22(3), (3A), (5) (DUAA s.114, SI 2026/82 reg 2(x)) · Sources: legislation.gov.uk, legislation.gov.uk, legislation.gov.uk, ico.org.uk

Maximum penalty

Up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, for breaches on or after 5 Feb 2026. Earlier breaches stay under the old £500,000 cap. Directors can be fined for some marketing breaches. Reg 5A breach-notice failures are dealt with by fixed penalty, not a full penalty notice.✓PECR reg 31 & Sch 1 paras 15, 18 (DUAA 2025 s.115 & Sch 13) applying DPA 2018 s.157(2)(a), (5); SI 2026/82 reg 11 · Sources: legislation.gov.uk, legislation.gov.uk, legislation.gov.uk, mishcon.com

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Get opt-in consent before setting non-essential cookies or similar tech.
• Use the analytics and preference exceptions only with clear notice and an easy, free opt-out.
• Get consent before email/SMS marketing to individuals, unless the soft opt-in applies.
• Offer an opt-out at collection and in every marketing message.
• Screen marketing calls against the TPS/CTPS and never make unconsented automated calls.
• Telecoms providers: report personal data breaches to the ICO within 72 hours and log every breach.
• Update fine-risk assessments: PECR now carries UK GDPR-level penalties.

Recent changes

DUAA 2025 (Royal Assent 19 Jun 2025). 20 Aug 2025: PECR breach deadline moved from 24 to 72 hours. 5 Feb 2026: new cookie exceptions (Sch A1), charity soft opt-in, UK GDPR-level fines and enforcement powers, wider 'call'/'communication' definitions (sent-but-unreceived messages count), codes of conduct. 30 Sep 2026: the Information Commission replaced the Information Commissioner.✓

Sources

• Primary source: https://www.legislation.gov.uk/uksi/2003/2426/contents
• Second source: https://www.dpocentre.com/blog/marketing-compliance-under-duaa-and-pecr/
• Regulator: Information Commission (took over from the Information Commissioner on 30 Sep 2026; still known as 'the ICO').

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.