When must a communications provider report a breach under PECR?

What it is

PECR regs 5 and 5A impose security and breach duties on service providers, separate from the UK GDPR breach regime that applies to everyone else. Providers must also keep an inventory of breaches.

When you must report

• Any personal data breach in connection with providing the service: notify the regulator within 72 hours of awareness. PECR reg 5A(2), as amended by DUAA s.111
• Where the breach is likely to adversely affect a subscriber or user: tell them without undue delay. PECR reg 5A(3)
• Every breach: record it in the provider's inventory. PECR reg 5A(8)

When you need not tell subscribers

• The data was rendered unintelligible by measures the regulator accepts, such as encryption. PECR reg 5A(4)

Who is responsible

The provider of the public electronic communications service.

What it involves

1. Detect and contain the breach.
2. Notify the regulator within 72 hours.
3. Assess and notify affected subscribers.
4. Record it in the inventory.

Timing

72 hours from becoming aware, since 2025-08-20.

If it goes wrong

Regulatory

The regulator can issue an enforcement notice and, since 2026-02-05, a penalty of up to £17.5 million or 4% of annual worldwide turnover (PECR as amended by DUAA s.115). Directors and officers can be fined personally where a marketing breach resulted from their conduct.

Criminal

No offence.

Civil

Anyone who suffers damage because of a breach of PECR can claim compensation from the person responsible (PECR reg 30).