What is PECR, and does it apply to you?
The Privacy and Electronic Communications Regulations 2003 (PECR) set specific rules on electronic marketing by phone, text, email and fax, on cookies and similar technologies, and on the security of public communications services. They apply to any organisation that does those things, whether or not it processes personal data in other ways, and sit alongside the UK GDPR.
What it is
PECR is the special law for these activities: where it applies, it decides whether you may send a message or set a cookie at all, and the UK GDPR still governs the personal data involved. The DUAA 2025 added new cookie exceptions, a charity soft opt-in and penalties at UK GDPR levels, all from 2026-02-05.
When it applies to you
- You send marketing by email, text, phone call, automated call or fax. PECR regs 19 to 23
- You store or access information on a user's device, such as cookies, pixels or fingerprinting. PECR reg 6
- You provide a public electronic communications service, such as a telecoms or internet access provider. PECR regs 5 and 5A
Who is responsible
The sender or instigator of the marketing, the website or app operator for cookies, and the service provider for security and breach duties.
What it involves
- Identify which PECR activities you carry out.
- Check consent or an exception for each.
- Screen calls against the TPS.
- Keep suppression lists.
- Pair PECR compliance with a UK GDPR lawful basis.
If it goes wrong
- Regulatory
- The regulator can issue an enforcement notice and, since 2026-02-05, a penalty of up to £17.5 million or 4% of annual worldwide turnover (PECR as amended by DUAA s.115). Directors and officers can be fined personally where a marketing breach resulted from their conduct.
- Criminal
- PECR creates no criminal offences; enforcement is by notice and penalty.
- Civil
- Anyone who suffers damage because of a breach of PECR can claim compensation from the person responsible (PECR reg 30).
Go further
- The law
- PECR, DUAA 2025
- Checklists
- Electronic marketing permission, Cookie and storage exemption audit
- Glossary
- Lex specialis
More on marketing, cookies and communications (PECR)
Sources
- Primary Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 legislation.gov.uk
- Primary Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 22 legislation.gov.uk
- Primary Data (Use and Access) Act 2025, section 115 legislation.gov.uk
- Regulator UK GDPR guidance and resources Information Commissioner's Office
Updated