PECR is UK secondary legislation (a statutory instrument, not an Act) implementing the EU ePrivacy Directive 2002/58/EC. It governs electronic direct marketing, cookies and similar tracking technologies, communications network security, and traffic/location data. It operates as lex specialis alongside the UK GDPR: where PECR sets a specific rule for marketing or cookies, that rule prevails over the general UK GDPR position on the same activity. The most misunderstood point is enforcement: PECR breaches are overwhelmingly dealt with by civil monetary penalty, and since the Data (Use and Access) Act 2025 the ceiling has risen dramatically to match the UK GDPR.
Made under the European Communities Act 1972. Amended repeatedly (notably 2011 for cookie consent, 2018 claims-management cold-calling ban, 2019 pension cold-calling restriction). The DUAA 2025 amended it in two stages: breach notification aligned with the UK GDPR from 2025-08-20 (s.111, Commencement No. 1); penalties, enforcement powers, the storage and access exceptions and the charity soft opt-in from 2026-02-05 (ss.112, 114, 115 and Schs 12 and 13, SI 2026/82).
Amended by: Amended by the DUAA 2025 to (a) align reg 5A breach notification with the UK GDPR, so a provider now notifies the regulator within 72 hours of becoming aware of the essential facts rather than 24 hours (in force 2025-08-20); (b) raise the penalty ceiling to UK GDPR levels and bring PECR within the DPA 2018 enforcement toolkit (in force 2026-02-05); (c) introduce consent exceptions for low-risk storage and access, including analytics (in force 2026-02-05); (d) extend the soft opt-in to charities (in force 2026-02-05); and (e) extend the cookie rules to those who "instigate" storage of or access to information, not only those who place cookies.
The UK GDPR consent standard is imported into PECR: where PECR requires consent (marketing, cookies), it must meet the UK GDPR definition of consent. PECR prevails on the specific activity.
Supplies the ICO's enforcement machinery and the constitution of the regulator that enforces PECR.
What the Data (Use and Access) Act 2025 changed here, before and after, with the date each took effect. All tracked changes
Notify the regulator of a personal data breach within 24 hours of detection.
Notify the regulator without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach.
Effect summary in the site's own words, not statutory text.
where feasible, not later than 72 hours after having become aware of it
Consent for any storage or access except for transmission or where strictly necessary for a requested service.
Consent for any storage or access except for transmission, where strictly necessary, for statistical purposes, for website appearance, or for emergency assistance, on conditions.
Effect summary in the site's own words, not statutory text.
Monetary penalties of up to £500,000.
Penalties of up to the higher of £17.5m or 4% of worldwide turnover, under the DPA 2018 enforcement toolkit.
Effect summary in the site's own words, not statutory text.
Soft opt-in for contact details obtained in a sale or negotiation for a sale only.
Soft opt-in for contact details obtained in a sale or negotiation for a sale, plus a charity soft opt-in for supporters, on conditions.
Effect summary in the site's own words, not statutory text.
Ten questions every profile answers explicitly. "None found" means the point was examined and the instrument has nothing distinctive on it.
| # | Point | Finding | Notes |
|---|---|---|---|
| 1 | Territorial extent | None found | Applies UK-wide with no regional carve-out. |
| 2 | Commencement | Asymmetry found | The DUAA 2025 amendments commenced in two stages. The breach notification change (s.111) took effect on 2025-08-20. The penalty ceiling, the regulator's PECR enforcement powers, the storage and access exceptions (s.112, Sch 12) and the charity soft opt-in (s.114) took effect on 2026-02-05 (SI 2026/82), with transitional rules in regs 8 to 11 for investigations already under way. |
| 3 | Sunset / mandatory review | None found | No sunset or mandatory review clause in PECR itself. |
| 4 | Criminal liability | Asymmetry found | PECR is primarily enforced by civil monetary penalty, not criminal prosecution. The headline enforcement risk (unsolicited marketing, cookie breaches) is a civil monetary penalty, NOT a criminal offence. Care is needed: the vast majority of ICO PECR action is CMPs, not prosecutions. |
| 5 | Civil liability | Asymmetry found | Regulation 30 provides a right for a person who suffers damage by contravention of PECR to bring proceedings for compensation, independent of ICO action. |
| 6 | Regulatory enforcement toolkit | Asymmetry found | Historically the PECR CMP ceiling was £500,000, far below the UK GDPR ceiling. The DUAA 2025 aligned it: from 2026-02-05 the maximum is the higher of £17.5m or 4% of total worldwide annual turnover, a roughly 35-fold increase. The older requirement to show substantial damage or distress before a monetary penalty was removed by a 2015 amendment, not by the DUAA. |
| 7 | Personal / director liability | Asymmetry found | Since 2018-12-17 the regulator can impose a monetary penalty on a director or other officer personally, alongside the company, where a PECR marketing contravention resulted from that officer's action or inaction. It was introduced to stop directors of nuisance-call firms escaping penalties by dissolving the company. The officer penalty was set at up to £500,000. |
| 8 | Public vs private sector split | None found | One regime applies to public and private senders/operators alike. |
| 9 | Legal-person coverage | Asymmetry found | Unusually, some PECR marketing protections extend to corporate subscribers, not just individuals, e.g. rules on unsolicited communications can protect legal persons. This differs from the UK GDPR, which protects natural persons only. |
| 10 | Exemptions, with their conditions | Asymmetry found | PECR's exemptions are activity-conditioned exceptions rather than a schedule of general carve-outs: the strictly-necessary and DUAA-added low-risk analytics exceptions to cookie consent, the reg 22(3) soft opt-in with its cumulative conditions, and the national security (reg 28) and legal-purposes (reg 29) exemptions. Each is condition-bound; none is a blanket permission. The operative scope of some DUAA cookie exceptions was still settling at the research date (see liveIssues). |
Recorded with their trigger conditions, not as bare names, most are conditional tests applied case by case rather than blanket carve-outs.
Trigger
Consent is not required where storage of or access to information on terminal equipment is strictly necessary, or falls within the DUAA-introduced exceptions (e.g. cookies used only for statistical/analytics purposes to measure or improve a service, subject to specified conditions including transparency and an opt-out). Not automatic, the conditions must be met and the ICO's refreshed storage-and-access guidance applies.
Disapplies
Advertising and cross-site profiling cookies remain outside the exception and still require consent.
Trigger
A sender may email/text market to an individual without prior consent only where all conditions are met: the contact details were obtained in the course of a sale or negotiations for a sale of a product or service to that person; the marketing is for the sender's own similar products or services; and the recipient was given a simple means to opt out at collection and in every message.
The soft opt-in is a narrow, condition-bound exception, not a general permission to email customers.
Trigger
A charity may send email or text marketing without prior consent where it obtained the contact details when the person expressed an interest in, or offered or gave support for, its charitable purposes; the marketing is for the sole purpose of furthering those purposes; and the person was given a simple means to refuse at collection and in every message. All conditions must be met.
Disapplies
In force 2026-02-05 (SI 2026/82). The rule is PECR reg 22(3A), inserted by DUAA 2025 s.114.
The cross-instrument texture that profiling an Act in isolation misses, including where the real answer to a question about this Act is found in a different one.
| Instrument | Relationship | Note |
|---|---|---|
| Data (Use and Access) Act 2025 | Amended by | Amended in two stages: breach notification from 2025-08-20; storage and access, charity marketing, enforcement and penalties from 2026-02-05. |
| UK GDPR | Lex specialis | For electronic marketing and cookies, PECR's specific rules prevail over the general UK GDPR lawful-basis analysis for that activity; UK GDPR still governs the underlying personal-data processing. |
The questions this instrument most often raises, with the answer and the authority for it.
The regulator's final guidance (2026-04-29) draws the line. The statistical exception covers first-party analytics used only to improve the service: aggregated counts of visits and page views, interactions, device and browser type, referrers, A/B tests, coarse location and load speeds, including through a third-party analytics provider acting only as a processor. It does not cover tracking individual visitors, keeping individual visit logs, profiling, linking visits to purchases, monitoring across services or measuring advertising. The appearance exception covers adapting the service to the user's settings, such as layout, language, theme and serving fonts, but not adapting content to inferred interests or using device data to fingerprint. Both need clear information and a simple, free way to object. Anything for advertising, including measuring ad performance and detecting click fraud, needs consent; the regulator advised the government in May 2026 on a possible advertising exception under reg 6A, and until regulations are made consent is required.
Decide who must be told about a personal data breach, and by when.
Start from what you are trying to do and get the UK GDPR basis to test first, with the extra condition you need for special category data.
A 72-hour screen for a personal data breach: does it meet the risk threshold for notifying the regulator, and what must the notification contain?
Screen each cookie, pixel, SDK or similar technology against the PECR consent rule and its Schedule A1 exceptions. Run it once per technology.
Before an email, text or call campaign: which PECR route permits it, and are its conditions met?
| Activity | Role here | Provisions |
|---|---|---|
| Email and text marketing | Primary | regs 22 and 23 |
| Telephone marketing | Primary | regs 19 and 21 |
| Cookies, pixels and device tracking | Primary | reg 6; Sch A1 |
| Personal data breach | Lex specialis | reg 5A |
| Online services likely to be used by children | Also applies | reg 6; Sch A1 |
| Using suppliers to process data | Interacts | reg 5A |
States the 72-hour deadline and that it changed from 24 hours on 2025-08-20.