Data Governance Atlas UK edition

PECR personal data breach (communications providers)

The separate breach duty for providers of public electronic communications services under PECR reg 5A: notify the regulator within 72 hours of becoming aware, tell subscribers where they are likely to be adversely affected, and keep an inventory. Runs alongside the UK GDPR duty.

Applies to
Providers of public electronic communications services, such as telecoms and internet access providers.
Instruments
PECR, UK GDPR
Steps
6 steps, with a deadline calculator.

Deadline calculator

Personal data breach (PECR providers)

Notify the Information Commission without undue delay and, where feasible, not later than 72 hours after becoming aware. 24 hours until 2025-08-20.

Enter a date to calculate.

Basis: PECR reg 5A(2). Bank holidays for 2025 to 2028, by the standard calendar rules. A calculator, not advice.

Mechanics

Item Position
Regulator deadline Without undue delay and, where feasible, within 72 hours of awareness (since 2025-08-20; 24 hours before)
Subscribers Without undue delay where the breach is likely to adversely affect their personal data or privacy
Exemption for subscriber notice Data made unintelligible by technological protection measures
Penalty ceiling Higher of £17.5m or 4% of turnover since 2026-02-05

Steps

  1. Confirm you are in scope

    The duty applies to providers of a public electronic communications service, for breaches of personal data processed in connection with providing it.

    See PECR

  2. Fix the moment of awareness

    The 72 hours run from when you became aware of the breach. Record when and how.

    See PECR

  3. Notify the regulator within 72 hours

    Notify the Information Commission without undue delay and, where feasible, within 72 hours of becoming aware (reg 5A(2)). Use the regulator's PECR breach reporting route.

    See PECR

  4. Assess whether subscribers must be told

    Tell the subscriber or user concerned without undue delay where the breach is likely to adversely affect their personal data or privacy (reg 5A(3)), unless you can show the data was made unintelligible by appropriate technological protection measures.

    See PECR

  5. Keep the inventory

    Record every personal data breach: the facts, the effects and the action taken, so the regulator can check compliance.

    See PECR

  6. Run the UK GDPR duty too

    The UK GDPR breach duty applies in parallel: follow the general breach procedure for the risk and high-risk tests.

    See UK GDPR

    PECR penalties have matched the UK GDPR ceiling since 2026-02-05. A missed or late PECR notification is no longer the cheaper failure.

Checklists and tools for this procedure

Breach notification decision

Decision tool

Decide who must be told about a personal data breach, and by when.

Breach: should the Information Commission be told?

Checklist for data protection

A 72-hour screen for a personal data breach: does it meet the risk threshold for notifying the regulator, and what must the notification contain?

Explainers

Sources