On this page you will read detailed information about Privacy and Electronic Communications Regulations 2003.
What Are PECR?
PECR stands for Privacy and Electronic Communications Regulations 2003 (SI 2003/2426). It is a UK regulation that complements the UK GDPR and the Data Protection Act. PECR governs certain kinds of electronic communications, focusing on:
- Direct marketing via electronic means (emails, texts, calls)
- Use of cookies and similar tracking technologies
- Security of public electronic communications services
- Privacy of users of electronic communications services
PECR essentially sets rules around how businesses can contact people digitally, use device storage (cookies), and ensure telecommunications privacy.
Because PECR sits alongside data protection law, organizations often must comply with both when handling electronic communications and tracking.
Key Provisions & Requirements Under PECR
Direct Marketing (Email, SMS, Calls)
Under Regulation 22 of PECR:
- You must not send unsolicited marketing emails or texts to individuals unless they have given prior, explicit consent.
- There is a soft opt-in exception: you may send marketing to your existing customers about similar products they previously bought, provided you gave them an opt-out option initially and in every message.
- Marketing to businesses (corporate subscribers) is generally allowed, but good practice is to maintain suppression or “do not email” lists.
- You must not disguise your identity (you must be clear about who is sending) and provide an easy unsubscribe method.
Cookies and Similar Technologies (Storing / Accessing Information on Devices)
This is the “cookie rule” side of PECR:
- You must obtain consent from users before storing or accessing information on their device (e.g. cookies, local storage) unless an exception applies.
- Exceptions include cases where storage is strictly necessary for providing a service the user requested (e.g. session cookies, user authentication).
- The DUAA (Data Use and Access Act 2025), which came into force on 19 June 2025, modifies how PECR handles non-consent cookies (e.g. for analytics, site performance) by recognizing certain low-risk uses as exempt from consent, if other conditions are met.
Breach Notification & Security
Under PECR, communications service providers must adopt appropriate security measures and report personal data breaches related to electronic communications.
- The DUAA aligns PECR’s breach notification timeline with UK GDPR: within 72 hours unless not feasible, with explanation for delay.
- The DUAA also gives the Information Commissioner (ICO) enhanced enforcement powers, bringing PECR in line with UK GDPR’s penalty regime.
Enforcement & Penalties
Before the changes, maximum fines under PECR were relatively modest (e.g. £500,000). The DUAA raises these maximum penalties to match UK GDPR levels — up to £17.5 million or 4% of global turnover, whichever is greater.
The alignment strengthens the ICO’s leverage in enforcing electronic communications and cookie rules.
Recent Reforms & DUAA’s Impact on PECR (2025 Changes)
The biggest recent overhaul affecting PECR is the passage of the Data (Use and Access) Act 2025 (DUAA), which amends PECR in a number of important ways.
1. Revised Cookie / Consent Rules
- DUAA relaxes consent requirements for certain low-risk cookies, such as analytics, site improvement, or preference cookies—provided transparency and opt-out capabilities are maintained.
- Storage or access purely for strictly necessary functions (security, fraud prevention, authentication) may not require consent under the new regime.
2. Increased Penalties & Enforcement
- As noted, the DUAA raises maximum fines to match UK GDPR.
- The ICO now has greater powers: it can request technical reports, compel witness attendance at interviews, etc.
3. Definition Updates & Direct Marketing Changes
- DUAA integrates the UK GDPR’s definition of “direct marketing” into PECR, aligning the language across data protection and electronic communications law.
- The DUAA extends the soft opt-in exception to charities, allowing them to send marketing emails under certain conditions (where previously more constrained).
4. Notification Timeframe for Breach
- PECR breach notification rules are amended: organizations must notify the ICO within 72 hours where feasible, rather than “without undue delay / within 24 hours.”
These changes aim to streamline, modernize, and harmonize PECR with the broader data protection landscape under the DUAA.
Why Compliance with PECR Matters More Now
- Because penalty levels now match GDPR, noncompliance can be financially impactful.
- As DUAA integrates PECR more tightly with data protection law, gaps or inconsistencies will be less tolerated.
- The ICO is actively consulting on its approach to regulating online advertising and consent under PECR.
- Businesses that operate across UK and EU jurisdictions must juggle both PECR and EU ePrivacy / eCommerce rules—ensuring dual compliance.
Practical Steps: How Organizations Should Adapt for PECR + DUAA
1. Update Cookie / Tracking Consent Mechanism
- Reassess which cookies/tools qualify as “low-risk” under DUAA’s revised regime
- Implement clear transparency and opt-out options
- Audit your cookie categories, consent banners, cookie management layers
2. Align Direct Marketing Practices
- Review your email, SMS, and direct messaging flows to ensure they meet PECR’s consent standards (or qualify under soft opt-in)
- For charities, assess whether you can leverage the extended soft opt-in rule
- Keep records of consent, subscription history, opt-outs, and unsubscribes
3. Incident & Breach Procedures
- Align breach notification workflow to a 72-hour timeline (or explain delay)
- Ensure your systems can detect, log, and trace breaches in electronic communications systems
4. Enhance Governance & Documentation
- Document decisions, legal basis for cookies/marketing, opt-out routes, user notices
- Maintain records for audits or ICO inspections
- Train marketing, IT, product teams about PECR + DUAA changes
5. Engage with ICO Consultations & Guidance
- The ICO is seeking views on its enforcement approach toward consent under PECR starting in 2025.
- Monitor updates to the SATs (Storage and Access Technologies) guidance and any statements on low-risk cookies.
6. Cross-border Considerations
- If you serve EU users, be mindful of ePrivacy / EU cookie rules, which may be stricter
- Harmonize consent and tracking systems to satisfy both UK and EU / international law
In the previous post, we had shared information about Digital Operational Resilience Act (DORA), so read that post also.
Case Examples & Hypotheticals
Example A: Marketing email to a prospect
Under PECR, sending a promotional email to someone who hasn’t consented is not allowed. After DUAA, you’d still need consent unless a new low-risk exception is later defined—but you must be cautious and maintain explicit records of consent.
Example B: Analytics cookies
Previously many analytics cookies required consent. Under DUAA, certain analytics cookies (low-risk, aggregate) may be exempted from consent, as long as opt-out and transparency are provided.
Example C: Charity newsletter
Charities may now rely on a broader soft opt-in under DUAA, allowing signed-up supporters to receive email updates for charity purposes, subject to clear notice and opt-out rights.
Challenges & Risks to Watch
- Determining which cookies / tracking fall into “low risk” and thus are exempt from consent may be ambiguous until ICO clarifies guidelines.
- Balancing transparency with user experience—too many prompts or complex consent flows frustrate users.
- Reassessing all marketing flows, tools, attribution setups, and cookie libraries to ensure compliance with new rules.
- Ensuring systems can detect “access / storage” actions (some trackers operate invisibly) to classify under PECR.
- ICO’s enforcement posture might shift, especially around consent, cookie compliance, or misuse of marketing channels.
Conclusion
The Privacy and Electronic Communications Regulations (PECR) set critical guardrails for digital marketing, cookies, security, and user privacy in the UK. With the Data (Use and Access) Act 2025 now modifying how PECR works—especially around cookies, consent, marketing, and penalties—2025 is a pivotal transition year.
Organizations must update their cookie mechanisms, review marketing consent flows, align with the new 72-hour breach rules, and keep a close eye on ICO consultations and guidance. Failure to adapt could lead to significant fines and reputational damage.
Disclaimer
The information and services on this website are not intended to and shall not be used as legal advice. You should consult a Legal Professional for any legal or solicited advice. While we have good faith and our own independent research to every information listed on the website and do our best to ensure that the data provided is accurate. However, we do not guarantee the information provided is accurate and make no representation or warranty of any kind, express or implied, regarding the accuracy, adequacy, validity, reliability, availability, or completeness of any information on the Site. UNDER NO CIRCUMSTANCES SHALL WE HAVE ANY LIABILITY TO YOU FOR ANY LOSS OR DAMAGE OF ANY KIND INCURRED AS A RESULT OR RELIANCE ON ANY INFORMATION PROVIDED ON THE SITE. YOUR USE OF THE SITE AND YOUR RELIANCE ON ANY INFORMATION ON THE SITE IS SOLELY AT YOUR OWN RISK. Comments on this website are the sole responsibility of their writers so the accuracy, completeness, veracity, honesty, factuality and politeness of comments are not guaranteed.
So friends, today we talked about Privacy and Electronic Communications Regulations 2003, hope you liked our post.
If you liked the information about Privacy and Electronic Communications Regulations 2003, then definitely share this article with your friends.
