Privacy and Electronic Communications Regulations 2003
What this means for your business
- Applies to
- United Kingdom
- On this page
- 20 compliance obligations, 10 practical guides across 4 topics
What you must do
20 compliance obligations under this legislation.
Management duties 15
Allow caller ID and location data for emergency calls
Fine up to Ā£17,500,000If your business provides telephone or electronic communications services, you must make sure that calls to 999 or 112 are never blocked or limited. You cannot stop the callerās number being shown on the receiving line, and you must allow the callerās location data to be processed, even though other calls may be subject to consent rules.
Coāoperate with public electronic communications service providers
If your business provides telecommunications or other electronic communication services, you must obey reasonable requests from the public service provider that supplies the calling or lineāidentification facilities. This means responding to and acting on any lawful request they make under regulations 10 and 11.
Delete or anonymise traffic data when no longer needed and retain only for payment disputes
Fine up to Ā£17,500,000If your business provides public electronic communications services, you must erase or deāidentify traffic data as soon as it is no longer needed to send a communication. You may keep the data longer only for billing or interconnection payments, and even then only until any related legal claim is finally settled. Any use of traffic data for marketing requires the subscriberās explicit consent and must stop when they withdraw that consent.
Do not make unsolicited marketing calls for claims management services without consent
You must not use telephone or any public electronic communications service to call people and promote claimsāmanagement services unless the person has previously told you they agree to receive such calls. If you have no consent, you must not place the call yourself or ask anyone else to do it on your behalf.
Meet ICO accreditation requirements for bodies monitoring code compliance
If your organisation wants to be accredited by the ICO to monitor compliance with a privacy code of conduct, you must prove you are independent, have the right expertise, and have clear procedures for assessing eligibility, monitoring compliance, handling complaints and publishing those procedures. You must also show there is no conflict of interest and keep those processes upātoādate.
Only make automated recorded marketing calls with consent and ID
You must not use an autoādialling system to send recorded directāmarketing calls unless the person youāre calling has already given you permission to receive such calls. Each call must also show your telephone number or another way for the recipient to contact you. Breaching this rule can lead to ICO enforcement action.
Only send fax marketing with consent and respect the fax doānotācall register
You must not fax unsolicited directāmarketing messages to anyone who hasnāt agreed to receive them, and you must check that the number isnāt on the fax ādoānotācallā register. If a recipient later withdraws consent, you must stop sending to that number immediately.
Provide free caller ID blocking option for outgoing calls
If you run a telephone or internet service that can show the callerās number, you must give users an easy way to hide that number when they make a call. The option must be available for each individual call and also as a permanent setting for the whole line, and it must be free of charge.
Provide free means to block caller ID on incoming calls
Fine up to Ā£17,500,000If you run a telephone service that can show the number of the person calling, you must give your customers an easy, free way to stop that number being displayed on their incoming calls. You also need to let them reject calls where the caller has deliberately hidden their number, and, where you offer connectedāline ID, give a free way to block that too.
Provide informed, optāin directory listings and allow data correction/withdrawal
Fine up to Ā£17,500,000If your business publishes a telephone (or similar) directory that the public can consult, you must tell each individual subscriber why their details are being listed, let them choose which details are shown, and get explicit consent when the directory can be accessed just by a phone number. You must also respect a corporate subscriberās request not to be listed and give every subscriber a free way to check, correct or remove their data at any time.
Provide name and contact details in all directāmarketing calls, faxes and automated messages
If you use a telephone line, automated calling system or fax service to send directāmarketing messages, you must include your business name and either a physical address or a freeāphone number in each message. This lets recipients know who is contacting them and how to get back to you.
Secure your public communications service and inform users of risks
Fine up to Ā£17,500,000If you run a public electronic communications service (for example, an ISP or telephone provider), you must put in place suitable technical and organisational safeguards to keep the service and any personal data safe. If, despite those safeguards, a significant security risk remains, you must tell your customers what the risk is, how they can protect themselves and any likely costs, at no charge.
Send marketing emails with clear sender identity and optāout address
Fine up to Ā£17,500,000If you send any directāmarketing email, you must show who you are and give recipients a valid address they can use to tell you to stop. You also must not hide the senderās details, must obey the electronicācommerce rules and must not link to websites that break those rules.
Set up and keep records of procedures for handling data access requests
Fine up to Ā£17,500,000If you run a communications service, you must have clear internal procedures for dealing with users who ask to see their personal data. You also need to keep records of how many requests you get, why they were made and how you responded, and be ready to hand that information to the ICO whenever they ask.
Stop automatic call forwarding on subscriber request
If a customer asks you to stop calls that are being automatically forwarded to them because a third party set up the forwarding, you must terminate that forwarding free of charge and without any avoidable delay. You also have to cooperate with any other communications providers to make sure the forwarding is stopped.
Notifications 1
Notify ICO and affected individuals of personal data breaches
Fine up to Ā£17,500,000If you experience a personal data breach, you must tell the Information Commissioner within 72 hours of finding out about it and give them details of what happened, the impact and what you are doing about it. If the breach is likely to harm your customers or users, you also have to inform them straight away with clear advice on how they can protect themselves. Keep a simple register of each breach so the ICO can check you are complying.
Other requirements 1
Provide public information on lineāidentification services
Fine up to Ā£17,500,000If your business supplies a public electronic communications service that includes caller ID or connected line ID, you must tell customers and the wider public that the service exists and explain the options to block it (as set out in regulations 10 and 11). This information should be readily accessible ā for example on your website, in customerāfacing brochures or in callācentre scripts.
Payments and fees 1
Provide nonāitemised bills when a subscriber asks
If you run a public electronic communications service (e.g., broadband, phone or TV provider), you must give a customer a bill that does not break down individual charges whenever the customer requests it. The bill can show the total amount only, not a lineābyāline list of services used.
Policies 1
Do not store or access data on usersā devices without a lawful basis
Fine up to Ā£17,500,000You must not place cookies, localāstorage items or any other information on a subscriberās or userās phone, computer or tablet unless an exemption in ScheduleāÆA1 applies (e.g., the user has given consent). In practice this means you need a clear policy and evidence that any deviceāside storage you do is permitted.
Registration and licensing 1
Notify ICO in writing to optāout of unsolicited marketing calls
If your business does not want to receive coldācalling marketing on any of its telephone lines, you must send a written notification to the ICO (or, before 30āÆDecāÆ2016, to OFCOM). This tells the regulator to add those numbers to a ādoānotācallā register.
Penalties for non-compliance
10 penalties under this legislation.
Allow caller ID and location data for emergency calls
Fine up to Ā£17,500,000
Delete or anonymise traffic data when no longer needed and retain only for payment disputes
Fine up to Ā£17,500,000
Provide free means to block caller ID on incoming calls
Fine up to Ā£17,500,000
Provide informed, optāin directory listings and allow data correction/withdrawal
Fine up to Ā£17,500,000
Secure your public communications service and inform users of risks
Fine up to Ā£17,500,000
Send marketing emails with clear sender identity and optāout address
Fine up to Ā£17,500,000
Set up and keep records of procedures for handling data access requests
Fine up to Ā£17,500,000
Notify ICO and affected individuals of personal data breaches
Fine up to Ā£17,500,000
Provide public information on lineāidentification services
Fine up to Ā£17,500,000
Do not store or access data on usersā devices without a lawful basis
Fine up to Ā£17,500,000
Practical guidance
Our guides explain how to comply with the requirements above.
Digital & Technology 3
Tech Sector Compliance Overview
Comprehensive guide to regulatory compliance for technology businesses - UK GDPR, data protection, online safety, cybersecurity, and sector-specific ā¦
Privacy and Electronic Communications Regulations
PECR sits alongside UK GDPR and gives specific privacy rights relating to electronic communications, including marketing calls, emails, ā¦
Cyber security requirements for UK businesses
How to protect your business from cyber threats and comply with UK cyber security requirements. Includes Cyber Essentials ā¦
Growth & Strategy 3
Email marketing: PECR and UK GDPR requirements
How to send compliant marketing emails under PECR and UK GDPR. Covers consent requirements, the soft opt-in exception ā¦
Marketing and advertising law
Legal requirements for promoting your business.
Electronic marketing rules (PECR)
How to comply with the Privacy and Electronic Communications Regulations 2003 when sending marketing emails, texts, and making ā¦
Compliance & Legal 3
Cookie consent: comply with PECR requirements
How to comply with cookie consent rules under the Privacy and Electronic Communications Regulations 2003 (PECR). Covers consent ā¦
Data protection annual compliance checklist
Annual checklist for verifying your data protection compliance. Covers ICO fee renewal, privacy notices, records of processing, breach ā¦
Data Use and Access Act 2025: what changed for businesses
What the Data (Use and Access) Act 2025 means for UK businesses. Explains the eight key reforms now ā¦
Sections and provisions
51 classified provisions from this legislation.
Duties 25
- s.5 Security of public electronic communications services and that network provider
- s.6 Storing information in the terminal equipment of a subscriber or user a person
- s.7 Restrictions on the processing of certain traffic data Legal proceedings
- s.9 Itemised billing and privacy
- s.10 Prevention of calling line identification ā outgoing calls
- s.11 Prevention of calling or connected line identification ā incoming calls
- s.12 Publication of information for the purposes of regulations 10 and 11
- s.13 Co-operation of communications providers for the purposes of regulations 10 and 11 a communications provider
- s.16 Emergency calls person
- s.17 Termination of automatic call forwarding other communications provider
- s.18 Directories of subscribers
- s.19 Use of automated calling systems A subscriber
- s.20 Use of facsimile machines for direct marketing purposes A subscriber
- s.23 Use of electronic mail for direct marketing purposes where the identity or address of the sender is concealed
- s.24 Information to be provided for the purposes of regulations 19 to 21A the service
- s.25 Register to be kept for the purposes of regulation 20
- s.26 Register to be kept for the purposes of regulation 21
- s.30 Proceedings for compensation for failure to comply with requirements of the Regulations
- s.32 Request that the Commissioner exercise his enforcement functions
- s.33 Technical advice to the Commissioner OFCOM
- ... and 5 more duties
Powers 2
Definitions 8
- Schedule 2 Transitional provisions
- s.4 Relationship between these Regulations and the data protection legislation
- s.8 Further provisions relating to the processing of traffic data under regulation 7
- s.15 Tracing of malicious or nuisance calls
- s.22 Use of electronic mail for direct marketing purposes
- s.29 Legal requirements, law enforcement etc.
- Calls for direct marketing in relation to pension Calls for direct marketing in relation to pension schemes
- Codes of conduct Codes of conduct