Marketing compliance: PECR and UK GDPR
- 5 steps
UK Statutory Instrument
2003
United Kingdom
Privacy and Electronic Communications Regulations 2003
At a glance
Who this Act binds
Business-side actors with duties under this Act, ranked by how often they appear.
- Any Person 12
- Data Controller 5
- Operator 2
- Director or Officer 1
Plus 5 non-business duties on Crown ministers, regulators, local authorities or tribunals — shown collapsed under each section below.
Step-by-step journeys using this legislation
Walkthroughs that take you from a real business situation to compliance.
Relevant guidance
Practical guides for businesses affected by this Act, ordered by how closely they engage with it.
Direct — cites this Act
3 guidesSupporting — topic alignment
18 guidesMentioned in related content
1 guidesOther Acts binding the same actors
For each actor bound by this Act, the other UK Acts that bind them most often. Useful for understanding the full compliance landscape facing each role.
Any Person also bound by 749 other Acts (top 5 shown)
- Human Medicines Regulations 2012 2012 110 duties
- Licensing Act 2003 2003 105 duties
- Merchant Shipping Act 1995 1995 97 duties
- Road Traffic Act 1988 1988 95 duties
- Air Navigation Order 2016 2016 86 duties
Data Controllers also bound by 7 other Acts (top 5 shown)
- UK GDPR (retained EU law) 2016 336 duties
- Data Protection Act 2018 2018 46 duties
- Equality Act 2010 2010 1 duty
- Data Protection (Charges and Information) Regulations 2018 2018 1 duty
- The Waste and Contaminated Land (Northern Ireland) Order 1997 1997 1 duty
Operators also bound by 125 other Acts (top 5 shown)
- Space Industry Regulations 2021 2021 71 duties
- Payment Services Regulations 2017 2017 41 duties
- Air Navigation Order 2016 2016 34 duties
- The Quarries Regulations 1999 1999 31 duties
- Reservoirs Act (Northern Ireland) 2015 2015 22 duties
Directors and Officers also bound by 224 other Acts (top 5 shown)
- Insolvency (England and Wales) Rules 2016 2016 75 duties
- Companies Act 2006 2006 63 duties
- Insolvency Act 1986 1986 46 duties
- CCBSA 2014 2014 22 duties
- CAICEA 2004 2004 18 duties
What this Act requires
Sections that create concrete duties on businesses or carry penalties. Procedural and definitional sections are folded into the “Browse other sections” expander at the bottom of each group. Click any section title to read the source text on legislation.gov.uk.
Schedules
Browse 2 other Schedules — structural / supplementary
Security of public electronic communications services
Fine up to £17,500,000- Safeguard the security of public electronic communications services Operator
Storing information in the terminal equipment of a subscriber or user
Fine up to £17,500,000- Obtain consent before using cookies or similar tracking technologies Any Person
Restrictions on the processing of certain traffic data
Fine up to £17,500,000- Erase or anonymise communications traffic data when no longer needed Data Controller
Itemised billing and privacy
- Provide non-itemised bills upon subscriber request Data Controller
Prevention of calling line identification – outgoing calls
- Provide callers with a way to hide their phone number Any Person
Prevention of calling or connected line identification – incoming calls
Fine up to £17,500,000- Provide callers with privacy options for incoming calls Data Controller
Publication of information for the purposes of regulations 10 and 11
Fine up to £17,500,000- Inform the public about caller ID and privacy options Data Controller
Co-operation of communications providers for the purposes of regulations 10 and 11
- Cooperate with telecoms providers regarding caller ID services Any Person
Emergency calls
Fine up to £17,500,000- Enable caller ID and location data for emergency 999/112 calls Any Person
Termination of automatic call forwarding
- Stop automatic call forwarding upon subscriber request Any Person
Directories of subscribers
Fine up to £17,500,000- Obtain consent and inform individual subscribers before including them in directories Director or Officer
Use of automated calling systems
- Obtain consent before making automated marketing calls Any Person
Use of facsimile machines for direct marketing purposes
- Do not send unsolicited direct marketing faxes without consent Any Person
Use of electronic mail for direct marketing purposes where the identity or address of the sender is concealed
Fine up to £17,500,000- Identify your business and provide a valid opt-out address in marketing emails Any Person
Information to be provided for the purposes of regulations 19 to 21A
- Identify yourself when sending direct marketing communications Any Person
Register to be kept for the purposes of regulation 20
Other duties (1) — Crown / regulator
- ICO must maintain and provide access to the Fax Preference Service register Statutory regulator
Register to be kept for the purposes of regulation 21
Other duties (1) — Crown / regulator
- ICO must maintain a register of people who opt out of marketing calls Statutory regulator
Proceedings for compensation for failure to comply with requirements of the Regulations
- Pay compensation for damages caused by privacy breaches Any Person
Request that the Commissioner exercise his enforcement functions
Other duties (1) — Crown / regulator
- ICO must investigate alleged PECR breaches upon request Statutory regulator
Technical advice to the Commissioner
Other duties (1) — Crown / regulator
- Ofcom must provide technical advice to the Information Commissioner Statutory regulator
Review of implementation
Other duties (1) — Crown / regulator
- Secretary of State must review the PECR regulations every five years Crown / Minister / Government department
Accreditation of bodies monitoring compliance with codes of conduct
- Accredited monitoring bodies must enforce codes of conduct and report suspensions Any Person
Calls for direct marketing of claims management services
- Do not make unsolicited marketing calls for claims management services Any Person
Personal data breach
Fine up to £17,500,000- Notify the ICO and users of personal data breaches Operator
(unknown)
Fine up to £17,500,000- Maintain procedures for handling personal data access requests Data Controller
Browse 24 other sections — procedural / definitional / commencement
Revocation of the Telecommunications (Data Protection and Privacy) Regulations 1999
Relationship between these Regulations and the data protection legislation
Further provisions relating to the processing of traffic data under regulation 7
Restrictions on the processing of location data
Tracing of malicious or nuisance calls
Calls for direct marketing purposes
Use of electronic mail for direct marketing purposes
Modification of contracts
National security
Legal requirements, law enforcement etc.
Information Commissioner’s enforcement powers
Amendment to the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000
Amendment to the Electronic Communications (Universal Service) Order 2003
Transitional provisions
Calls for direct marketing in relation to pension schemes
Codes of conduct
Effect of codes of conduct
Emergency alerts
Enforcement: appeals
Enforcement: third party information notices
Personal data breach: audit
Personal data breach: enforcement
Power to provide exceptions to regulation 6(1)
Storing information in the terminal equipment of a subscriber or user
Official guidance
Authoritative sources published by regulators or government explaining this legislation.
- Report unwanted marketing to the ICO (opens in a new tab) from ICO Detailed Guidance
- TPS — Telephone Preference Service (opens in a new tab) Detailed Guidance
- DUAA 2025 changes to PECR (opens in a new tab) Publication
- ASA advertising codes (opens in a new tab) Detailed Guidance
- Minimum unit pricing guidance (gov.wales) (opens in a new tab) Detailed Guidance
- Minimum unit pricing guidance (mygov.scot) (opens in a new tab) Detailed Guidance
- Marketing and advertising law (GOV.UK) (opens in a new tab) Detailed Guidance
- Direct marketing guidance (ICO) (opens in a new tab) from ICO Detailed Guidance
- GOV.UK: Plans for commencement (opens in a new tab) Detailed Guidance
- ICO: What does the DUAA mean for organisations (opens in a new tab) from ICO Detailed Guidance
- ... and 10 more
Enforcement and responsible bodies
The regulators that administer or enforce this legislation.
ICO
PrimaryInformation Commissioner's Office
Data protection, freedom of information, privacy and electronic communications regulation. Enforces UK GDPR and Data Protection Act 2018. Issues fines for breaches. …
Office of Communications
Regulates telecoms, TV, radio, video-on-demand, postal services, and online safety. Issues licences for telecoms providers, manages spectrum. Now enforces Online Safety Act …
Explore more
Browse legislation
Find other UK business legislation with related guidance.
Regulators
Learn more about the bodies that enforce this legislation.