Watchtower/Law library/Privacy and Electronic Communications (EC...
As last captured

legislation

Privacy and Electronic Communications (EC Directive) Regulations 2003

PECR requires communications providers to safeguard security and report breaches under reg. 5A, restricts terminal storage under reg. 6, and binds direct marketers regarding unsolicited calls and electronic mail under reg. 21 and reg. 22.

Verified at publication, 2026-11-12 11:32 UTC

92 provisions in 8 parts · official text ↗

trbfpseuipsvmemccm
impact by vertical

Summary

What this law does

The Regulations establish privacy and security rules for electronic communications. They impose duties on communications providers to safeguard security, report personal data breaches within 72 hours, and restrict processing of traffic and location data. They restrict storing or accessing information on terminal equipment, subject to exceptions including user authentication. Additionally, they regulate unsolicited direct marketing by automated calling, fax, telephone, and electronic mail, requiring subscriber consent or qualifying existing relationship opt-outs.

Why it matters to Signicat and its customers

No Signicat-specific relevance narrative is stored for this instrument; the stored applicability is shown below.

Who is bound: provider of a public electronic communications service; provider of the electronic communications network; public communications provider; communications provider; person using, or instigating the use of, the service; person; collector of the personal data; producer of the directory; person to whom the information notice is given · Regulators: Information Commission; OFCOM

Banking Finance
Regulates electronic direct marketing, cold calling on claims/pensions, and exempts strictly necessary terminal storage for fraud prevention and user authentication.
Energy Utility Telco
Telecom providers face statutory obligations regarding communications security, breach notifications within 72 hours, and traffic or location data handling.
Insurance Pensions
Restricts unsolicited direct marketing telephone calls concerning occupational or personal pension schemes unless specific consent or client exceptions apply.
Services
Restricts direct marketing calls for claims management services and regulates electronic marketing consent, identification, and opt-out registers.
Commerce
Restricts terminal storage and access (cookies) on subscriber devices and requires prior consent or soft opt-in for direct marketing.

Key obligations each linked to the provision it comes from

Under (1), a person must not use or instigate a public electronic communications service to make unsolicited calls to an individual for direct marketing in relation to occupational or personal pension schemes, except where paragraph (2) or (3) applies. Under (4), a subscriber must not permit the subscriber's line to be used in contravention of paragraph (1). Direct marketing includes marketing products acquired with pension funds, advice promoting withdrawal or transfer of pension funds, or services assessing pension performance under (5)(b).
reg. 21B
data_protection.processor_controls
Under (1) and (2), a person shall neither transmit nor instigate unsolicited communications for direct marketing by electronic mail to individual subscribers unless the recipient previously consented, except in circumstances referred to in paragraph (3) or (3A). Under (4), a subscriber shall not permit his line to be used in contravention of paragraph (2).
reg. 22
data_protection.processor_controls
If a service provider fails to comply with regulation 5A notification requirements, the Information Commission may issue a fixed monetary penalty notice of £1,000 under (1) and (2). Before serving the notice, the Commission must serve a notice of intent under (3) and (4) allowing written representations within 21 days. The service provider may discharge liability by paying £800 within 21 days of receipt under (5). Service providers may appeal to the Tribunal under (8). Penalties are recoverable through court orders under (10), (11), and (12).
reg. 5C
data_protection.processor_controls
Under (1) to (3), a relevant public communications provider directed by a relevant public authority during an emergency may disregard restrictions in (2) to convey alert communications. Under (4) and (5), the provider may disregard those restrictions to test an emergency alert service when notified and directed by a Minister of the Crown. Under (6), traffic or location data processed under this regulation must be erased or modified to cease constituting personal data within 7 days of the directed alert period expiring or within 48 hours of receipt of test directions.
reg. 16A
data_protection.processor_controlsretention.archive

Part summaries

0 of 0 parts have a verified summary.

L1 unavailable for current verification: the overall summary needs every part verified. Provisions and the verified summaries remain readable.

Verification findings (102)

synthesis coverage: missing/unverified L2 main

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-1

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-2

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-3

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-4

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-5

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-5A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-5B

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-5C

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-6

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-6A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-7

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-8

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-9

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-10

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-11

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-12

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-13

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-14

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-15

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-16

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-16A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-17

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-18

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-19

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-20

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-21

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-21A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-21B

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-22

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-23

synthesis coverage: missing/unverified L2 main

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-24

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-25

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-26

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-27

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-28

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-29

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-29A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-30

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-31

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-31A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-31B

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-32

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-32A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-32B

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-32C

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-33

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-34

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-35

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-36

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-37

synthesis coverage: missing/unverified L2 schedule-A1

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-1

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-2

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-3

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-4

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-5

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-6

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-7

synthesis coverage: missing/unverified L2 schedule-1

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-1

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-2

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-3

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-4

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-5

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-6

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-7

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-8

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-9

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-10

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-11

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-12

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-13

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-14

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-15

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-16

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-17

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-18

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-19

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-20

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-21

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-22

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-23

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-24

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-25

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-26

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-27

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-28

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-29

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-30

synthesis coverage: missing/unverified L2 schedule-2-part-1

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-2-paragraph-1

synthesis coverage: missing/unverified L2 schedule-2-part-2

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-2-paragraph-2

synthesis coverage: missing/unverified L2 schedule-2-part-3

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-2-paragraph-3

synthesis coverage: missing/unverified L2 schedule-2-part-4

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-2-paragraph-4

synthesis coverage: missing/unverified L2 schedule-2-part-5

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-2-paragraph-5

Instrument tier unavailable

Change history as published

Reg. 5B omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 115(3), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)

Reg. 31A omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 115(6), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)

Reg. 31B omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 115(7), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)

Pending effects amendments not yet applied to this text

reg. 33 words substituted by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 Sch. 3 para. 6(6)(b)(ii) · Effective date unknown · reg. 33

reg. 33 word substituted by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 Sch. 3 para. 6(6)(c) · Effective date unknown · reg. 33

Full TOC · table of contents Expand all parts

8 parts · 92 provisions. Open a provision for its text and, where available, its one-line summary.

· 50 provisions
1 Citation and commencement
2 Interpretation
3 Revocation of the Telecommunications (Data Protection and Privacy) Regulations 1999
4 Relationship between these Regulations and the data protection legislation
5 Security of public electronic communications services
5A Personal data breach
5B Personal data breach: audit
5C Personal data breach: enforcement
6 Storing information in the terminal equipment of a subscriber or user
6A Power to provide exceptions to regulation 6(1)
7 Restrictions on the processing of certain traffic data
8 Further provisions relating to the processing of traffic data under regulation 7
9 Itemised billing and privacy
10 Prevention of calling line identification – outgoing calls
11 Prevention of calling or connected line identification – incoming calls
12 Publication of information for the purposes of regulations 10 and 11
13 Co-operation of communications providers for the purposes of regulations 10 and 11
14 Restrictions on the processing of location data
15 Tracing of malicious or nuisance calls
16 Emergency calls
16A Emergency alerts
17 Termination of automatic call forwarding
18 Directories of subscribers
19 Use of automated calling systems
20 Use of facsimile machines for direct marketing purposes
21 Calls for direct marketing purposes
21A Calls for direct marketing of claims management services
21B Calls for direct marketing in relation to pension schemes
22 Use of electronic mail for direct marketing purposes
23 Use of electronic mail for direct marketing purposes where the identity or address of the sender is concealed
24 Information to be provided for the purposes of regulations 19 to 21A
25 Register to be kept for the purposes of regulation 20
26 Register to be kept for the purposes of regulation 21
27 Modification of contracts
28 National security
29 Legal requirements, law enforcement etc.
29A
30 Proceedings for compensation for failure to comply with requirements of the Regulations
31 Information Commission’s enforcement powers
31A Enforcement: third party information notices
31B Enforcement: appeals
32 Request that the Commission exercise ... enforcement functions
32A Codes of conduct
32B Accreditation of bodies monitoring compliance with codes of conduct
32C Effect of codes of conduct
33 Technical advice to the Commission
34 Amendment to the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000
35 Amendment to the Electronic Communications (Universal Service) Order 2003
36 Transitional provisions
37 Review of implementation
Schedule A1 · 7 provisions
1 Interpretation
2 Consent
3 Transmission of a communication over an electronic communications network
4 Storage or access strictly necessary to provide an information society service
5 Collecting information for statistical purposes
6 Website appearance etc
7 Emergency assistance
SCHEDULE 1 · 30 provisions
1 Provisions applied for enforcement purposes
2 General modification of references to the Data Protection Act 2018
3 Modification of section 142 (information notices)
4 Modification of section 143 (information notices: restrictions)
5 Modification of section 145 (information orders)
6 Modification of section 146 (assessment notices)
7 Modification of section 146A (assessment notices: approval of person to prepare report)
8 Modification of section 147 (assessment notices: restrictions)
9 Modification of section 148A (interview notices)
10 Modification of section 148B (interview notices: restrictions)
11 Modification of section 149 (enforcement notices)
12 Modification of section 150 (enforcement notices: supplementary)
13 Modification of section 152 (enforcement notices: restrictions)
14 Modification of Schedule 15 (powers of entry and inspection)
15 Modification of section 155 (penalty notices)
16 Modification of Schedule 16 (penalties)
17 Modification of section 156 (penalty notices: restrictions)
18 Modification of section 157 (maximum amount of penalty)
19 Modification of section 159 (amount of penalties: supplementary)
20 Modification of section 160 (guidance)
21 Modification of section 162 (rights of appeal)
22 Modification of section 163 (determination of appeals)
23 Modification of section 180 (jurisdiction)
24 Modification of section 181 (interpretation of Part 6)
25 Modification of section 182 (regulations and consultation)
26 Modification of section 196 (penalties for offences)
27 Modification of section 200 (guidance about PACE codes of practice)
28 Modification of section 202 (proceedings in the First-tier Tribunal: contempt)
29 Modification of section 203 (tribunal procedure rules)
30 Interpretation
Interpretation · 1 provisions
1
Directories · 1 provisions
2
Notifications · 1 provisions
3
Registers kept under regulations 25 and 26 · 1 provisions
4
References in these Regulations to OFCOM · 1 provisions
5

Impact profile

Transportation
1
Banking finance
2
Public sector health
1
Energy, utilities & telco
3
Insurance pensions
2
Services
2
Media entertainment
1
Manufacturing construction
1
Commerce
2

Dimensions

Mechanism strength
2
Signicat obligation
1
Urgency
Pending

Penalties

A fixed monetary penalty of £1,000 (discounted to £800 if paid within 21 days) may be imposed by the Information Commission under reg. 5C for failing to comply with breach notification requirements.

Definitions

bill
“includes an invoice, account, statement or other document of similar character and “billing” shall be construed accordingly;”
reg. 2
call
“means a connection established by means of a telephone service available to the public allowing two-way communication in real time , and a reference to making a call includes a reference to attempting to establish such a connection;”
reg. 2
direct marketing
“means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;”
reg. 2
electronic communications network
“has the meaning given by section 32 of the Communications Act 2003 ;”
reg. 2
electronic mail
“means any text, voice, sound or image message sent over a public electronic communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient and includes messages sent using a short message service;”
reg. 2
individual
“means a living individual and includes an unincorporated body of such individuals;”
reg. 2
personal data breach
“means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a public electronic communications service;”
reg. 2
public communications provider
“means a provider of a public electronic communications network or a public electronic communications service;”
reg. 2
subscriber
“means a person who is a party to a contract with a provider of public electronic communications services for the supply of such services;”
reg. 2
traffic data
“means any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing in respect of that communication and includes data relating to the routing, duration or time of a communication;”
reg. 2
user
“means any individual using a public electronic communications service; and”
reg. 2
value added service
“means any service which requires the processing of traffic data or location data beyond that which is necessary for the transmission of a communication or the billing in respect of that communication.”
reg. 2
website
“includes a mobile application and any other platform by means of which an information society service is provided.”
Sch. A1 para. 1
the PEC Regulations
“means these Regulations.”
Sch. 1 para. 30

References

uk:ukpga/2000/8

uk:ukpga/2018/12

uk:ukpga/2025/18

uk:uksi/2002/2013