legislation

Privacy and Electronic Communications (EC Directive) Regulations 2003

PECR requires communications providers to safeguard security and report breaches under reg. 5A, restricts terminal storage under reg. 6, and binds direct marketers regarding unsolicited calls and electronic mail under reg. 21 and reg. 22.

Verified at publication, 2026-11-12 11:32 UTC

92 provisions in 8 parts · official text ↗

trbfpseuipsvmemccm

impact by vertical

Summary

What this law does

The Regulations establish privacy and security rules for electronic communications. They impose duties on communications providers to safeguard security, report personal data breaches within 72 hours, and restrict processing of traffic and location data. They restrict storing or accessing information on terminal equipment, subject to exceptions including user authentication. Additionally, they regulate unsolicited direct marketing by automated calling, fax, telephone, and electronic mail, requiring subscriber consent or qualifying existing relationship opt-outs.

Why it matters to Signicat and its customers

No Signicat-specific relevance narrative is stored for this instrument; the stored applicability is shown below.

Who is bound: provider of a public electronic communications service; provider of the electronic communications network; public communications provider; communications provider; person using, or instigating the use of, the service; person; collector of the personal data; producer of the directory; person to whom the information notice is given · Regulators: Information Commission; OFCOM

Banking Finance: Regulates electronic direct marketing, cold calling on claims/pensions, and exempts strictly necessary terminal storage for fraud prevention and user authentication.
Energy Utility Telco: Telecom providers face statutory obligations regarding communications security, breach notifications within 72 hours, and traffic or location data handling.
Insurance Pensions: Restricts unsolicited direct marketing telephone calls concerning occupational or personal pension schemes unless specific consent or client exceptions apply.
Services: Restricts direct marketing calls for claims management services and regulates electronic marketing consent, identification, and opt-out registers.
Commerce: Restricts terminal storage and access (cookies) on subscriber devices and requires prior consent or soft opt-in for direct marketing.

Key obligations each linked to the provision it comes from

Under (1), a person must not use or instigate a public electronic communications service to make unsolicited calls to an individual for direct marketing in relation to occupational or personal pension schemes, except where paragraph (2) or (3) applies. Under (4), a subscriber must not permit the subscriber's line to be used in contravention of paragraph (1). Direct marketing includes marketing products acquired with pension funds, advice promoting withdrawal or transfer of pension funds, or services assessing pension performance under (5)(b).

reg. 21B

data_protection.processor_controls

Under (1) and (2), a person shall neither transmit nor instigate unsolicited communications for direct marketing by electronic mail to individual subscribers unless the recipient previously consented, except in circumstances referred to in paragraph (3) or (3A). Under (4), a subscriber shall not permit his line to be used in contravention of paragraph (2).

reg. 22

data_protection.processor_controls

If a service provider fails to comply with regulation 5A notification requirements, the Information Commission may issue a fixed monetary penalty notice of £1,000 under (1) and (2). Before serving the notice, the Commission must serve a notice of intent under (3) and (4) allowing written representations within 21 days. The service provider may discharge liability by paying £800 within 21 days of receipt under (5). Service providers may appeal to the Tribunal under (8). Penalties are recoverable through court orders under (10), (11), and (12).

reg. 5C

data_protection.processor_controls

Under (1) to (3), a relevant public communications provider directed by a relevant public authority during an emergency may disregard restrictions in (2) to convey alert communications. Under (4) and (5), the provider may disregard those restrictions to test an emergency alert service when notified and directed by a Minister of the Crown. Under (6), traffic or location data processed under this regulation must be erased or modified to cease constituting personal data within 7 days of the directed alert period expiring or within 48 hours of receipt of test directions.

reg. 16A

data_protection.processor_controlsretention.archive

Part summaries

0 of 0 parts have a verified summary.

L1 unavailable for current verification: the overall summary needs every part verified. Provisions and the verified summaries remain readable.

Verification findings (102)

synthesis coverage: missing/unverified L2 main

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-1

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-2

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-3

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-4

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-5

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-5A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-5B

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-5C

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-6

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-6A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-7

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-8

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-9

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-10

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-11

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-12

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-13

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-14

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-15

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-16

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-16A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-17

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-18

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-19

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-20

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-21

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-21A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-21B

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-22

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-23

synthesis coverage: missing/unverified L2 main

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-24

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-25

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-26

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-27

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-28

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-29

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-29A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-30

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-31

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-31A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-31B

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-32

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-32A

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-32B

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-32C

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-33

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-34

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-35

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-36

synthesis coverage: missing evaluation uk:uksi/2003/2426#regulation-37

synthesis coverage: missing/unverified L2 schedule-A1

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-1

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-2

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-3

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-4

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-5

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-6

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-A1-paragraph-7

synthesis coverage: missing/unverified L2 schedule-1

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-1

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-2

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-3

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-4

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-5

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-6

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-7

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-8

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-9

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-10

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-11

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-12

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-13

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-14

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-15

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-16

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-17

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-18

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-19

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-20

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-21

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-22

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-23

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-24

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-25

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-26

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-27

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-28

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-29

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-1-paragraph-30

synthesis coverage: missing/unverified L2 schedule-2-part-1

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-2-paragraph-1

synthesis coverage: missing/unverified L2 schedule-2-part-2

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-2-paragraph-2

synthesis coverage: missing/unverified L2 schedule-2-part-3

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-2-paragraph-3

synthesis coverage: missing/unverified L2 schedule-2-part-4

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-2-paragraph-4

synthesis coverage: missing/unverified L2 schedule-2-part-5

synthesis coverage: missing evaluation uk:uksi/2003/2426#schedule-2-paragraph-5

Instrument tier unavailable

Change history as published

Reg. 5B omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 115(3), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)

Reg. 31A omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 115(6), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)

Reg. 31B omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 115(7), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)

Pending effects amendments not yet applied to this text

reg. 33 words substituted by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 Sch. 3 para. 6(6)(b)(ii) · Effective date unknown · reg. 33

reg. 33 word substituted by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 Sch. 3 para. 6(6)(c) · Effective date unknown · reg. 33

Full TOC · table of contents Collapse parts

8 parts · 92 provisions. Open a provision for its text and, where available, its one-line summary.

· 50 provisions

1 Citation and commencement uk:uksi/2003/2426#regulation-1

2 Interpretation uk:uksi/2003/2426#regulation-2

3 Revocation of the Telecommunications (Data Protection and Privacy) Regulations 1999 uk:uksi/2003/2426#regulation-3

4 Relationship between these Regulations and the data protection legislation uk:uksi/2003/2426#regulation-4

5 Security of public electronic communications services uk:uksi/2003/2426#regulation-5

5A Personal data breach uk:uksi/2003/2426#regulation-5A

5B Personal data breach: audit uk:uksi/2003/2426#regulation-5B

5C Personal data breach: enforcement uk:uksi/2003/2426#regulation-5C

6 Storing information in the terminal equipment of a subscriber or user uk:uksi/2003/2426#regulation-6

6A Power to provide exceptions to regulation 6(1) uk:uksi/2003/2426#regulation-6A

7 Restrictions on the processing of certain traffic data uk:uksi/2003/2426#regulation-7

8 Further provisions relating to the processing of traffic data under regulation 7 uk:uksi/2003/2426#regulation-8

9 Itemised billing and privacy uk:uksi/2003/2426#regulation-9

10 Prevention of calling line identification – outgoing calls uk:uksi/2003/2426#regulation-10

11 Prevention of calling or connected line identification – incoming calls uk:uksi/2003/2426#regulation-11

12 Publication of information for the purposes of regulations 10 and 11 uk:uksi/2003/2426#regulation-12

13 Co-operation of communications providers for the purposes of regulations 10 and 11 uk:uksi/2003/2426#regulation-13

14 Restrictions on the processing of location data uk:uksi/2003/2426#regulation-14

15 Tracing of malicious or nuisance calls uk:uksi/2003/2426#regulation-15

16 Emergency calls uk:uksi/2003/2426#regulation-16

16A Emergency alerts uk:uksi/2003/2426#regulation-16A

17 Termination of automatic call forwarding uk:uksi/2003/2426#regulation-17

18 Directories of subscribers uk:uksi/2003/2426#regulation-18

19 Use of automated calling systems uk:uksi/2003/2426#regulation-19

20 Use of facsimile machines for direct marketing purposes uk:uksi/2003/2426#regulation-20

21 Calls for direct marketing purposes uk:uksi/2003/2426#regulation-21

21A Calls for direct marketing of claims management services uk:uksi/2003/2426#regulation-21A

21B Calls for direct marketing in relation to pension schemes uk:uksi/2003/2426#regulation-21B

22 Use of electronic mail for direct marketing purposes uk:uksi/2003/2426#regulation-22

23 Use of electronic mail for direct marketing purposes where the identity or address of the sender is concealed uk:uksi/2003/2426#regulation-23

24 Information to be provided for the purposes of regulations 19 to 21A uk:uksi/2003/2426#regulation-24

25 Register to be kept for the purposes of regulation 20 uk:uksi/2003/2426#regulation-25

26 Register to be kept for the purposes of regulation 21 uk:uksi/2003/2426#regulation-26

27 Modification of contracts uk:uksi/2003/2426#regulation-27

28 National security uk:uksi/2003/2426#regulation-28

29 Legal requirements, law enforcement etc. uk:uksi/2003/2426#regulation-29

29A uk:uksi/2003/2426#regulation-29A

30 Proceedings for compensation for failure to comply with requirements of the Regulations uk:uksi/2003/2426#regulation-30

31 Information Commission’s enforcement powers uk:uksi/2003/2426#regulation-31

31A Enforcement: third party information notices uk:uksi/2003/2426#regulation-31A

31B Enforcement: appeals uk:uksi/2003/2426#regulation-31B

32 Request that the Commission exercise ... enforcement functions uk:uksi/2003/2426#regulation-32

32A Codes of conduct uk:uksi/2003/2426#regulation-32A

32B Accreditation of bodies monitoring compliance with codes of conduct uk:uksi/2003/2426#regulation-32B

32C Effect of codes of conduct uk:uksi/2003/2426#regulation-32C

33 Technical advice to the Commission uk:uksi/2003/2426#regulation-33

34 Amendment to the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 uk:uksi/2003/2426#regulation-34

35 Amendment to the Electronic Communications (Universal Service) Order 2003 uk:uksi/2003/2426#regulation-35

36 Transitional provisions uk:uksi/2003/2426#regulation-36

37 Review of implementation uk:uksi/2003/2426#regulation-37

Schedule A1 · 7 provisions

1 Interpretation uk:uksi/2003/2426#schedule-A1-paragraph-1

2 Consent uk:uksi/2003/2426#schedule-A1-paragraph-2

3 Transmission of a communication over an electronic communications network uk:uksi/2003/2426#schedule-A1-paragraph-3

4 Storage or access strictly necessary to provide an information society service uk:uksi/2003/2426#schedule-A1-paragraph-4

5 Collecting information for statistical purposes uk:uksi/2003/2426#schedule-A1-paragraph-5

6 Website appearance etc uk:uksi/2003/2426#schedule-A1-paragraph-6

7 Emergency assistance uk:uksi/2003/2426#schedule-A1-paragraph-7

SCHEDULE 1 · 30 provisions

1 Provisions applied for enforcement purposes uk:uksi/2003/2426#schedule-1-paragraph-1

2 General modification of references to the Data Protection Act 2018 uk:uksi/2003/2426#schedule-1-paragraph-2

3 Modification of section 142 (information notices) uk:uksi/2003/2426#schedule-1-paragraph-3

4 Modification of section 143 (information notices: restrictions) uk:uksi/2003/2426#schedule-1-paragraph-4

5 Modification of section 145 (information orders) uk:uksi/2003/2426#schedule-1-paragraph-5

6 Modification of section 146 (assessment notices) uk:uksi/2003/2426#schedule-1-paragraph-6

7 Modification of section 146A (assessment notices: approval of person to prepare report) uk:uksi/2003/2426#schedule-1-paragraph-7

8 Modification of section 147 (assessment notices: restrictions) uk:uksi/2003/2426#schedule-1-paragraph-8

9 Modification of section 148A (interview notices) uk:uksi/2003/2426#schedule-1-paragraph-9

10 Modification of section 148B (interview notices: restrictions) uk:uksi/2003/2426#schedule-1-paragraph-10

11 Modification of section 149 (enforcement notices) uk:uksi/2003/2426#schedule-1-paragraph-11

12 Modification of section 150 (enforcement notices: supplementary) uk:uksi/2003/2426#schedule-1-paragraph-12

13 Modification of section 152 (enforcement notices: restrictions) uk:uksi/2003/2426#schedule-1-paragraph-13

14 Modification of Schedule 15 (powers of entry and inspection) uk:uksi/2003/2426#schedule-1-paragraph-14

15 Modification of section 155 (penalty notices) uk:uksi/2003/2426#schedule-1-paragraph-15

16 Modification of Schedule 16 (penalties) uk:uksi/2003/2426#schedule-1-paragraph-16

17 Modification of section 156 (penalty notices: restrictions) uk:uksi/2003/2426#schedule-1-paragraph-17

18 Modification of section 157 (maximum amount of penalty) uk:uksi/2003/2426#schedule-1-paragraph-18

19 Modification of section 159 (amount of penalties: supplementary) uk:uksi/2003/2426#schedule-1-paragraph-19

20 Modification of section 160 (guidance) uk:uksi/2003/2426#schedule-1-paragraph-20

21 Modification of section 162 (rights of appeal) uk:uksi/2003/2426#schedule-1-paragraph-21

22 Modification of section 163 (determination of appeals) uk:uksi/2003/2426#schedule-1-paragraph-22

23 Modification of section 180 (jurisdiction) uk:uksi/2003/2426#schedule-1-paragraph-23

24 Modification of section 181 (interpretation of Part 6) uk:uksi/2003/2426#schedule-1-paragraph-24

25 Modification of section 182 (regulations and consultation) uk:uksi/2003/2426#schedule-1-paragraph-25

26 Modification of section 196 (penalties for offences) uk:uksi/2003/2426#schedule-1-paragraph-26

27 Modification of section 200 (guidance about PACE codes of practice) uk:uksi/2003/2426#schedule-1-paragraph-27

28 Modification of section 202 (proceedings in the First-tier Tribunal: contempt) uk:uksi/2003/2426#schedule-1-paragraph-28

29 Modification of section 203 (tribunal procedure rules) uk:uksi/2003/2426#schedule-1-paragraph-29

30 Interpretation uk:uksi/2003/2426#schedule-1-paragraph-30

Interpretation · 1 provisions

1 uk:uksi/2003/2426#schedule-2-paragraph-1

Directories · 1 provisions

2 uk:uksi/2003/2426#schedule-2-paragraph-2

Notifications · 1 provisions

3 uk:uksi/2003/2426#schedule-2-paragraph-3

Registers kept under regulations 25 and 26 · 1 provisions

4 uk:uksi/2003/2426#schedule-2-paragraph-4

References in these Regulations to OFCOM · 1 provisions

5 uk:uksi/2003/2426#schedule-2-paragraph-5

Impact profile

Transportation

Banking finance

Public sector health

Energy, utilities & telco

Insurance pensions

Services

Media entertainment

Manufacturing construction

Commerce

Dimensions

Mechanism strength

Signicat obligation

Urgency

Pending

Penalties

A fixed monetary penalty of £1,000 (discounted to £800 if paid within 21 days) may be imposed by the Information Commission under reg. 5C for failing to comply with breach notification requirements.

Definitions

bill

“includes an invoice, account, statement or other document of similar character and “billing” shall be construed accordingly;”

reg. 2

call

“means a connection established by means of a telephone service available to the public allowing two-way communication in real time , and a reference to making a call includes a reference to attempting to establish such a connection;”

reg. 2

direct marketing

“means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;”

reg. 2

electronic communications network

“has the meaning given by section 32 of the Communications Act 2003 ;”

reg. 2

electronic mail

“means any text, voice, sound or image message sent over a public electronic communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient and includes messages sent using a short message service;”

reg. 2

individual

“means a living individual and includes an unincorporated body of such individuals;”

reg. 2

personal data breach

“means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a public electronic communications service;”

reg. 2

public communications provider

“means a provider of a public electronic communications network or a public electronic communications service;”

reg. 2

subscriber

“means a person who is a party to a contract with a provider of public electronic communications services for the supply of such services;”

reg. 2

traffic data

“means any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing in respect of that communication and includes data relating to the routing, duration or time of a communication;”

reg. 2

user

“means any individual using a public electronic communications service; and”

reg. 2

value added service

“means any service which requires the processing of traffic data or location data beyond that which is necessary for the transmission of a communication or the billing in respect of that communication.”

reg. 2

website

“includes a mobile application and any other platform by means of which an information society service is provided.”

Sch. A1 para. 1

the PEC Regulations

“means these Regulations.”

Sch. 1 para. 30

References