PECR governs how organisations may contact people electronically (calls, faxes, email, SMS) and how they may store information on a person's device. It rides alongside UK GDPR rather than replacing it: when both apply, both must be satisfied. This is the original 2003 instrument, with the rules that have since become the daily fabric of British compliance.
PECR's thirty-six regulations cluster into five concerns: secrecy of the network, the things you can do to a person's terminal, the rules of engagement for marketing, the privacy of voice telephony, and the listing of subscribers. The marketing rules are what most businesses meet in practice; the others quietly govern the infrastructure they depend on.
PECR doesn't prescribe a single rule for marketing. It prescribes five, one per channel, and each splits again by whether the recipient is an individual or a corporate subscriber. The matrix below collapses the entire regime into a grid you can read in one glance, with citations and the small print kept faithful to the regulations.
A narrow, conditional licence to email or text individual subscribers without prior consent, aimed at letting an existing customer relationship breathe a little, without becoming a vector for cold marketing. All three tests must be true at the same time. Miss one and you fall back to the default Reg 22(2) consent rule.
Acquired during a genuine commercial relationship. Bought or scraped lists fail this test outright. The relationship must be with the marketing sender, not a parent or sister entity.
The new pitch must be reasonably related to what the customer originally engaged with, not a leap into an unrelated category. ICO guidance treats "similar" as judged from the customer's expectation, not the seller's product taxonomy.
Free of charge except for the cost of transmission. Offered when the details were first taken, and again on every subsequent communication. The unsubscribe must work and be honoured.
Soft opt-in does not cover third-party marketing, charity fundraising on the back of a donation (HCT v ICO clarified the test), or group-company marketing where the subsidiary that holds the relationship is not the entity marketing. It also doesn't apply to automated calls (Reg 19), faxes (Reg 20), or live calls (Reg 21).
Before PECR speaks to marketing, it speaks to the network itself. Service providers must keep their services secure, must inform subscribers of residual risks, and must not retain traffic data beyond what's necessary for transmission, billing, or a defined value-added purpose with consent.
Appropriate technical and organisational measures, judged in light of the state of technology and the cost of implementation, proportionate to the risk. Where significant residual risk remains, subscribers must be told the nature of the risk, mitigations available, and likely cost, free of charge.
Information may not be stored on, or read from, terminal equipment without the subscriber being given clear information and an opportunity to refuse. Strictly-necessary plumbing is exempt; everything else is consent territory.
Once a communication is delivered, traffic data must be erased or stripped of personal-data character, with three exceptions: billing windows, marketing of communications services with consent, and value-added services with consent. Consent is withdrawable at any time.
Only the public-communications provider, or a person acting under its authority, may process retained traffic data, and only for billing management, customer enquiries, fraud prevention/detection, marketing of communications services, or a value-added service. Subscribers must be told the types and durations beforehand.
Location data beyond what's needed for transmission may only be processed anonymously, or with consent for a specified value-added service. Before consent, the subscriber must be told what data, what purposes, what duration, and whether it will go to a third party. Consent withdrawable at any time, on each connection or transmission.
Nothing in PECR relieves a person of obligations under what is now the UK GDPR & Data Protection Act 2018. Where both regimes apply, for example, marketing emails to a named individual, both must be satisfied. PECR is the channel rule; UK GDPR is the data rule.
A cluster of often-overlooked obligations sits behind the marketing rules: the privacy mechanics of the call itself. Caller identification, automatic forwarding, malicious-call tracing, emergency-call carve-outs, and how subscribers find their way into (or out of) directories.
A subscriber may request non-itemised bills. OFCOM is required to balance the privacy of the calling user against the right of the bill-paying subscriber to itemisation, including by enabling alternative privacy-preserving methods.
Outgoing calls must offer a per-call and per-line means of withholding identification. Incoming calls must offer means of rejecting calls without CLI and of withholding connected-line identity. Providers must publicise the options.
A communications provider may override CLI suppression where a subscriber has asked for malicious or nuisance calls to be traced and the provider is satisfied that doing so is necessary and expedient. Stored data may be made available to a person with a legitimate interest.
Calls to 999 or 112 are excluded from CLI-prevention rules; the calling line's identity must be presentable to the emergency authority, and location-data restrictions are disregarded for the call. Privacy yields to safety.
Where a third party has caused calls intended for another line to be forwarded to a subscriber's line, the subscriber's provider must stop the forwarding without avoidable delay and free of charge. Other providers must reasonably co-operate.
Inclusion of an individual's data in a directory requires prior, informed, free-of-charge opportunity to determine inclusion. Reverse-lookup directories (telephone number → identity) require express consent. Corporates may object. Subscribers may verify, correct, or withdraw at any time.
PECR is a small instrument doing a specific job (the privacy of electronic communications) in a much larger regulatory neighbourhood. It descends from an EU directive, depends on definitions in the Communications Act, runs in parallel to UK GDPR, and shares an enforcer with the data-protection regime. Online safety law is the newer arrival next door.
The ePrivacy Directive. PECR transposes Articles 2, 4, 5(3), 6–13, 15 and 16 into UK domestic law. The 2009 amending directive tightened the cookie rule.
Supplies the load-bearing definitions: "electronic communications network", "electronic communications service", "communications provider", and the framework establishing OFCOM (s. 1, Office of Communications Act 2002).
Reg 4 confirms PECR doesn't displace data-protection law. Where the same processing engages both, both must be satisfied. UK GDPR governs the lawful basis for the data; PECR governs the channel.
OFCOM's other major hat. Where PECR governs the privacy of the carriage of electronic communications, the OSA governs the safety of user-to-user and search content the carriage delivers. Same regulator, different lever.
PECR doesn't build a parallel enforcement machinery; it bolts onto the Data Protection Act's. Schedule 1 to PECR transplants Part V of the Data Protection Act (with modifications) so the Information Commissioner can issue information notices, enforcement notices, and serve monetary penalties on PECR breaches as if they were data-protection breaches.
PECR creates a triangulated enforcement regime: the Commissioner acts on her own motion or at OFCOM's or an aggrieved person's request; the aggrieved person may also sue for damages directly; and any contract term inconsistent with PECR is simply void.
A communications provider isn't required to do (or refrain from doing) anything if exemption is required to safeguard national security. A Minister's certificate is conclusive evidence; the Information Tribunal hears appeals on judicial-review grounds.
No PECR obligation applies where compliance would be inconsistent with statutory or court-order requirements, would prejudice the prevention or detection of crime, or where exemption is necessary for legal proceedings, legal advice, or establishing/exercising/defending legal rights.
A guided walk through the marketing rules. Answer up to five questions to find out which PECR regime governs your contact, what consent (if any) you need, and what the disclosure rules require. This is a heuristic for orientation; the binding answer is in the regulations and ICO guidance.
PECR borrows freely from the Communications Act, the Data Protection Act, and the parent Directive, but a handful of definitions, set out in Reg 2, do the heavy lifting throughout the rest of the instrument.
SMS.