PECR
Privacy and Electronic Communications Regulations 2003
The UK implementation of the ePrivacy Directive: rules on cookies, electronic marketing and the security of communications services, enforced by the ICO.
In force: In force since 2003; amended several times since, including by the Data (Use and Access) Act 2025
Who it applies to
Anyone sending electronic marketing or using cookies and similar technologies, and providers of public electronic communications services.
Key requirements
- Consent for non-essential cookies and similar storage or access technologies.
- Consent for most marketing emails and texts to individuals, with a 'soft opt-in' for existing customers.
- Screening against the Telephone Preference Service for marketing calls.
- Security and breach notification duties for communications service providers.
Breach and incident notification
Public electronic communications service providers notify the ICO of personal data breaches within the short deadline set by the ICO's guidance, and may need to tell affected customers.
Penalties
Enforced by the ICO through monetary penalties and enforcement notices.
Related frameworks
Shows up on these exams
Official source
legislation.gov.uk: SI 2003/2426Not legal advice
This is a study summary, not legal advice. Laws and their guidance change, and obligations depend on your facts and jurisdiction. Check the official source and the current, dated text, and consult a qualified lawyer before acting.
Go deeper
Privacy lab
Practise this topic hands-on.
UK GDPR / DPA 2018
United Kingdom - Privacy & data protection
UK NIS Regulations
United Kingdom - Critical infrastructure
Computer Misuse Act
United Kingdom - Cybercrime
GDPR
European Union - Privacy & data protection
ePrivacy
European Union - Privacy & data protection
COPPA
United States (federal) - Privacy & data protection