What is PECR and when does it apply?

PECR is a data privacy regulation which, like the GDPR, sets out rules on what marketing activities businesses can and cannot do without consent, and also dictates how businesses must deal with personal and corporate data. In plain language, PECR applies to all organisations that do at least one of these:

• Market by phone, email, text or fax
• Use cookies or a similar technology on a website
• Compile a telephone directory (or a similar public directory)
• Are a network or communication service provider

The first bullet point alone means that PECR applies to virtually every UK organisation that undertakes regular marketing activities.

PECR and the UK’s implementation of the GDPR ultimately both stem from different European privacy initiatives, and it is not a matter of complying with one or the other: organisations must comply with both. PECR has adopted the GDPR’s definition of valid consent to make abiding by both sets of regulations easier. PECR was last updated in early 2019 to patch some grey and missing areas within the GDPR.

Though the two regulations naturally complement each other, there are some notable differences between the GDPR and PECR:

• The GDPR mandates a 72-hour timeframe to report a breach. For PECR it is much tighter, at only 24 hours.
• Unlike the GDPR, PECR applies to other organisations in addition to applying to individuals.
• PECR applies even if you are not processing personal data, and marketing rules apply even if you cannot identify the person you’re contacting.

If you’re following good data protection standards and are compliant with the GDPR, then chances are you’ll be in a good position to be in-line with PECR requirements. It’s down to your data protection officer to make sure your organisation is following all relevant regulations, including PECR. Here are some examples of steps you should be taking to make sure you’re PECR compliant:

• Buying marketing lists

  In the event that you have bought a list, ensure that you match the personal data (such as phone number and email) against those who have previously opted out of calls and emails to your organisation, and to those who are on the Telephone Preference Service (TPS) list.

• Sending marketing emails

  Organisations cannot track if and when a marketing email has been opened, forwarded, deleted (and so on) without the consent of the data subject.

• Consent

  PECR follows the same definition of consent given in the GDPR, namely it must be freely given, specific, informed, and unambiguous.

• Cookies

  Ensure you have a cookie compliance banner in place. That means giving website visitors the ability to opt into the various categories of cookies. Only necessary cookies can be processed automatically before consent is given. Be proactive and scan your website to inform yourself and website visitors of the cookies that are collected and processed.