What is PECR and when does it apply?

Rebecca Bada Headshot
Rebecca Bada
Senior GDPR Consultant
19th March 2021

The overlooked privacy regulation

It’s hard to ignore the GDPR these days, with headline-making fines and regular news updates on the continuing impacts of data protection post-Brexit. Most businesses will be aware of what they have to do for the GDPR, with increasing numbers actively engaging GDPR compliance services. But there is another privacy regulation that UK businesses must comply with. It may not grab as many headlines as the GDPR, but it’s still mandatory, and the Information Commissioner’s Office (ICO) still issue fines for data breaches arising from non-compliance.

This other regulation is the Privacy and Electronic Communications Regulation, almost always referred to as PECR, and it’s about time we told you more about it.

What is PECR?

PECR is a data privacy regulation which, like the GDPR, sets out rules on what marketing activities businesses can and cannot do without consent, and also dictates how businesses must deal with personal and corporate data. In plain language, PECR applies to all organisations that do at least one of these:

  • Market by phone, email, text or fax
  • Use cookies or a similar technology on a website
  • Compile a telephone directory (or a similar public directory)
  • Are a network or communication service provider

The first bullet point alone means that PECR applies to virtually every UK organisation that undertakes regular marketing activities.

Person typing on a laptop with communication icons floating

What’s the difference between PECR and GDPR?

PECR and the UK’s implementation of the GDPR ultimately both stem from different European privacy initiatives, and it is not a matter of complying with one or the other: organisations must comply with both. PECR has adopted the GDPR’s definition of valid consent to make abiding by both sets of regulations easier. PECR was last updated in early 2019 to patch some grey and missing areas within the GDPR.

Though the two regulations naturally complement each other, there are some notable differences between the GDPR and PECR:

  • The GDPR mandates a 72-hour timeframe to report a breach. For PECR it is much tighter, at only 24 hours.
  • Unlike the GDPR, PECR applies to other organisations in addition to applying to individuals.
  • PECR applies even if you are not processing personal data, and marketing rules apply even if you cannot identify the person you’re contacting.
Clipboard with checklist icon

Want to find out more about GDPR?

Bulletproof has helpful free resources for organisations looking to find out more about GDPR. Why not download our educational GDPR white paper, watch our insightful webinar featuring our Head of Compliance, or view our interesting infographics?

How do I comply with PECR?

If you’re following good data protection standards and are compliant with the GDPR, then chances are you’ll be in a good position to be in-line with PECR requirements. It’s down to your data protection officer to make sure your organisation is following all relevant regulations, including PECR. Here are some examples of steps you should be taking to make sure you’re PECR compliant:

  • Buying marketing lists

    In the event that you have bought a list, ensure that you match the personal data (such as phone number and email) against those who have previously opted out of calls and emails to your organisation, and to those who are on the Telephone Preference Service (TPS) list.
  • Sending marketing emails

    Organisations cannot track if and when a marketing email has been opened, forwarded, deleted (and so on) without the consent of the data subject.
  • Consent

    PECR follows the same definition of consent given in the GDPR, namely it must be freely given, specific, informed, and unambiguous.
  • Cookies

    Ensure you have a cookie compliance banner in place. That means giving website visitors the ability to opt into the various categories of cookies. Only necessary cookies can be processed automatically before consent is given. Be proactive and scan your website to inform yourself and website visitors of the cookies that are collected and processed.

Case Study: A PECR Breach

A call centre company made over 150,000 unsolicited calls, including calls to people who were TPS registered. This prompted multiple complaints by members of the public and, after an investigation by the authorities, the call centre was fined £120,000.

Lessons Learned

  • It is imperative that organisations check against the TPS register before making sales calls to customers.
  • If a mailing list is bought from a third-party supplier, ensure that it comes with a record of the consent. Though the list came from elsewhere, it’s still your duty to make sure that consent was given and duly recorded.
  • Ensure the consent meets the requirements under PECR and GDPR, as described above.

The future of PECR

It is expected that a new EU ePrivacy directive will be released in the next few years and, though nothing is yet certain with data protection in the post-Brexit world, the new regulation will probably impact the UK’s PECR regulation. As with all other data protection matters, engage with an experienced data protection officer and follow their recommendations to make sure you don’t fall victim to data breaches and fines.

Rebecca Bada Headshot

Meet the author

Rebecca Bada Senior GDPR Consultant

As one of our more experienced data protection officers, Rebecca knows data protection inside and out. Her favourite topics to write about include UK & EU GDPR, DPO activities and the often-overlooked PECR regulations.

Get help with your data protection obligations

Bulletproof’s experienced data protection officers give your business on-going support and maintenance of your data protection obligations. Find out more about our flexible, cost-effective packages.

Learn more

Related resources

Trusted cyber security & compliance services from a certified provider

Get a quote today

If you are interested in our services, get a free, no obligation quote today by filling out the form below.

(1,500 characters limit)

For more information about how we collect, process and retain your personal data, please see our privacy policy.