What is PECR and when does it apply?

Rebecca Bada Headshot
Written by Rebecca Bada  GDPR & PECR Consultant

19/03/2021

The overlooked privacy regulation

It’s hard to ignore the GDPR these days, with headline-making fines and regular news updates on the continuing impacts of data protection post-Brexit. Most businesses will be aware of what they have to do for the GDPR, with increasing numbers actively doing something about it. But there is another privacy regulation that UK businesses must comply with. It may not grab as many headlines as the GDPR, but it’s still mandatory, and the Information Commissioner’s Office (ICO) still issue fines for data breaches arising from non-compliance.

This other regulation is the Privacy and Electronic Communications Regulation, almost always referred to as PECR, and it’s about time we told you more about it.


What is PECR?

PECR is a data privacy regulation which, like the GDPR, sets out rules on what marketing activities businesses can and cannot do without consent, and also dictates how businesses must deal with personal and corporate data. In plain language, PECR applies to all organisations that do at least one of these:

  • Market by phone, email, text or fax
  • Use cookies or a similar technology on a website
  • Compile a telephone directory (or a similar public directory)
  • Are a network or communication service provider

The first bullet point alone means that PECR applies to virtually every UK organisation that undertakes regular marketing activities.

Person typing on a laptop with communication icons floating

What’s the difference between PECR and GDPR?

PECR and the UK’s implementation of the GDPR ultimately both stem from different European privacy initiatives, and it is not a matter of complying with one or the other: organisations must comply with both. PECR has adopted the GDPR’s definition of valid consent to make abiding by both sets of regulations easier. PECR was last updated in early 2019 to patch some grey and missing areas within the GDPR.

Though the two regulations naturally complement each other, there are some notable differences between the GDPR and PECR:

  • The GDPR mandates a 72-hour timeframe to report a breach. For PECR it is much tighter, at only 24 hours.
  • Unlike the GDPR, PECR applies to other organisations in addition to applying to individuals.
  • PECR applies even if you are not processing personal data, and marketing rules apply even if you cannot identify the person you’re contacting.
Clipboard with checklist icon

Want to find out more about GDPR?

Bulletproof has helpful free resources for organisations looking to find out more about GDPR. Why not download our educational white paper, watch our insightful webinar featuring our Head of Compliance, or view our interesting infographics?

How do I comply with PECR?

If you’re following good data protection standards and are compliant with the GDPR, then chances are you’ll be in a good position to be in-line with PECR requirements. It’s down to your data protection officer to make sure your organisation is following all relevant regulations, including PECR. Here are some examples of steps you should be taking to make sure you’re PECR compliant:

  • Buying marketing lists

    In the event that you have bought a list, ensure that you match the personal data (such as phone number and email) against those who have previously opted out of calls and emails to your organisation, and to those who are on the Telephone Preference Service (TPS) list.
  • Sending marketing emails

    Organisations cannot track if and when a marketing email has been opened, forwarded, deleted (and so on) without the consent of the data subject.
  • Consent

    PECR follows the same definition of consent given in the GDPR, namely it must be freely given, specific, informed, and unambiguous.
  • Cookies

    Ensure you have a cookie compliance banner in place. That means giving website visitors the ability to opt into the various categories of cookies. Only necessary cookies can be processed automatically before consent is given. Be proactive and scan your website to inform yourself and website visitors of the cookies that are collected and processed.

Case Study: A PECR Breach

A call centre company made over 150,000 unsolicited calls, including calls to people who were TPS registered. This prompted multiple complaints by members of the public and, after an investigation by the authorities, the call centre was fined £120,000.

Lessons Learned

  • It is imperative that organisations check against the TPS register before making sales calls to customers.
  • If a mailing list is bought from a third-party supplier, ensure that it comes with a record of the consent. Though the list came from elsewhere, it’s still your duty to make sure that consent was given and duly recorded.
  • Ensure the consent meets the requirements under PECR and GDPR, as described above.

The future of PECR

It is expected that a new EU ePrivacy directive will be released in the next few years and, though nothing is yet certain with data protection in the post-Brexit world, the new regulation will probably impact the UK’s PECR regulation. As with all other data protection matters, engage with an experienced data protection officer and follow their recommendations to make sure you don’t fall victim to data breaches and fines.


Our experts are the ones to trust when it comes to your cyber security

  • Bulletproof are CREST approved

    CREST approved

  • Bulletproof are ISO 27001 and 9001 certified

    ISO 27001 and 9001 certified

  • Bulletproof are Tigerscheme qualified testers

    Tigerscheme qualified testers

  • Bulletproof are a PCI DSS v3.2 Level 1 service provider

    PCI DSS v3.2 Level 1
    service provider

  • Bulletproof have 24/7 on-site Security Operations Centre

    24/7 on-site Security
    Operations Centre

Get a quote today

If you’re interested in our services, get a free, no obligation quote today by filling out the form below.

By submitting this form, I agree to the Bulletproof privacy policy.