Compliance tools · Cybersecurity and data protection

ePrivacy Directive compliance tool

Directive 2002/58/EC · European Union · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your ePrivacy Directive documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

ePrivacy Directive is Directive 2002/58/EC, a binding instrument in the European Union. Cookies, electronic marketing and communications confidentiality rules.

The free assessment screens for ePrivacy Directive when a business operates online or provides digital services.

Sectors this instrument reaches: electronic communications providers.

Screen your business against all 116 agent toolkits, free →

• Your exact position under ePrivacy Directive: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that ePrivacy Directive applies to your business, free →

Does ePrivacy Directive apply to my business?

The directive applies to you if you provide publicly available electronic communications services or public communications networks, or if you use automated calling systems, facsimile machines or electronic mail for direct marketing (Article 13). It also covers undertakings providing connection to such networks or services, and undertakings with universal service obligations (Article 1(7) amending Article 8(3) of Directive 2002/22/EC).

Who does ePrivacy Directive apply to?

It applies to providers of publicly available electronic communications services and public communications networks, undertakings providing connection to those networks or services, undertakings designated as having universal service obligations, and any natural or legal person using automated calling systems, facsimile machines or electronic mail for direct marketing (Article 13). End-users, including consumers, are the beneficiaries of its protections.

Does ePrivacy Directive apply to a small business?

The directive sets no size threshold and no small business exemption. Recital 21 and amended Article 20 of Directive 2002/22/EC extend contract rights normally reserved for consumers to other end-users including micro enterprises and SMEs upon their request, and Member States must promote awareness of this possibility among SMEs.

When does ePrivacy Directive apply from, and what are the deadlines?

The original directive was published and entered into force on 31 July 2002 (Article 20), with Member State transposition due by 31 October 2003 (Article 17(1)). The 2009 amendments entered into force on 19 December 2009 (Article 5 of Directive 2009/136/EC), with transposition due by 25 May 2011 (Article 4(1) of Directive 2009/136/EC).

What does ePrivacy Directive require me to do?

You must adopt and maintain a security policy for personal data processing (Article 4(1a)), notify breaches without undue delay (Article 4(3)), erase or anonymise traffic data after transmission (Article 6), obtain consent for cookies and terminal equipment access (Article 5(3)), and obtain prior consent for automated direct marketing (Article 13(1)).

What records or documents does ePrivacy Directive require me to keep or produce?

You must maintain a breach inventory covering the facts, effects and remedial action for each personal data breach (Article 4(4)). You must also establish internal procedures for responding to law enforcement access requests and supply the competent national authority, on demand, with information about those procedures, the number of requests, the legal justification and your response (Article 15(1b)).

What happens if I do not comply with ePrivacy Directive?

Member States must lay down penalties, including criminal sanctions where appropriate, that are effective, proportionate and dissuasive (Article 15a(1)). Competent national authorities may order the cessation of infringements (Article 15a(2)) and may impose sanctions for failure to comply with breach notification obligations. Penalties vary significantly between Member States.

Does ePrivacy Directive apply to a UK business selling into the EU?

The territorial scope of the directive is the European Union, and as a directive it applies through the national transposition measures of each Member State. The instrument does not state how it applies to a UK business selling into the EU.

How do I start complying with ePrivacy Directive?

The first practical step is to adopt and maintain a security policy with respect to the processing of personal data (Article 4(1a) of Directive 2002/58/EC, as inserted by the 2009 amendments). That policy must restrict personal data access to authorised personnel for legally authorised purposes.

Which ComplianceSME account includes the ePrivacy Directive toolkit?

The ePrivacy Directive agent toolkit is included from the Micro level.

Related in cybersecurity and data protection: GDPR · NIS2 Directive · CER Directive · DORA