Compliance tools · Cybersecurity and data protection

PECR 2003 compliance tool

SI 2003/2426 · United Kingdom · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your PECR 2003 documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

PECR 2003 is SI 2003/2426, a binding instrument in the United Kingdom. UK cookies and electronic marketing rules, enforced alongside UK GDPR.

The free assessment screens for PECR 2003 when a business operates online or provides digital services, or handles personal data.

Screen your business against all 116 agent toolkits, free →

• Your exact position under PECR 2003: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that PECR 2003 applies to your business, free →

Does PECR 2003 apply to my business?

PECR 2003 applies to you if you use electronic mail, automated calling systems, fax or telephone for direct marketing, or if you operate a website or mobile application that uses cookies or similar tracking technologies, or if you provide public electronic communications services. The Regulations also cover any person storing or accessing information in the terminal equipment of a subscriber or user (regulation 6(1)).

Who does PECR 2003 apply to?

The Regulations apply to providers of public electronic communications services and networks, communications providers within the meaning of section 405 of the Communications Act 2003, persons using electronic communications services for direct marketing, subscribers, users, and any person storing or accessing information in terminal equipment. A subscriber is a person who is party to a contract with a provider of public electronic communications services (regulation 2(1)).

Does PECR 2003 apply to a small business?

The instrument has no size threshold. Any business using electronic mail, automated calling systems, fax or telephone for direct marketing is directly regulated regardless of size, and any business providing public electronic communications services, however small, carries the full security and breach notification regime in regulation 5 and 5A.

When does PECR 2003 apply from, and what are the deadlines?

The Regulations came into force on 11 December 2003 (regulation 1). A service provider must notify a personal data breach to the Information Commissioner without undue delay and, where feasible, not later than 72 hours after becoming aware of it (regulation 5A(2)), and must notify affected subscribers and users without undue delay (regulation 5A(3)).

What does PECR 2003 require me to do?

You must take appropriate technical and organisational measures to safeguard the security of a public electronic communications service, including a documented security policy (regulation 5(1) and 5(1A)), notify personal data breaches to the Commissioner within 72 hours (regulation 5A(2)), and obtain consent before storing or accessing information in terminal equipment (regulation 6(1)). Direct marketing by electronic mail, fax, automated calling and telephone carries its own consent and register check duties (regulations 19 to 24).

What records or documents does PECR 2003 require me to keep or produce?

You must maintain a standing inventory of every personal data breach sufficient to let the Commissioner verify compliance (regulation 5A). Communications providers must establish and maintain internal procedures for responding to access requests made under the national security exemption (regulation 28) and the legal requirement, law enforcement and legal proceedings exemption (regulation 29), and provide the Commissioner, on demand, with information about those procedures, the volume of requests, their legal justification, and the provider's response (regulation 29A).

What happens if I do not comply with PECR 2003?

Infringements of regulations 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23, 24, or 32B(4) or (5) attract the higher maximum amount under Schedule 16 of the Data Protection Act 2018, as applied with modifications by Schedule 1. Failure to comply with the regulation 5A breach notification requirements attracts a fixed monetary penalty of £1,000, reducible to £800 if paid within 21 days beginning when the notice of intent is received (regulation 5C(5)).

How do I start complying with PECR 2003?

The first practical step is to take appropriate technical and organisational measures to safeguard the security of the service, including a documented security policy (regulation 5(1) and 5(1A)).

Which ComplianceSME account includes the PECR 2003 toolkit?

The PECR 2003 agent toolkit is included from the Micro level.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive