United KingdomPECR, Automated Calls, Facsimile and Live Telephone Calls for Direct Marketing
PECR (S.I. 2003/2426), regs. 19-21, 21A, 21B and 24
In force since .
A telephone contact rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
What it requires
- These duties reach only calls and faxes made for direct marketing purposes; a purely informational or service call is outside them.
- Get the called subscriber's prior consent before transmitting, or instigating the transmission of, recorded matter for direct marketing purposes by an automated calling or communication system (one that can automatically dial a sequence of numbers and play sounds that are not live speech), and either do not prevent presentation of your calling line's identity or present a line on which you can be contacted.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1
- Do not transmit, or instigate the transmission of, an unsolicited direct-marketing fax to an individual subscriber unless they have consented, to a corporate subscriber who has told you not to, or to any subscriber whose number is listed on the fax-marketing register the Information Commission keeps, unless that subscriber has since told you they do not object.NIST Privacy FrameworkCT.PO-P3
- Do not use, or instigate the use of, a public electronic communications service to make an unsolicited live call for direct marketing purposes to a subscriber who has registered an objection to such calls on that line, or who has told you directly not to call, unless they have since told you they do not object.NIST Privacy FrameworkCT.PO-P3
- Whether or not the call is solicited, do not prevent presentation of your calling line's identity, or present a line on which you can be contacted, when making a call for direct marketing purposes.NIST Privacy FrameworkCM.AW-P1
- Get the called individual's prior consent before making an unsolicited call marketing claims management services; there is no do-not-call-register or existing-customer exception for this subject.NIST Privacy FrameworkCT.PO-P1
- Do not make an unsolicited call marketing occupational or personal pension schemes unless you are an authorised person or a scheme's trustee or manager and the individual has consented, or has an existing client relationship with you in which they might reasonably expect such calls and has been given a simple, free means of refusing both at collection and with every later call.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- When you use an automated calling system or a fax for direct marketing, give your name and either your address or a telephone number where you can be reached free of charge; for a live call, give your name and, if the recipient asks, that address or number.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text. Also read by: Information Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
The PEC Regulations' own enforcement route (reg. 31 and Sch. 1) applies Data Protection Act 2018 s.157 with modifications. Schedule 1 paragraph 18(b)(ii), as substituted by the Data (Use and Access) Act 2025, Sch. 13 (in force under S.I. 2026/82, reg. 2(z14)), gives a failure to comply with regulation 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23, 24 or 32B(4) or (5) the higher maximum amount defined at Data Protection Act 2018 s.157(5): the greater of £17,500,000 or 4 percent of worldwide annual turnover for an undertaking, or £17,500,000 for anyone else. Every other PEC Regulations contravention keeps the lower, standard maximum amount under s.157(6) (the greater of £8,700,000 or 2 percent, or £8,700,000).
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 17,500,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information Commission, exercising the enforcement powers Schedule 1 applies to it under regulation 31 of the Regulations.
Enforcement record
The Information Commissioner's Annual Report and Financial Statements 2025/26, covering to , states that the regulator issued 10 monetary penalty notices totalling £1,445,000 and 10 enforcement notices for breaches of PECR. The count of 20 adds the penalty notices and the enforcement notices, and it covers every regulation of PECR rather than only the regulations this row carries.
- As of
- Currency
- GBP
- Source link
- https://ico.org.uk/media2/ybsi5n0j/ico-annual-report-202527.pdf
- Fines per year
- 1,445,000
- Actions per year
- 20
Settledness
- As of
- Guidance link
- https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/telephone-marketing/
- Guidance body
- Information Commission
- Open questions
- Does a call in which software generates humanlike speech in real time transmit 'sounds which are not live speech' within an 'automated calling system' under regulation 19(4) of PECR, when the Information Commission's guidance describes an automated call as one that 'plays a recorded message'?
What this law does
These provisions reach only a call or fax made for direct marketing purposes, not a purely informational or service call. Regulation 19 requires the called subscriber's prior consent before transmitting recorded matter for direct marketing purposes by an automated calling or communication system, and either presenting the calling line's identity or an alternative contact number.
Regulation 20 bars an unsolicited direct-marketing fax to an individual subscriber unless they consented, to a corporate subscriber who has objected, or to any subscriber whose number is on the fax-marketing register kept under regulation 25. The Information Commission keeps that register. Regulation 21 bars an unsolicited live telephone call for direct marketing to a subscriber who has registered an objection under regulation 26 or told the caller directly not to call.
Every direct-marketing call, solicited or unsolicited, must present a working calling-line identity or an alternative contact number. Regulation 21A requires the called individual's prior consent for an unsolicited call marketing claims management services, with no do-not-call-register exception.
Regulation 21B lets only an authorised person or a scheme's trustee or manager make an unsolicited call marketing occupational or personal pension schemes, and only with that consent or within an existing client relationship that carries a standing free means to object, again whatever the register says.
Regulation 24 requires a caller using an automated system or fax to give their name and either an address or a freephone number, and a live caller to give their name and, on request, that address or number.
When LexLint raises it
When your app profile says your app places automated calls or sends faxes.
Back to the example · Lint your app
Page updated .