United KingdomPECR, Electronic Mail for Direct Marketing Purposes
PECR (S.I. 2003/2426), regs. 22 and 23
In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
What it requires
- Get the individual recipient's prior consent before sending, or instigating the sending of, unsolicited electronic mail, which reaches SMS and other messaging as well as email, for direct marketing purposes, unless the soft opt-in below applies.NIST Privacy FrameworkCT.PO-P1
- You do not need consent if you obtained the recipient's contact details in the course of a sale or sale negotiation with them, you market only your own similar products or services, and you gave the recipient a simple, free means of opting out at the time the details were collected and with every later message.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- From , a charity does not need consent to email or text someone to further its own charitable purposes if it obtained their details because they expressed an interest in, or offered or gave support to, those purposes, and gave them a simple, free means of refusing at collection and with every later message.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Do not disguise or conceal the identity of the person on whose behalf a marketing message is sent, and always provide a valid address the recipient can use to ask you to stop.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
- Do not send a marketing message that breaks the Electronic Commerce (EC Directive) Regulations 2002's identification rules for commercial communications, or that encourages the recipient to visit a website that breaks them.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text. Also read by: Information Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
The PEC Regulations' own enforcement route (reg. 31 and Sch. 1) applies Data Protection Act 2018 s.157 with modifications. Schedule 1 paragraph 18(b)(ii), as substituted by the Data (Use and Access) Act 2025, Sch. 13 (in force under S.I. 2026/82, reg. 2(z14)), gives a failure to comply with regulation 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23, 24 or 32B(4) or (5) the higher maximum amount defined at Data Protection Act 2018 s.157(5): the greater of £17,500,000 or 4 percent of worldwide annual turnover for an undertaking, or £17,500,000 for anyone else. Every other PEC Regulations contravention keeps the lower, standard maximum amount under s.157(6) (the greater of £8,700,000 or 2 percent, or £8,700,000).
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 17,500,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information Commission, exercising the enforcement powers Schedule 1 applies to it under regulation 31 of the Regulations.
Enforcement record
The Information Commissioner's Annual Report and Financial Statements 2025/26, covering to , states that the regulator issued 10 monetary penalty notices totalling £1,445,000 and 10 enforcement notices for breaches of PECR. The count of 20 adds the penalty notices and the enforcement notices, and it covers every regulation of PECR rather than only the regulations this row carries.
- As of
- Currency
- GBP
- Source link
- https://ico.org.uk/media2/ybsi5n0j/ico-annual-report-202527.pdf
- Fines per year
- 1,445,000
- Actions per year
- 20
Settledness
- As of
- Guidance link
- https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/
- Guidance body
- Information Commission
- Open questions
- Does the Information Commission's statement that the soft opt-in 'does not apply to non-commercial promotions (eg charity fundraising or political campaigning)' still hold for a charity, now that regulation 22(3A) of PECR gives a charity a soft opt-in?
What this law does
Regulation 22 requires an individual subscriber's prior consent before sending, or instigating the sending of, unsolicited electronic mail (a term that reaches SMS and other messaging, not only email) for direct marketing purposes, unless a soft opt-in applies because the sender obtained the recipient's details in a sale or sale negotiation, markets only its own similar products or services, and gave the recipient a free opt-out at collection and with every later message.
Since the Data (Use and Access) Act 2025 gives a charity the same soft opt-in where it obtained the recipient's details because the recipient expressed interest in, or offered support for, the charity's own charitable purpose, on the same free opt-out terms.
Regulation 23 separately bars sending a direct-marketing email that disguises or conceals the sender's identity or that omits a valid address for the recipient to ask that such communications stop, and bars one that would contravene, or that encourages a visit to a website that would contravene, the labelling and identification rules of the Electronic Commerce (EC Directive) Regulations 2002.
When LexLint raises it
When your app profile says your app sends automated outreach, sends automated texts or sends commercial email.
Back to the example · Lint your app
Page updated .