Email & SMS Marketing (PECR) Compliance Check

Why this matters

The Privacy and Electronic Communications Regulations (PECR) govern every marketing email, text and automated call a UK business sends. Unlike UK GDPR’s broader “legitimate interest” grounds, PECR generally requires specific opt-in consent before marketing individuals — with one key exception, the “soft opt-in”, which lets you email existing customers about similar products or services without fresh consent, provided you gave them a clear chance to opt out at the point of collection and in every message since. Sole traders and some partnerships are treated as individuals under PECR, so B2B lists built from scraped contact details or bought data are a common, often unrecognised compliance gap.

Enforcement has sharpened. The Data (Use and Access) Act 2025 raised the maximum fine the ICO can issue for PECR breaches from £500,000 to the same level as UK GDPR — up to £17.5 million or 4% of global annual turnover, whichever is higher. The ICO has continued to take action against businesses sending marketing without valid consent, without a working unsubscribe option, or continuing to message people after they’ve opted out. Every marketing email or SMS must also clearly identify the sender and provide a straightforward way to opt out, and consent records need to be kept to demonstrate compliance if challenged.

What you'll need

• How your business currently collects marketing consent (website forms, checkout, in-store, etc.)
• Whether your contact list includes purchased, scraped or third-party data
• Your current unsubscribe/opt-out process for email and SMS
• Records of consent given by contacts on your list (if any)

What you'll get

A personalised compliance report covering: a score out of 100, an executive summary, a list of findings ranked by severity, and a prioritised action plan with timeframes.