PECR Self-Assessment Tool

Kick-start your PECR compliance project

The PECR implement the EU’s ePrivacy Directive (also known as the ‘cookies law’) into UK law and set out privacy rights relating to electronic communications used for marketing purposes.

The PECR apply to:

• Electronic marketing communications, including via automated or live calls, texts, emails and faxes;
• The use of cookies or other tracking technologies; and
• The privacy of users or subscribers of electronic communications services.

Penalties for PECR non-compliance include criminal prosecution, non-criminal enforcement and monetary penalties, which can be issued by the ICO (Information Commissioner’s Office). A recent PECR amendment means directors – in addition to the organisation itself – can be personally fined up to £500,000.

This PECR Self-Assessment Tool has been created to help organisations kick-start their PECR compliance project by assessing their current stance against the Regulations and the relevant parts of the GDPR (General Data Protection Regulation), helping them establish areas for development, and plan and prioritise their project effectively.

Why choose the PECR Self-Assessment Tool?

• Easy-to-use, cost-effective DIY solution to PECR compliance, suitable for non-experts.
• Consists of more than 100 straightforward, granular yes–no questions, with optional tooltips for extra guidance.
• Get a visual overview of your PECR compliance with a high-level colour-coded analysis.
• Created by data privacy specialists.
• Delivered in Excel format and will work in any Microsoft environment; the tool does not need to be installed like software and does not depend on complex databases.

* Designed for non-service/non-network providers only. If your organisation is a service or network provider, you will need to use our PECR Audit service.

Note that the PECR overlap with the GDPR and so, where relevant, the PECR Self-Assessment Tool asks about GDPR compliance. However, complying with one law does not automatically guarantee compliance with the other – each law stipulates rules that the other does not.

For instance, the PECR’s marketing rules apply even if the person you are contacting cannot be identified (e.g. by dialling numbers at random, or in B2B marketing), whereas the GDPR protects only natural, living persons who can be identified.

If you need expert help after conducting your self-assessment, or would like to address full GDPR and PECR compliance together, please contact our data privacy consultancy team.