PECR – The Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426) – Regulation 32A – Codes of conduct
Regulations
Regulation 32A[F1Codes of conduct
(1) The [F2Commission] must encourage representative bodies to produce codes of conduct intended to contribute to compliance with these Regulations.
(2) Under paragraph (1), the [F2Commission] must encourage representative bodies to produce codes which take account of, among other things, the specific features of different sectors.
(3) A code of conduct described in paragraph (1) may, for example, make provision with regard to—
- (a)rights and obligations under these Regulations;
- (b)out-of-court proceedings and other dispute resolution procedures for resolving disputes arising in connection with these Regulations.
(4) The [F3Commission] must encourage representative bodies to submit codes of conduct described in paragraph (1) to the [F3Commission] in draft.
(5) Where a representative body does so, the [F3Commission] must—
- (a)provide the representative body with an opinion on whether the code correctly reflects the requirements of these Regulations,
- (b)decide whether to approve the code, and
- (c)if the code is approved, register and publish the code.
(6) The [F3Commission] may only approve a code if, among other things—
- (a)the code contains a mechanism for monitoring whether persons who undertake to apply the code comply with its provisions, and
- (b)in relation to persons other than public bodies, the mechanism involves monitoring by a body which is accredited for that purpose by the [F3Commission] under regulation 32B.
(7) In relation to amendments of a code of conduct that is for the time being approved under this regulation—
- (a)paragraphs (4) and (5) apply as they apply in relation to a code, and
- (b)the requirements in paragraph (6) must be satisfied by the code as amended.
(8) A code of conduct described in paragraph (1) may be contained in the same document as a code of conduct described in Article 40 of the UK GDPR (and a provision contained in such a document may be a provision of both codes).
(9) In this regulation—
- “public body” has the meaning given in section 7 of the Data Protection Act 2018 (for the purposes of the UK GDPR);
- “representative body” means an association or other body representing categories of—
- (a)communications providers, or
- (b)other persons engaged in activities regulated by these Regulations;
- (a)
- “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.]
Amended text
This Regulation is shown as amended by Data (Use and Access) Act 2025; S.I. 2026/386 (see the annotations below), as incorporated in the text in force on 5 November 2026 as published on legislation.gov.uk.
Annotations
Textual Amendments
- F1 Regs. 32A-32C inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 116(2), 142(1); S.I. 2026/82, reg. 2(z)
- F2 Word in reg. 32A(1)(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 6(3)(4)(h); S.I. 2026/1015, reg. 2(c)
- F3 Word in reg. 32A(4)-(6) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 6(3)(4)(h); S.I. 2026/1015, reg. 2(c)
https://pecr.digiphile.law/article/article-32A.html
Text as at 5 November 2026.
This is an unofficial convenience version of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in November 2026.