PECRUK · S.I. 2003/2426
Digiphile
PECR – The Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426) – Regulation 5C – Personal data breach: enforcement

Regulations

Regulation 5C[F1Personal data breach: enforcement

(1) If a service provider fails to comply with the notification requirements of regulation 5A, the Information Commissioner may issue a fixed monetary penalty notice in respect of that failure.
(2) The amount of a fixed monetary penalty under this regulation shall be £1,000.
(3) Before serving such a notice, the Information Commissioner must serve the service provider with a notice of intent.
(4) The notice of intent must—
  • (a)
    state the name and address of the service provider;
  • (b)
    state the nature of the breach;
  • (c)
    indicate the amount of the fixed monetary penalty;
  • (d)
    include a statement informing the service provider of the opportunity to discharge liability for the fixed monetary penalty;
  • (e)
    indicate the date on which the Information Commissioner proposes to serve the fixed monetary penalty notice; and
  • (f)
    inform the service provider that he may make written representations in relation to the proposal to serve a fixed monetary penalty notice within the period of 21 days [F2beginning when the notice of intent is served].
(5) A service provider may discharge liability for the fixed monetary penalty if he pays to the Information Commissioner the amount of £800 within [F3the period of 21 days beginning when the notice of intent is received].
(6) The Information Commissioner may not serve a fixed monetary penalty notice until the time within which representations may be made has expired.
(7) The fixed monetary penalty notice must state—
  • (a)
    the name and address of the service provider;
  • (b)
    details of the notice of intent served on the service provider;
  • (c)
    whether there have been any written representations;
  • (d)
    details of any early payment discounts;
  • (e)
    the grounds on which the Information Commissioner imposes the fixed monetary penalty;
  • (f)
    the date by which the fixed monetary penalty is to be paid; and
  • (g)
    details of, including the time limit for, the service provider’s right of appeal against the imposition of the fixed monetary penalty.
(8) A service provider on whom a fixed monetary penalty is served may appeal to the Tribunal against the issue of the fixed monetary penalty notice.
(9) Any sum received by the Information Commissioner by virtue of this regulation must be paid into the Consolidated Fund.
(10) In England and Wales F4..., the penalty is recoverable—
  • (a)
    if [F5the county court] so orders, as if it were payable under an order of that court;
  • (b)
    if the High Court so orders, as if it were payable under an order of that court.
(11) In Scotland, the penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.
(12) [F6 In Northern Ireland, the penalty is recoverable—
  • (a)
    if a county court so orders, as if it were payable under an order of that court;
  • (b)
    if the High Court so orders, as if it were payable under an order of that court.
(13) The Secretary of State may by regulations made by statutory instrument amend this regulation so as to substitute a different amount for the amount for the time being specified in paragraph (2) or (5).
(14) Regulations under paragraph (13) may make transitional provision.
(15) Before making regulations under paragraph (13), the Secretary of State must consult—
  • (a)
    the Information Commissioner, and
  • (b)
    such other persons as the Secretary of State considers appropriate.
(16) A statutory instrument containing regulations under this regulation may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.]]

Amended text

This Regulation is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 19 September 2026, ELI), as incorporated in the text in force on 19 September 2026 as published on legislation.gov.uk.

Amendment in force, not yet in the text

The following amendment(s) to this Regulation are now in force, but legislation.gov.uk had not incorporated them in the text in force on 19 September 2026 that this page reproduces, so the text above does not yet show them:

  • reg. 5C(1): words substituted by S.I. 2026/386, Sch. 3, para. 6(3), para. 6(4)(b); commencement: reg. 1(2)
  • reg. 5C(3): words substituted by S.I. 2026/386, Sch. 3, para. 6(3), para. 6(4)(b); commencement: reg. 1(2)
  • reg. 5C(4)(e): words substituted by S.I. 2026/386, Sch. 3, para. 6(3), para. 6(4)(b); commencement: reg. 1(2)
  • reg. 5C(5)(6): words substituted by S.I. 2026/386, Sch. 3, para. 6(3), para. 6(4)(b); commencement: reg. 1(2)
  • reg. 5C(7)(e): words substituted by S.I. 2026/386, Sch. 3, para. 6(3), para. 6(4)(b); commencement: reg. 1(2)
  • reg. 5C(9): words substituted by S.I. 2026/386, Sch. 3, para. 6(3), para. 6(4)(b); commencement: reg. 1(2)
  • reg. 5C(15)(a): words substituted by S.I. 2026/386, Sch. 3, para. 6(3), para. 6(4)(b); commencement: reg. 1(2)

Note: S.I. 2026/386 came into force on 30 September 2026 (reg. 1(2)), when section 119 of the Data (Use and Access) Act 2025 was fully brought into force by S.I. 2026/1015, reg. 2.

Annotations

Textual Amendments

  1. F1 Regs. 5A-5C inserted (26.5.2011) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (S.I. 2011/1208), regs. 1(1), 5
  2. F2 Words in reg. 5C(4)(f) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(2)(a), 142(1); S.I. 2025/904, reg. 2(p)
  3. F3 Words in reg. 5C(5) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(2)(b), 142(1); S.I. 2025/904, reg. 2(p)
  4. F4 Words in reg. 5C(10) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 115(4)(a)(i), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)
  5. F5 Words in reg. 5C(10)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 115(4)(a)(ii), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)
  6. F6 Reg. 5C(12)-(16) inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 115(4)(b), 142(1)(2)(h) (with s. 115(10)); S.I. 2026/82, reg. 2(y) (with regs. 8-11)

https://pecr.digiphile.law/article/article-5C.html

Text as at 19 September 2026.

This is an unofficial convenience version of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.

Type to search the full text.