DUAA 2025 and the new £17.5m PECR fines

From 5 February 2026, the maximum fine for breaching the UK’s Privacy and Electronic Communications Regulations (PECR) rose from £500,000 to £17.5 million or 4% of total worldwide annual turnover, whichever is higher. The change came from section 115 and Schedule 13 of the Data (Use and Access) Act 2025 (DUAA), and it covers the email marketing rule (reg 22) and the identity and opt-out rule (reg 23). The rules on who you may email did not change. The cost of getting them wrong did, by a factor of about 35.

The timeline

• 19 June 2025: the Data (Use and Access) Act 2025 received Royal Assent.
• 5 February 2026: most of Part 5, including the PECR enforcement changes, came into force under the DUAA (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82).
• 19 June 2026: controllers had to have a process for handling data protection complaints.
• 30 September 2026: the office of the Information Commissioner was abolished and its functions moved to the new Information Commission. The ICO’s guidance and enforcement powers continue under the new body.

What the higher maximum covers

Section 115 of DUAA replaced Schedule 1 to PECR. Paragraph 18 of the new schedule applies the higher maximum amount from section 157 of the Data Protection Act 2018 to PECR regulations 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23 and 24. For email marketers the two that matter most are:

• Regulation 22: unsolicited marketing email to individual subscribers needs prior consent or the soft opt-in.
• Regulation 23: every marketing email must identify the sender and give a valid address for opting out.

The ICO also gained new PECR investigatory powers, including interview notices and technical reports. A regulator with those powers is more likely to ask how you decided a particular address was a business, and to expect an answer for that address rather than a general policy.

What did not change

The core email rules are the same as before. Consent or the soft opt-in is still required for individual subscribers. The reg 22 consent rule still does not apply to corporate subscribers, such as companies, LLPs and Scottish partnerships. Reg 23 still applies to everyone. ICO guidance still says that if you are unsure whether an address belongs to a corporate or an individual subscriber, you should treat it as an individual.

Two legitimate interests changes that are often confused

DUAA made two separate changes to UK GDPR lawful bases, and they are easy to mix up.

• Article 6(11), added by section 70. It lists processing necessary for direct marketing as an example of processing that may be necessary for a legitimate interest. This is not automatic. You still need to identify the purpose, show the processing is necessary and balance it against the person’s interests.
• Recognised legitimate interests, Article 6(1)(ea) and Schedule 4. A new lawful basis that needs no balancing test, but it covers only a short list of purposes such as national security, emergencies, crime and safeguarding. Direct marketing is not on that list.

The ICO updated its legitimate interests guidance on 23 March 2026. It says legitimate interests can apply to direct marketing only where PECR does not require consent. So the order of questions is: first PECR (is this a corporate subscriber?), then UK GDPR (is my use of this person’s data fair and balanced?).

A change for charities only

DUAA also created a new charity soft opt-in in reg 22(3A). It applies only to charities, and only to contact details collected on or after 5 February 2026 from people who expressed interest in or supported the charity’s purposes. Commercial senders cannot use it.

What this means for B2B senders

When the maximum fine was £500,000, many businesses treated PECR risk as small. At £17.5 million or 4% of worldwide turnover, it becomes a question for boards and investors. The safest way to keep B2B email open as a channel is to know, for each address, whether the recipient is a corporate subscriber, and to keep a record of how you decided.

PECR Check returns a verdict for each address with reason codes, the Companies House number and status behind the domain, a policy version and an audit ID linked to a stored evidence record. There is no due diligence defence in PECR, so the record does not make a breach lawful. It does let you show your working. It is a classification with evidence, not legal advice.