The Data Use and Access Act 2025 (DUAA) has brought a notable change to UK electronic marketing law, shifting the risk profile for compliance. From 5 February 2026, organisations can face fines of up to £17.5 million, or 4% of annual global turnover, for serious breaches of the Privacy and Electronic Communications Regulations (PECR).
Whilst many organisations have focused heavily on the UK General Data Protection Regulation (GDPR) in recent years, PECR deserves equal attention. Marketing emails, cookies, and online tracking remain areas of active regulatory interest and can expose organisations to substantial financial penalties if overlooked.