The Data (Use and Access) Act 2025 and your texts

On 5 February 2026 the ceiling on a fine for a marketing text that breaks the rules went from £500,000 to £17.5 million, or 4% of worldwide turnover if that comes to more. Same regulations and the same regulator, with a ceiling 35 times higher. That's the one line from the Data (Use and Access) Act 2025 that anyone who texts customers needs to know, and the rest of what the Act did to texting fits on a page.

The Act itself is a long one. It got Royal Assent on 19 June 2025 and its long title runs from "access to customer data and business data" through digital verification, registers of births and deaths, the new Information Commission and, near the end, "the creation of purported intimate images". The part that touches a text message is small: Chapter 2 of Part 5, sections 109 to 116, headed "Privacy and electronic communications". Those eight sections amend the Privacy and Electronic Communications (EC Directive) Regulations 2003, which the Act calls "the PEC Regulations" and everyone else calls PECR. PECR is the law that says who you may text with marketing and what the text has to carry, so eight short sections are where every change for business texting lives.

The fine ceiling: from £500,000 to £17.5 million

Until February this year the biggest penalty the ICO could issue for breaking PECR was £500,000. The number came from an unglamorous place. Regulation 2 of the Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 set "the prescribed amount for the purposes of section 55A(5)" of the old Data Protection Act 1998 at £500,000, and PECR borrowed that machinery for its own fines. Data protection fines moved to a different scale with the Data Protection Act 2018. PECR's didn't, which is why a text marketing fine has sat at £500,000 or under since 2010 while a data protection fine could run to eight figures.

Section 115 of the 2025 Act closes the gap. It replaces regulation 31 of PECR and swaps PECR's Schedule 1 for the one in Schedule 13 of the Act, which applies "certain provisions of Parts 5 to 7 of the Data Protection Act 2018" to PECR, with modifications. Part 6 of the 2018 Act is where the penalty amounts are. Section 157 sets a "higher maximum amount" of £17,500,000 or 4% of total annual worldwide turnover, whichever is higher, and a "standard maximum amount" of £8,700,000 or 2%. The ICO's summary of the changes says the aim is to bring PECR into line with UK GDPR so that "enforcement mechanisms and penalties are the same in most cases", and its blog of 23 June 2026 puts it in plain figures: fines under PECR of up to £17.5 million or 4% of global turnover.

Will the ICO start issuing £17 million fines for texts? Not quickly. The same June 2026 blog says the ICO is "currently developing separate guidance to cover these higher fines", that its draft enforcement procedural guidance sets out how it means to use the new powers, and that the final version will come "in due course". The pattern in our post on what the ICO's text marketing penalty notices say is the better guide to what a typical case has cost so far. What's changed is the ceiling, and the ceiling is what a tribunal, an insurer and a board look at.

A text that never arrives still counts

The quieter change is in section 110, and it's the one I'd flag to anyone running a list. The Act rewrites the definitions at the front of PECR. "Communication" now covers "information that has been transmitted", "call" now covers "attempts to make a connection via a telephone call", and "recipient" now includes an intended recipient. The government's factsheet on the PEC Regulations, published 27 June 2025, spells out why. Under the old wording, which spoke of communications "exchanged or conveyed", a sender could argue that a breach needed the message to connect. Now an infringement of the direct marketing rules can happen "even if the call or message does not connect".

For texting that matters more than it sounds. Take a campaign to 50,000 numbers where 8,000 fail (dead SIMs, numbers that were never mobiles, handsets switched off for longer than the validity period). It used to leave an argument about whether those 8,000 were ever "sent" in PECR's sense. The argument has gone. What counts is what you instigated, so the number on a penalty notice is the number you loaded, and the only defence is the consent behind each one.

The definition of direct marketing is now pinned to the Data Protection Act 2018 one as well: "the communication (by whatever means) of advertising or marketing material which is directed to particular individuals". It was the ICO's working definition already, so nothing moves in practice. A service text (your table is booked, your parcel is on its way) stays outside it, and a "20% off this weekend" tacked on the end pulls the whole text inside it.

The charity soft opt-in

Section 114 adds a new paragraph (3A) to regulation 22 of PECR, in force since 5 February 2026 (the ICO's own page had expected it in January). It gives charities something commercial senders have had since 2003: a way to send marketing by electronic mail, which in PECR takes in texts (the factsheet says "marketing emails and texts"), to people who never ticked a consent box, provided three conditions all hold.

First, "the sole purpose of the direct marketing is to further one or more of the charity's charitable purposes". Second, the charity got the person's details while they were expressing an interest in those purposes, or offering or providing support for them. Third, the person was given a simple, free way to refuse when their details were first collected, and gets the same chance in every message after that. The new paragraph (5) defines a charity as one under the Charities Act 2011, the Charities Act (Northern Ireland) 2008 or a body on the Scottish Charity Register.

The second and third conditions carry a sting for anyone hoping to point this at an old database. The opt-out has to have been offered when the details were first collected. A list built in 2019 from event sign-ups with no opt-out line on the form can't be brought under (3A) now, because the condition is about what happened then. Our post on charity texting and the new soft opt-in goes through the wording and the Fundraising Regulator's position in more detail.

What stays the same

Most of PECR is untouched, and the untouched part is the part most businesses fall foul of.

Regulation 22(2) still says a person "shall neither transmit, nor instigate the transmission of" unsolicited marketing by electronic mail to an individual subscriber without prior consent. The commercial soft opt-in in 22(3) still has its three conditions: details obtained "in the course of the sale or negotiations for the sale of a product or service", marketing "in respect of that person's similar products and services only", and a simple means of refusing at the point of collection and in every message. Regulation 23 still bans marketing where the sender's identity "has been disguised or concealed" or where "a valid address to which the recipient of the communication may send a request that such communications cease" hasn't been provided. That's where the name at the front of the text and the "Reply STOP to opt out" line come from, and neither became optional in February.

Two smaller changes are worth a sentence each. Section 111 extends the time a telecoms provider has to report a personal data breach from 24 hours to "not later than 72 hours after having become aware of it", which is a duty on network operators; the businesses that text through them aren't touched by it. Section 116 lets a trade body write a PECR code of conduct for its sector and put it to the ICO for approval, and a member can then use adherence to an approved code "as a means of demonstrating its compliance with PECR". Whether anyone writes one for business texting remains to be seen. If they do, it'll be the nearest thing to a checklist PECR has ever had.

The dates

The Act came in by stages, and the government's commencement page (last updated 12 October 2026) lists them. The ones that matter for texting:

• 19 June 2025: Royal Assent. Section 142 brought a handful of provisions in on the day, none of them about PECR.
• 20 August 2025: stage one, mostly technical provisions and the ICO's new statutory objectives, under the Commencement No. 1 Regulations.
• 5 February 2026: the Commencement No. 6 Regulations (SI 2026/82) brought in sections 110, 112, 114, 115 and 116 and Schedules 12 and 13 "so far as not already in force". That's the new definitions, the cookie rules, the charity soft opt-in, the enforcement powers and the codes of conduct, all on one day, alongside most of the rest of Part 5.
• June 2026: the duty on organisations to have a complaints procedure, which the commencement page gives as about twelve months after Royal Assent.
• 30 September 2026: the ICO's office is abolished and its functions pass to the Information Commission.

So the body that enforces PECR has had a new name for a little over a fortnight as I write this, and the higher fine ceiling has been live for eight months. As of the ICO's June update, the guidance on how it'll use that ceiling was still being written.

What to do about it

Nothing in the Act asks a careful sender to change a text. It raises the price of a careless one. Four things worth doing this month.

Check the consent behind every number on your marketing list, and write down where each one came from. If a number came in through a sale, you're on the soft opt-in and can only text about similar products. If it came from anywhere else you need the consent record, and "they gave us their number" isn't one. The rules are laid out in our guide to SMS marketing rules in the UK.

Separate service texts from marketing texts, in your templates and in your head. "Crown Dental: your check-up is on Thu 19 Nov at 10:30. Reply C to confirm." is a service text to anyone on your books. Add "Bring a friend and get 10% off whitening" and the whole thing is direct marketing by the Act's definition, to be sent only to people who've consented, with "Reply STOP to opt out" on the end.

Treat failed sends as sends. The new definition of "communication" counts what you transmitted, so clean the list before a campaign, drop the numbers that bounced last time, and keep the delivery reports.

Make the opt-out work on the day it arrives. Regulation 23 has always required a valid address for cease requests, and a STOP that takes a week to process is a complaint waiting to happen. CaptiFi Connect handles STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT and OPTOUT automatically and puts "Reply STOP to opt out" on every campaign by default; the detail is on the opt-outs page. The suppression list that builds up is a record worth keeping next to the consent records, because regulation 22 turns on whether you can show that the person agreed.

If you run a charity, read regulation 22(3A) before you send a single text under it, and check the opt-out line on your sign-up forms from today, because the forms you use now decide which supporters you can text next year.