PECR is enforced through the 2018 Act's information, assessment, interview and enforcement notices and penalty notices as applied by the new Schedule 1. Any person must answer information notices about its own compliance or about a suspected breach by another person, and a communications provider must answer notices about another person's use of its network or service, without disclosing the notice's existence where the notice says a duty of confidentiality applies; communications providers and anyone doing regulated activity can receive assessment notices (including approved-person reports) and staff can receive interview notices. Penalties reach the higher maximum (GBP 17.5 million or 4 percent of worldwide turnover for an undertaking) for breaches of regulations 5, 6, 7, 8, 14 and 19 to 24 and for failing to comply with a notice or the confidentiality duty, and the standard maximum otherwise; for regulations 19 to 24 (marketing calls, faxes, emails and calling line identification) a penalty can also be given to an officer whose consent, connivance or neglect caused the breach. Breaches from 5 February 2026 fall under this regime, earlier ones under the old one.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.