OTP, UK GDPR and PECR: what UK businesses actually need to know

If you send text messages to customers in the UK — order updates, appointment reminders, marketing, or one-time passcodes — two sets of rules apply: the UK GDPR (with the Data Protection Act 2018) for how you handle personal data, and the Privacy and Electronic Communications Regulations (PECR) for electronic marketing specifically. Both are enforced by the Information Commissioner's Office (ICO). This is a practical overview of what changed recently and where verification codes fit in. It isn't legal advice.

What changed in 2025

The Data (Use and Access) Act (DUAA) became law on 19 June 2025. For messaging, the headline change is enforcement: the maximum PECR fine rose from £500,000 to £17.5 million, or 4% of global annual turnover, whichever is higher — bringing PECR penalties in line with UK GDPR. The ICO also gained stronger investigatory powers, including the ability to compel witnesses and request technical reports. In short, the rules on marketing texts didn't get looser; the consequences of ignoring them got a lot larger.

UK GDPR: handling the data behind a message

A phone number tied to a person is personal data. Under UK GDPR you need a lawful basis to process it, you should only keep it as long as you need it, and you must be able to explain what you do with it. In practice, for an SMS platform that means:

• Lawful basis. For transactional messages (a delivery update, a booking confirmation, a security code) that's usually "legitimate interests" or performance of a contract. For marketing, consent is the safer footing (see PECR below).
• Data minimisation. Store the number and what you need to deliver and audit the message — not more.
• Retention. Don't keep message logs and contact lists indefinitely "just in case".
• Individual rights. People can ask what you hold and ask you to delete it.

PECR: the rules specific to marketing texts

PECR sits on top of UK GDPR and governs unsolicited electronic marketing. The core rule for SMS marketing to individuals is consent — the person has to have agreed to receive it. There is one important exception, the "soft opt-in": if someone bought (or negotiated to buy) something from you, you gave them a clear chance to opt out at the time, and you're marketing your own similar products, you can text them without separate prior consent. Every marketing message must still let them opt out easily, and honouring a STOP reply is non-negotiable.

Do you need to register with the ICO?

Most organisations that process personal data must pay the ICO's data protection fee (an annual charge, tiered by size) and be on the register, unless a specific exemption applies. It's an inexpensive, quick step — and operating without it when you should be registered is itself something the ICO can act on. If you're processing customer phone numbers to send messages, assume you need it and check your tier.

Where OTP fits in

One-time passcodes are firmly on the service side of the line — you're verifying identity or securing an account, not marketing. Used well, OTP actually supports your data-protection posture: it's a proportionate security measure that helps keep accounts and personal data out of the wrong hands, which is exactly the kind of "appropriate technical measure" UK GDPR expects. It doesn't need marketing consent, but the underlying number is still personal data, so the minimisation and retention points above still apply.

A practical checklist

• Separate transactional messages from marketing messages, and be honest about which is which.
• For marketing texts, rely on consent or a properly-qualified soft opt-in — and record how you got it.
• Make opt-out effortless and process STOP replies immediately.
• Identify the sender so recipients know who's texting them.
• Check your ICO registration and pay the data protection fee if you need to.
• Keep only the data you need, for only as long as you need it.

How Bremlio helps

Bremlio bakes several of these controls into the platform so you don't have to build them yourself: STOP replies add the sender to a suppression list that's checked before every send; marketing messages carry an opt-out line; content is screened before delivery; and message history gives you the audit trail. The OTP API handles verification as a clean service flow. None of that replaces getting your own consent and registration right — but it removes a lot of the plumbing.

This article is general information, not legal advice. UK GDPR, the DPA 2018, PECR and the Data (Use and Access) Act 2025 are complex and their guidance is still being updated by the ICO — check the current ICO guidance or take professional advice for your specific situation.