Data and Cyber School – the latest cyber security and data protection updates

The Bill significantly widens the net of regulated entities. In addition to operators of essential services (OES) in the healthcare, energy, drinking water, transport and digital infrastructure sectors, as well as relevant digital service providers (RDSPs) (online marketplaces, online search engines, cloud computing services), the following will now fall under direct regulation:

• Managed Service Providers (MSPs): Some medium and large MSPs, referred to as Relevant Managed Service Providers (RMSPs) in the Bill, will be brought into scope. The Information Commissioner's Office (ICO) (soon to be the Information Commission) will regulate.
• Data centre infrastructure: UK data centres at or above 1MW capacity will be brought into scope. Data centre services provided on an enterprise basis (which serve its own undertaking only) will be brought into scope if they are at or above 10MW capacity. Whilst designated as OESs, there may be some differences in applicable duties (e.g. for incident reporting) compared to other OESs.
• Large load controllers: Organisations that control 300MW of electrical load or more to remotely control consumer appliances will be designated as OESs. The Department for Energy Security and Net Zero and Ofgem will act as the joint regulator. This will bring large load controllers in line with other energy infrastructure. 

This expansion reflects the growing recognition that supply chain vulnerabilities are a prime target for attackers. 

Regulators will be granted powers to designate and regulate organisations as "critical suppliers". Regulators will be able to designate a supplier of goods or services to OES, RDSPs or RMSPs as critical, if set criteria apply. This will address situations where an incident disrupts a supplier from delivering goods or services and that disruption is likely to have a significant impact on the economy or day-to-day functioning of society in all or part of the UK. Often this will be because the supplier's systems are used as a route for attackers to target an essential or digital service provider. Requirements for duties and incident reporting will be set through regulations. 

One of the most impactful changes is the introduction of stricter reporting timelines. 

A two-stage reporting structure is introduced. For a significant incident, in-scope organisations must give: 

• Initial notification within 24 hours
• Full report within 72 hours 

In parallel with reporting to their regulator, a copy of the incident notifications and a full report must be sent to the National Cyber Security Centre (NCSC). 

This requirement aims to give regulators and the NCSC a clearer picture of emerging threats. Failure to comply could result in daily fines of up to £100,000 or penalties linked to annual turnover (see 4). 

The definition of a reportable incident is expanded to capture a broader range of incidents. Currently the threshold for reporting an incident is if it is causing significant disruption to an essential and digital service. This does not capture attacks that have compromised the integrity or security of a system in a way which could have significant impacts in the future, such as pre-positioning (where attackers gain access or presence within networks for future significant disruption) and ransomware incidents (where malicious software infects a victim's computer system, preventing or impairing access to IT systems, and facilitating the theft of personal or sensitive data – then demanding payment.) The Bill puts forward measures which will require those incidents to also be reported. 

Transparency requirements will be enhanced. RDSPs, RMSPs and data centre operators will need to alert customers likely to be affected by a significant incident. 

Regulators will gain enhanced powers to investigate and enforce compliance. 

There will be a new cost recovery framework which will allow regulators to recover the full costs associated with their NIS activities through a periodic fee. 

Penalties for non-compliance will be linked to annual turnover, ensuring fines are proportionate to the size of the organisation. Detail on defining the calculation of turnover for penalties will be set out in secondary legislation. 

The Bill sets out a revised penalty structure. The new maximum penalties proposed are: 

1. For more serious breaches, up to £17 million, or 4% of the regulated entity's worldwide turnover, whichever is higher.
2. For less serious breaches, up to £10 million, or 2% of worldwide turnover, whichever is higher.
3. For ongoing breaches, the Bill proposes fines of up to £100,000 per day (for entities that are not "undertakings" or for non turnover-based penalties) in specified circumstances. 

The Bill also introduces information notice and non-disclosure penalties of up to £10 million, or for continuing non-compliance - up to £50,000 per day. 

The NIS Regulations apply across multiple sectors and are enforced by 12 regulators (13 when the new law comes into force). Regulators will have a duty to seek to achieve objectives which will be set out in a statement of strategic priorities. 

The Secretary of State will have authority to direct regulators and organisations to take specific, proportionate steps during major cyber incidents. This could include enhanced monitoring or temporary network isolation to protect national security. Proportionate safeguards will be implemented. 

The Secretary of State will also have power to bring more sectors into scope of the NIS Regulations and update and introduce security and resilience requirements for organisations within scope including in relation to supply chain risk management, via secondary legislation. 

The Act creates a more permissive framework for solely automated decisions with legal or similarly significant effects, provided organisations implement safeguards (clear information, right to contest, and meaningful human intervention). Restrictions for special category data remain unless an exemption applies.

Clarifies "reasonable and proportionate" searches and introduces a stop‑the‑clock mechanism while you seek clarification.

Lists specific public‑interest disclosures that do not require the usual Article 6(1)(f) balancing test, and codifies examples (network security, intra‑group admin and direct marketing) in statute.

Recalibrates adequacy and transfer risk assessments via a new 'data protection test' (protection "not materially lower" than UK standards), supporting a more risk‑based approach.

Aligns the Privacy and Electronic Communication (EC Directive) Regulations 2003 (PECR) maximum penalty with UK GDPR (the higher of £17,500,000 or 4% of worldwide turnover) and expands consent exemptions for low‑risk storage/access (analytics/statistical, appearance/functionality, security and fraud, authentication, fault detection, maintaining user selections). Definitions of "call", "communication", "recipient" and who can "instigate" storage/access are updated, and breach reporting timing aligns to 72 hours. Note: advertising and cross‑site tracking still require consent.

Enables sector‑specific schemes (e.g., open finance and beyond) via secondary legislation; the government has consulted on opportunities in digital markets.

Moved to public beta in June 2025; statutory obligations to upload asset data will be introduced via regulations with phased lead‑times. 

Boards should understand and oversee cyber risk, integrate it into enterprise risk frameworks, and review risks regularly—including supplier and third-party risks.

Set the tone from the top. Establish and monitor a cyber strategy aligned to risk appetite and business objectives, with appropriate investment and clear outcomes.

Build a positive security culture. Ensure the board and workforce receive regular training to maintain cyber literacy, and measure the effectiveness of awareness activities.

Maintain a clear, exercised incident response and business recovery plan with defined legal, regulatory, communications and stakeholder responsibilities.

Secure proportionate assurance. Use internal and independent reviews to evidence controls, understand gaps and track improvements. Ensure meaningful, regular board reporting.