Operates an app store, in the United Kingdom

Consumer Rights Act 2015, c. 15, s. 46 · Read the law's page

• This binds a trader that supplies digital content to a consumer under a contract; a trader acts for purposes relating to its trade, business, craft or profession, and a consumer is an individual acting wholly or mainly outside them (sections 2(2), 2(3) and 46(1)).
• If your digital content damages the consumer's device or other digital content, and the damage would not have occurred had you exercised reasonable care and skill, repair the damage within a reasonable time and without significant inconvenience to the consumer, bearing the necessary costs, or compensate the consumer with an appropriate payment (section 46(1) to (3)).
• Pay any compensation without undue delay and within 14 days of agreeing that the consumer is entitled to it, and charge the consumer no fee for the payment (section 46(5) and (6)).

Cyber Security and Resilience (Network and Information Systems) Bill, session 2026-27 (HL Bill 62, as amended on Report) · Read the law's page

• If you operate an essential service other than a data center, give your designated competent authority an initial notification of an incident that has affected or is affecting the operation or security of the systems you rely on, and whose impact in the United Kingdom has been, is or is likely to be significant, within 24 hours of first being aware of it, and a full notification within 72 hours of that time, in writing and in the form and manner the authority determines, sending a copy to the computer security incident response team (the CSIRT) at the same time (new regulation 11).
• If you operate a data center service, give the same 24-hour and 72-hour notifications of an incident that has had, is having or is likely to have a significant impact on the operation or security of the systems you rely on, or on the operation or security of the service through the effect on a customer's systems (new regulation 11A); as soon as reasonably practicable after the full notification, take reasonable steps to establish which of your United Kingdom customers are likely to be adversely affected and notify them of the nature of the incident and why you consider them likely to be adversely affected, then provide them with such updates about the incident and its impact as you consider necessary (new regulation 11C).
• If you operate a data center service, give the designated competent authority your name, proper address, the names of your directors or partners and up-to-date contact details within three months of being deemed designated or of notice of your designation, and tell it of any change within seven days of the change taking effect (new regulation 8ZA).
• If you provide a relevant digital service, give the Information Commission an initial notification within 24 hours, and a full notification within 72 hours, of first being aware of an incident affecting the service whose impact in the United Kingdom has been, is or is likely to be significant, with a copy to the CSIRT; then, as soon as reasonably practicable after the full notification, notify your United Kingdom customers likely to be adversely affected, then provide them with such updates about the incident and its impact as you consider necessary (new regulations 12A and 12C).
• If you provide a relevant digital service, have regard to any relevant guidance from the Information Commission when carrying out your duties under regulation 12(1) (new regulation 12(2A)); notify the Information Commission of any change to your registered details within seven days of the change taking effect, those details now including the names of your directors or partners and which relevant digital services you provide (regulation 14, as amended); and, if your principal office is outside the United Kingdom, nominate a representative in the United Kingdom within three months (regulation 14A, as amended).
• If you provide a managed service, identify and take appropriate and proportionate measures to manage the risks to the network and information systems you rely on to provide managed services within the United Kingdom, ensuring (having regard to the state of the art) a level of security appropriate to the risk and preventing and minimizing the impact of incidents, and have regard to any relevant guidance from the Information Commission (new regulation 14B).
• If you provide a managed service, give the Information Commission an initial notification within 24 hours, and a full notification within 72 hours, of first being aware of an incident affecting the service whose impact in the United Kingdom has been, is or is likely to be significant, with a copy to the CSIRT; then, as soon as reasonably practicable after the full notification, notify your United Kingdom customers likely to be adversely affected, then provide them with such updates about the incident and its impact as you consider necessary (new regulations 14E and 14G).
• If you provide a managed service, register with the Information Commission your name, proper address, the names of your directors or partners and up-to-date contact details before the registration date, which is three months after section 14 of the Act comes into force or, if you first meet the definition later, three months after you first meet it; notify any change within seven days of it taking effect; and, if your principal office is outside the United Kingdom, nominate a representative in the United Kingdom within three months (new regulations 14C and 14D).
• If a designated competent authority or the Information Commission designates you as a critical supplier, notify it as soon as practicable, in writing and with supporting evidence, if you have reasonable grounds to believe it could not designate you (new regulation 14K).
• If a designated competent authority or the Information Commission gives you a written information notice, comply with it: the notice may be given to a person it regulates or to any other person, other than the single point of contact or the CSIRT, that appears to it likely to have the information or documents sought, whether or not that person is established in the United Kingdom, and, for a person it does not regulate, it may be a general request published for a category of persons; the power reaches information stored outside the United Kingdom (new regulations 15 and 15A).
• If a designated competent authority or the Information Commission regulates you, allow an inspection under regulation 16, which the bill extends to managed service providers, and pay any charge it imposes under its charging scheme and any invoice for its costs of exercising a function in relation to you (new regulations 20A and 20C).
• Comply with a direction the Secretary of State gives you under section 44 or 48 to do, or not to do, a particular thing specified in it, for example a restriction on the use of goods, services or facilities, the removal or modification of goods or facilities, or the appointment of a skilled person whose appointment the Secretary of State has approved in writing, and keep its existence and contents confidential where the Secretary of State so requires.
• The bill reaches you if you operate an essential service in the United Kingdom, whether or not you are established there, a class the bill extends to a data center service of 1 megawatt or more of rated IT load (10 megawatts or more where the data center serves only the undertaking that owns or manages it) and to a load controller of 300 megawatts or more of potential electrical control that carries on activities for system-balancing purposes.
• It also reaches you where you provide a managed service, or an online marketplace, an online search engine or a cloud computing service, in the United Kingdom, whether or not you are established there, unless you are a micro or small enterprise, are designated a critical supplier for that service, or are subject to public authority oversight and do not derive more than half your income from activities of a commercial nature; providing a public electronic communications network or service does not by itself make you a digital or managed service provider.