Provides telecom services, in the United Kingdom

Regulation (EU) 2015/2120 as retained in UK law, art. 3; Open Internet Access (EU Regulation) Regulations 2016 (S.I. 2016/607), regs. 19-21 · Read the law's page

• Treat all traffic equally when providing internet access services, without discrimination, restriction or interference, irrespective of the sender and receiver, the content accessed or distributed, the applications or services used or provided, or the terminal equipment used.
• Apply only reasonable traffic management, which must be transparent, non-discriminatory and proportionate, not based on commercial considerations, not monitor specific content and not last longer than necessary; do not block, slow down, alter, restrict, interfere with, degrade or discriminate between specific content, applications or services except as necessary to comply with national legislation, preserve network integrity and security, or prevent impending or exceptional congestion.
• Do not let an agreement with an end-user, or a commercial practice, limit the end-user's right to access and distribute information and content, use and provide applications and services, and use terminal equipment of their choice.
• Offer a service other than internet access that is optimised for specific content or applications only where the optimisation is necessary for a specific level of quality, network capacity is sufficient to carry it in addition to internet access, and it is neither usable or offered as a replacement for internet access nor to the detriment of its availability or general quality.

Communications Act 2003, c. 21, ss. 105A to 105C; Electronic Communications (Security Measures) Regulations 2022, SI 2022/933 · Read the law's page

• Applies to the provider of a public electronic communications network or a public electronic communications service in the United Kingdom (reached by declaring that you provide telecom services); a provider within these duties is outside the essential-service duties of the Network and Information Systems Regulations 2018.
• Take such measures as are appropriate and proportionate for the purposes of identifying the risks of security compromises occurring, reducing those risks, and preparing for the occurrence of security compromises (section 105A(1)).
• When a security compromise occurs, take appropriate and proportionate measures to prevent adverse effects arising from it, and to remedy or mitigate any adverse effect it has on the network or service (section 105C(2) and (3)).
• As a network provider, take appropriate and proportionate measures to ensure that the network is designed, constructed, redesigned and maintained in a manner which reduces the risks of security compromises occurring (Security Measures Regulations 2022, regulation 3(1)).
• As a network provider, make a written record of the risks identified at least once in any period of 12 months, and keep each record for at least 3 years (Security Measures Regulations 2022, regulation 3(3)(b) and (4)).

Communications Act 2003, c. 21, ss. 105J and 105K · Read the law's page

• Applies to the provider of a public electronic communications network or a public electronic communications service in the United Kingdom (reached by declaring that you provide telecom services), the same providers as the security duties of sections 105A to 105C.
• Inform OFCOM as soon as reasonably practicable of any security compromise that has a significant effect on the operation of the network or service, and of any security compromise that puts a person in a position to bring about a further security compromise with such an effect (section 105K(1)).
• In judging whether the effect is significant, take into account the length of the period of effect, the number of users affected, the size and location of the geographical area affected, and the extent to which users' activities are affected (section 105K(2)).
• Where there is a significant risk of a security compromise occurring, take reasonable and proportionate steps to bring the relevant information, in clear and plain language, to the attention of the users who may be adversely affected (section 105J(2)).
• Give users the existence of the risk, the nature of the security compromise, the technical measures they can reasonably take to prevent or mitigate its effect, and the name and contact details of a person who can give further information (section 105J(3)).

Ofcom General Conditions of Entitlement, Condition C6; Communications Act 2003, ss. 96A-97 · Read the law's page

• Make sure, so far as technically feasible, that the caller identification data provided with or associated with a call includes a valid, dialable telephone number which uniquely identifies the caller, and respect end-users' privacy choices.
• Do not charge subscribers any additional or separate fee for access to or use of standard calling line identification facilities.
• Where technically feasible, take all reasonable steps to identify calls, other than calls to emergency organisations, whose caller identification data is invalid, does not uniquely identify the caller or has no dialable number, and prevent those calls from being connected to the called party.