United KingdomSecurity Duties of Relevant Digital Service Providers
The Network and Information Systems Regulations 2018, SI 2018/506, reg. 12(1) and (2)
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- Applies to a relevant digital service provider: a provider of an online marketplace, an online search engine or a cloud computing service in the United Kingdom whose head office is in the United Kingdom or which has nominated a representative established there, and which is not a micro or small enterprise (regulation 1).
- Identify and take appropriate and proportionate measures to manage the risks posed to the security of the network and information systems on which you rely to provide the service in the United Kingdom (regulation 12(1)).
- Ensure, having regard to the state of the art, a level of security of network and information systems appropriate to the risk posed, and prevent and minimise the impact of incidents with a view to ensuring the continuity of the service (regulation 12(2)(a) and (b)).
- Take into account the security of systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards (regulation 12(2)(c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Regulation 18(6) caps a penalty at 1,000,000 pounds for a contravention that is not a material contravention, at 8,500,000 pounds for a material contravention that does not meet the criteria of paragraph (d), and at 17,000,000 pounds for a material contravention that has or could have created a significant risk to, or significant impact on, the service provision.
- Rule
- Fixed only
- As of
- Currency
- GBP
- Fixed cap
- 17,000,000
Who enforces it
Enforcement body
The Information Commission, which regulation 3(2) designates as the competent authority for relevant digital service providers and which may serve an enforcement notice under regulation 17(2) and a penalty notice under regulation 18(2).
Settledness
- As of
What this law does
Regulation 12(1) requires a relevant digital service provider to identify and take appropriate and proportionate measures to manage the risks posed to the security of the network and information systems on which it relies to provide an online marketplace, an online search engine or a cloud computing service in the United Kingdom. Regulation 12(2) requires those measures to ensure, having regard to the state of the art, a level of security appropriate to the risk posed.
A provider is a relevant digital service provider only if it is not a micro or small enterprise as defined in Commission Recommendation 2003/361/EC.
When LexLint raises it
When your app profile says your app operates a social platform.