United KingdomNotification of Incidents by Relevant Digital Service Providers
The Network and Information Systems Regulations 2018, SI 2018/506, reg. 12(3) to (7)
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- Applies to the relevant digital service providers described in the security duties of regulation 12(1) and (2): a provider of an online marketplace, an online search engine or a cloud computing service in the United Kingdom that is not a micro or small enterprise.
- Notify the Information Commission in writing about any incident having a substantial impact on the provision of any of those services (regulation 12(3)); this applies only if you have access to information that lets you assess whether the impact is substantial (regulation 12(4)).
- Make the notification without undue delay and in any event no later than 72 hours after you are first aware that the incident has occurred (regulation 12(6)(a)).
- State your name and the digital services you provide, the time and duration of the incident, its nature and impact, any cross-border impact, and any other helpful information (regulation 12(5)).
- In judging whether the impact is substantial, take into account the number of users affected, the duration of the incident, the geographical area affected, the extent of the disruption to the service and the extent of the impact on economic and societal activities (regulation 12(7)(a)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Regulation 18(6) caps a penalty at 1,000,000 pounds for a contravention that is not a material contravention, at 8,500,000 pounds for a material contravention that does not meet the criteria of paragraph (d), and at 17,000,000 pounds for a material contravention that has or could have created a significant risk to, or significant impact on, the service provision.
- Rule
- Fixed only
- As of
- Currency
- GBP
- Fixed cap
- 17,000,000
Who enforces it
Enforcement body
The Information Commission, which regulation 3(2) designates as the competent authority for relevant digital service providers and which may serve an enforcement notice under regulation 17(2) and a penalty notice under regulation 18(2).
Settledness
- As of
What this law does
Regulation 12(3) requires a relevant digital service provider to notify the Information Commission in writing about any incident having a substantial impact on the provision of an online marketplace, online search engine or cloud computing service that it provides. The notification must be made without undue delay and in any event no later than 72 hours after the provider is first aware that an incident has occurred.
The requirement to notify applies only if the provider has access to information which enables it to assess whether the impact of an incident is substantial.
When LexLint raises it
When your app profile says your app operates a social platform.