United Kingdom. Cybersecurity. Statutory instrument (SI 2018/506)
NIS RegulationsNetwork and Information Systems Regulations 2018
In force
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Implements the NIS Directive in the UK, requiring operators of essential services and relevant digital service providers to manage network and information security risks and report significant incidents. The ICO regulates cloud computing services, online marketplaces and search engines.
- Key themes
- Unique features
UK kept the original NIS model after Brexit rather than adopting NIS2; small and micro enterprises are exempt from the RDSP regime.
- SaaS relevance
Medium and large cloud computing service providers (including many SaaS platforms) offering services in the UK are RDSPs and must register with the ICO and report incidents.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Incidents with substantial impact: competent authority within 72h
- DPO
- No
- Cross-border transfers
- Non-UK RDSPs must nominate a UK representative
- Maximum penalty
- £17m
§3Dates
- Key dates
- Adopted
- In force
- Amended 2020 and 2021 (Brexit); to be substantially amended/replaced by the Cyber Security and Resilience Bill
§4Text and authority
- Text
- Authoritative text legislation.gov.uk
- Authority
- Sector competent authorities; ICO for relevant digital service providers (online marketplaces, search engines, cloud computing services)
§5Where it applies
- Domestic law of
- United Kingdom
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.