{
  "url": "https://openlegislation.uk/communications-act-2003/section-105A",
  "json_url": "https://openlegislation.uk/communications-act-2003/section-105A.json",
  "legislation": "ukpga/2003/21",
  "legislation_title": "Communications Act 2003",
  "legislation_url": "https://openlegislation.uk/communications-act-2003",
  "path": "section/105A",
  "kind": "section",
  "number": "105A",
  "heading": "Duty to take security measures",
  "text": "(1) The provider of a public electronic communications network or a public electronic communications service must take such measures as are appropriate and proportionate for the purposes of—\n(a) identifying the risks of security compromises occurring;\n(b) reducing the risks of security compromises occurring; and\n(c) preparing for the occurrence of security compromises.\n(2) In this Chapter “security compromise”, in relation to a public electronic communications network or a public electronic communications service, means—\n(a) anything that compromises the availability, performance or functionality of the network or service;\n(b) any unauthorised access to, interference with or exploitation of the network or service or anything that enables such access, interference or exploitation;\n(c) anything that compromises the confidentiality of signals conveyed by means of the network or service;\n(d) anything that causes signals conveyed by means of the network or service to be—\n(i) lost;\n(ii) unintentionally altered; or\n(iii) altered otherwise than by or with the permission of the provider of the network or service;\n(e) anything that occurs in connection with the network or service and compromises the confidentiality of any data stored by electronic means;\n(f) anything that occurs in connection with the network or service and causes any data stored by electronic means to be—\n(i) lost;\n(ii) unintentionally altered; or\n(iii) altered otherwise than by or with the permission of the person holding the data; or\n(g) anything that occurs in connection with the network or service and causes a connected security compromise.\n(3) But in this Chapter “security compromise” does not include anything that occurs as a result of conduct that—\n(a) is required or authorised by or under an enactment mentioned in subsection (4);\n(b) is undertaken for the purpose of providing a person with assistance in giving effect to a warrant or authorisation that has been issued or given under an enactment mentioned in subsection (4);\n(c) is undertaken for the purpose of providing a person with assistance in exercising any power conferred by or under prison rules; or\n(d) is undertaken for the purpose of providing assistance to a constable or a member of a service police force (acting in either case in that capacity).\n(4) The enactments are—\n(a) the Investigatory Powers Act 2016;\n(b) Part 1 of the Crime and Courts Act 2013;\n(c) the Prisons (Interference with Wireless Telegraphy) Act 2012;\n(d) the Regulation of Investigatory Powers Act 2000;\n(e) the Regulation of Investigatory Powers (Scotland) Act 2000;\n(f) the Intelligence Services Act 1994;\n(g) any other enactment (whenever passed or made) so far as it—\n(i) makes provision which is in the interests of national security;\n(ii) has effect for the purpose of preventing or detecting crime or of preventing disorder; or\n(iii) makes provision which is in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security.\n(5) In this section—\n“connected security compromise” means—\n(a)in relation to a public electronic communications network, a security compromise that occurs in relation to another public electronic communications network or a public electronic communications service;\n(b)in relation to a public electronic communications service, a security compromise that occurs in relation to a public electronic communications network or another public electronic communications service;\n“crime” and “detecting crime” have the same meanings as in the Investigatory Powers Act 2016;\n“prison rules” means any rules made under—\n(a)section 47 of the Prison Act 1952;\n(b)section 39 of the Prisons (Scotland) Act 1989; or\n(c)section 13 of the Prison Act (Northern Ireland) 1953;\n“service police force” means—\n(a)the Royal Navy Police;\n(b)the Royal Military Police; or\n(c)the Royal Air Force Police;\n“signal” has the same meaning as in section 32.",
  "extent": null,
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Ss. 105A-105D and cross-heading inserted (26.5.2011) by The Electronic Communications and Wireless Telegraphy Regulations 2011 (S.I. 2011/1210), reg. 1(2), Sch. 1 para. 65 (with Sch. 3 para. 2)"
    },
    {
      "type": "F",
      "label": "F2",
      "text": "Ss. 105A, 105B substituted for ss. 105A-105D and ss. 105C, 105D re-inserted (17.11.2021 for specified purposes, 1.10.2022 in so far as not already in force) by Telecommunications (Security) Act 2021 (c. 31), ss. 1(2), 2, 28(1)(a)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukpga/2003/21/section/105A",
    "retrieved_at": "2026-10-29T09:18:16.154105+00:00",
    "licence": "OGL-UK-3.0",
    "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
    "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
  }
}