Regulation 12 Relevant digital service providers

United Kingdom

(1)

A RDSP must identify and take appropriate and proportionate measures to manage the risks posed to the security of network and information systems on which it relies to provide, within the F1United Kingdom, the following services—

(a)

online marketplace;

(b)

online search engine; or

(c)

cloud computing service.

(2)

The measures taken by a RDSP under paragraph (1) must—

(a)

(having regard to the state of the art) ensure a level of security of network and information systems appropriate to the risk posed;

(b)

prevent and minimise the impact of incidents affecting their network and information systems with a view to ensuring the continuity of those services; and

(c)

take into account the following elements as specified in Article 2 of EU Regulation 2018/151—

(i)

the security of systems and facilities;

(ii)

incident handling;

(iii)

business continuity management;

(iv)

monitoring auditing and testing; and

(v)

compliance with international standards.

(3)

A RDSP must notify the F2Information Commission F3in writing about any incident having a substantial impact on the provision of any of the digital services mentioned in paragraph (1) that it provides.

(4)

The requirement to notify in paragraph (3) applies only if the RDSP has access to information which enables it to assess whether the impact of an incident is substantial.

(5)

The notification mentioned in paragraph (3) must provide the following information—

F4(a)

the RDSP’s name and the digital services that it provides;

(b)

the time the F5... incident occurred;

(c)

the duration of the ... incident;

(d)

information concerning the nature and impact of the ... incident;

(e)

information concerning any, or any likely, cross-border impact of the ... incident; and

(f)

any other information that may be helpful to the F6Information Commission.

(6)

The notification under paragraph (3) must—

(a)

be made without undue delay and in any event no later than 72 hours after the RDSP is F7first aware that an incident has occurred; and

(b)

contain sufficient information to enable the F8Information Commission to determine the significance of any cross-border impact.

(7)

In order to determine whether the impact of an incident is substantial the RDSP must—

(a)

take into account the following parameters, as specified in Article 3 of EU Regulation 2018/151—

(i)

the number of users affected by the incident and, in particular, the users relying on the digital service for the provision of their own services;

(ii)

the duration of the incident;

(iii)

the geographical area affected by the incident;

(iv)

the extent of the disruption to the functioning of the service;

(v)

the extent of the impact on economic and societal activities; and

F9(b)

have regard to any relevant guidance published by the F10Information Commission.

(8)

After receipt of a notification under paragraph (3) the F11Information Commission must share the incident notification with the CSIRT as soon as reasonably practicable.

(9)

If an OES is reliant on a RDSP to provide an essential service, the operator must notify the F12designated competent authority for the OES in writing in relation to it about any significant impact on the continuity of the service it provides caused by an incident affecting the RDSP F13without undue delay.

F14(10)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(11)

The F15Information Commission is not required to share information under F16these Regulations if the information contains—

(a)

confidential information; or

(b)

information which may prejudice the security or commercial interests of a RDSP.

(12)

If the Information Commission or CSIRT—

(a)

consults with the RDSP responsible for an incident notification under paragraph (3), and

(b)

is of the view that public awareness about that incident is necessary to prevent or manage it, or is in the public interest,

the Information Commission or CSIRT may inform the public about that incident or F17the Information Commission may direct the RDSP responsible for the notification to do so.

(13)

Before the Information Commission or CSIRT informs the public about an incident notified under paragraph (3), the Information Commission or CSIRT must consult each other and the RDSP who provided the notification.

(14)

The Information Commission may inform the public about an incident affecting digital services in F18a Member State of the EU if—

(a)

the relevant authorities in the affected Member State notify the Information Commission about the incident;

(b)

the Information Commission consults with those relevant authorities; and

(c)

the Information Commission is of the view mentioned in F19paragraph (12)(b).

(15)

The Information Commission must provide an annual report to the SPOC identifying the number and nature of incidents notified to it under paragraph (3).

(16)

The first report mentioned in paragraph (15) must be submitted on or before 1st July 2018 and subsequent reports must be submitted at annual intervals after that date.

F20(17)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Annotations

Textual amendments

F1: Words in reg. 12(1) substituted (20.1.2021) by The Network and Information Systems (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/653), reg. 1(2), Sch. para. 11(a); 2020 c. 1, Sch. 5 para. 1(1)
F2: Words in reg. 12(3) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(c); S.I. 2026/1015, reg. 2(c)
F3: Words in reg. 12(3) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 9(a) (with reg. 21)
F4: Reg. 12(5)(a) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 9(b)(i) (with reg. 21)
F5: Word in reg. 12(5)(b)-(e) omitted (31.12.2020) by virtue of The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 9(b)(ii) (with reg. 21)
F6: Words in reg. 12(5)(f) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(c); S.I. 2026/1015, reg. 2(c)
F7: Word in reg. 12(6)(a) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 9(c) (with reg. 21)
F8: Words in reg. 12(6)(b) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(c); S.I. 2026/1015, reg. 2(c)
F9: Reg. 12(7)(b) substituted (12.1.2022) by The Network and Information Systems (EU Exit) (Amendment) Regulations 2021 (S.I. 2021/1461), regs. 1, 3(2)
F10: Words in reg. 12(7)(b) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(c); S.I. 2026/1015, reg. 2(c)
F11: Words in reg. 12(8) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(c); S.I. 2026/1015, reg. 2(c)
F12: Words in reg. 12(9) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 9(d)(i) (with reg. 21)
F13: Words in reg. 12(9) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 9(d)(ii) (with reg. 21)
F14: Reg. 12(10) omitted (20.1.2021) by virtue of The Network and Information Systems (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/653), reg. 1(2), Sch. para. 11(b) (as amended by S.I. 2019/1444, regs. 1(2), 4); 2020 c. 1, Sch. 5 para. 1(1)
F15: Words in reg. 12(11)-(15) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(c); S.I. 2026/1015, reg. 2(c)
F16: Words in reg. 12(11) substituted (20.1.2021) by The Network and Information Systems (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/653), reg. 1(2), Sch. para. 11(c); 2020 c. 1, Sch. 5 para. 1(1)
F17: Words in reg. 12(12) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 9(e) (with reg. 21)
F18: Words in reg. 12(14) substituted (20.1.2021) by The Network and Information Systems (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/653), reg. 1(2), Sch. para. 11(d); 2020 c. 1, Sch. 5 para. 1(1)
F19: Words in reg. 12(14)(c) substituted (20.6.2018) by The Network and Information Systems (Amendment) Regulations 2018 (S.I. 2018/629), regs. 1, 2(7)(c)
F20: Reg. 12(17) omitted (20.1.2021) by virtue of The Network and Information Systems (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/653), reg. 1(2), Sch. para. 11(e); 2020 c. 1, Sch. 5 para. 1(1)