Regulation 15 Information notices
United Kingdom
In order to assess whether a person should be an OES, a designated competent authority may serve an information notice F1in writing upon any person requiring that person to provide it with F2all such information as it reasonably requires to establish whether—
a threshold requirement described in F3... Schedule 2 is met; or
the conditions mentioned in regulation 8(3) are met.
A designated competent authority may serve an information notice F4in writing upon an OES requiring F5the OES to provide it with F6all such information as it reasonably requires F7for one or more of the following purposes—
to assess the security of the OES’s network and information systems;
to establish whether there have been any events that the authority has reasonable grounds to believe have had, or could have, an adverse effect on the security of network and information systems and the nature and impact of those events;
to identify any failure of the OES to comply with any duty set out in these Regulations;
to assess the implementation of the OES’s security policies, including from the results of any inspection conducted under regulation 16 and any underlying evidence in relation to such an inspection.
The F9Information Commission may serve upon a RDSP an information notice F10in writing requiring that RDSP to provide the Information Commission with F11all such information as the Information Commission reasonably requires F12for one or more of the following purposes—
to assess the security of the RDSP’s network and information systems;
to establish whether there have been any events that the Information Commission has reasonable grounds to believe have had, or could have, an adverse effect on the security of network and information systems and the nature and impact of those events;
to identify any failure of the RDSP to comply with any duty set out in these Regulations;
to assess the implementation of the RDSP’s security policies, including from the results of any inspection conducted under regulation 16 and any underlying evidence in relation to such an inspection.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
An information notice must—
describe the information that is required by the designated competent authority or the F15Information Commission;
provide the reasons for requesting such information;
specify the form and manner in which the requested information is to be provided; and
specify the time period within which the information must be provided.
A person upon whom an information notice has been served under this regulation must comply with the requirements of the notice.
In a case falling within paragraph (1) the information notice may—
be served by publishing it in such manner as the designated competent authority considers appropriate in order to bring it to the attention of any persons who are described in the notice as the persons from whom the information is required; and
take the form of a general request for a certain category of persons to provide the information that is specified in the notice.
A competent authority or the F17Information Commission may withdraw an information notice by written notice to the person on whom it was served.
An information notice under paragraph (1) may not be served upon the SPOC or CSIRT.
Annotations
Textual amendments
- F1
Words in reg. 15(1) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(a)(i) (with reg. 21)
- F2
Words in reg. 15(1) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(a)(ii) (with reg. 21)
- F3
Words in reg. 15(1)(a) omitted (20.6.2018) by virtue of The Network and Information Systems (Amendment) Regulations 2018 (S.I. 2018/629), regs. 1, 2(8)
- F4
Words in reg. 15(2) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(b)(i)(aa) (with reg. 21)
- F5
Words in reg. 15(2) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(b)(i)(bb) (with reg. 21)
- F6
Words in reg. 15(2) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(b)(i)(cc) (with reg. 21)
- F7
Words in reg. 15(2) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(b)(i)(dd) (with reg. 21)
- F8
Reg. 15(2)(a)-(d) substituted for reg. 15(2)(a)(b) (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(b)(ii) (with reg. 21)
- F9
Words in reg. 15(3) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(g); S.I. 2026/1015, reg. 2(c)
- F10
Words in reg. 15(3) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(c)(i)(aa) (with reg. 21)
- F11
Words in reg. 15(3) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(c)(i)(bb) (with reg. 21)
- F12
Words in reg. 15(3) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(c)(i)(cc) (with reg. 21)
- F13
Reg. 15(3)(a)-(d) substituted for reg. 15(3)(a)(b) (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(c)(ii) (with reg. 21)
- F14
Reg. 15(4) omitted (31.12.2020) by virtue of The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(d) (with reg. 21)
- F15
Words in reg. 15(5)(a) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(g); S.I. 2026/1015, reg. 2(c)
- F16
Reg. 15(5A) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(e) (with reg. 21)
- F17
Words in reg. 15(7) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(g); S.I. 2026/1015, reg. 2(c)