OpenLegislation

Regulation 16 Power of inspection

(1)

F1The designated competent authority for an OES may—

(a)

conduct F2all or any part of an inspection;

(b)

appoint a person to conduct F3all or any part of an inspection on its behalf; F4...

(c)

direct the OES to appoint a person who is approved by that authority to conduct F5all or any part of an inspection on its behalf,

F6....

(2)

The F7Information Commission may—

(a)

conduct F8all or any part of an inspection;

(b)

appoint a person to conduct F9all or any part of an inspection on its behalf; F10...

(c)

direct that a RDSP appoint a person who is approved by the Information Commission to conduct F11all or any part of an inspection on its behalf,

F12....

(3)

For the purposes of carrying out the inspection under paragraph (1) or (2), the OES or RDSP (as the case may be) must—

(a)

pay the reasonable costs of the inspection F13if so required by the relevant competent authority or the F14Information Commission ;

(b)

co-operate with the F15inspector;

(c)

provide the inspector with F16... access to their premises F17in accordance with paragraph (5)(a);

F18(d)

allow the inspector to examine, print, copy or remove any document or information, and examine or remove any material or equipment, in accordance with paragraph (5)(d);

(e)

allow the inspector access to any person from whom the inspector seeks relevant information for the purposes of the inspection;

F19(f)

not intentionally obstruct an inspector performing their functions under these Regulations; and

(g)

comply with any request made by, or requirement of, an inspector performing their functions under these Regulations.

(4)

The F20relevant competent authority or F21Information Commission may appoint a person to F22conduct all or any part of an inspection under paragraph (1)(b) or (2)(b) on its behalf on such terms and in such a manner as it considers appropriate.

F23(5)

An inspector may—

(a)

at any reasonable time enter the premises of an OES or RDSP (except any premises used wholly or mainly as a private dwelling) if the inspector has reasonable grounds to believe that entry to those premises may be necessary or helpful for the purpose of the inspection;

(b)

require an OES or RDSP to leave undisturbed and not to dispose of, render inaccessible or alter in any way any material, document, information, in whatever form and wherever it is held (including where it is held remotely), or equipment which is, or which the inspector considers to be, relevant for such period as is, or as the inspector considers to be, necessary for the purposes of the inspection;

(c)

require an OES or RDSP to produce and provide the inspector with access, for the purposes of the inspection, to any such material, document, information or equipment which is, or which the inspector considers to be, relevant to the inspection, either immediately or within such period as the inspector may specify;

(d)

examine, print, copy or remove any document or information, and examine or remove any material or equipment (including for the purposes of printing or copying any document or information) which is, or which the inspector considers to be, relevant for such period as is, or as the inspector considers to be, necessary for the purposes of the inspection;

(e)

take a statement or statements from any person;

(f)

conduct, or direct the OES or RDSP to conduct, tests;

(g)

take any other action that the inspector considers appropriate and reasonably required for the purposes of the inspection.

(6)

The inspector must—

(a)

produce proof of the inspector’s identity if requested by any person present at the premises; and

(b)

take appropriate and proportionate measures to ensure that any material, document, information or equipment removed in accordance with paragraph (5)(d) is kept secure from unauthorised access, interference and physical damage.

(7)

Before exercising any power under paragraph (5)(b) to (d) or (g), the inspector—

(a)

must take such measures as appear to the inspector appropriate and proportionate to ensure that the ability of the OES or RDSP, as the case may be, to comply with any duty set out in these Regulations will not be affected; and

(b)

may consult such persons as appear to the inspector appropriate for the purpose of ascertaining the risks, if any, there may be in doing anything which the inspector proposes to do under that power.

(8)

Where under paragraph (5)(d) an inspector removes any document, material or equipment, the inspector must provide, to the extent practicable, a notice giving—

(a)

sufficient particulars of that document, material or equipment for it to be identifiable; and

(b)

details of any procedures in relation to the handling or return of the document, material or equipment.

(9)

In this regulation—

(a)

a reference to a “test” is a reference to any process which is—

(i)

employed to verify assertions about the security of a network or information system; and

(ii)

based on interacting with that system, including components of that system,

and includes the exercising of any relevant security or resilience management process;

(b)

“inspection” means any activity carried out (including any steps mentioned in paragraph (5)) for the purpose of—

(i)

verifying compliance with the requirements of these Regulations; or

(ii)

assessing or gathering evidence of potential or alleged failures to comply with the requirements of these Regulations,

including any necessary follow-up activity for either purpose;

(c)

“inspector” means any person conducting all or any part of an inspection in accordance with paragraph (1) or (2).

Annotations

Textual amendments

F1

Words in reg. 16(1) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(a)(i) (with reg. 21)

F2

Words in reg. 16(1)(a) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(a)(ii) (with reg. 21)

F3

Words in reg. 16(1)(b) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(a)(ii) (with reg. 21)

F4

Word in reg. 16(1) omitted (31.12.2020) by virtue of The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(a)(iii) (with reg. 21)

F5

Words in reg. 16(1)(c) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(a)(iv) (with reg. 21)

F6

Words in reg. 16(1) omitted (31.12.2020) by virtue of The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(a)(v) (with reg. 21)

F7

Words in reg. 16(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(h); S.I. 2026/1015, reg. 2(c)

F8

Words in reg. 16(2)(a) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(b)(i) (with reg. 21)

F9

Words in reg. 16(2)(b) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(b)(i) (with reg. 21)

F10

Word in reg. 16(2) omitted (31.12.2020) by virtue of The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(b)(ii) (with reg. 21)

F11

Words in reg. 16(2)(c) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(b)(iii) (with reg. 21)

F12

Words in reg. 16(2) omitted (31.12.2020) by virtue of The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(b)(iv) (with reg. 21)

F13

Words in reg. 16(3)(a) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(c)(i) (with reg. 21)

F14

Words in reg. 16(3)(a) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(h); S.I. 2026/1015, reg. 2(c)

F15

Word in reg. 16(3)(b) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(c)(ii) (with reg. 21)

F16

Word in reg. 16(3)(c) omitted (31.12.2020) by virtue of The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(c)(iii)(aa) (with reg. 21)

F17

Words in reg. 16(3)(c) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(c)(iii)(bb) (with reg. 21)

F18

Reg. 16(3)(d) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(c)(iv) (with reg. 21)

F19

Reg. 16(3)(f)(g) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(c)(v) (with reg. 21)

F20

Word in reg. 16(4) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(d)(i) (with reg. 21)

F21

Words in reg. 16(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(h); S.I. 2026/1015, reg. 2(c)

F22

Words in reg. 16(4) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(d)(ii) (with reg. 21)

F23

Reg. 16(5)-(9) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 12(e) (with reg. 21)