Regulation 18 Penalties

United Kingdom

F1(1)

The designated competent authority for an OES may serve a notice of intention to impose a penalty on the OES if it has reasonable grounds to believe that the OES has failed to comply with a duty referred to in regulation 17(1) or the duty set out in regulation 17(3A) and considers that a penalty is warranted having regard to the facts and circumstances of the case.

(2)

The F2Information Commission may serve a notice of intention to impose a penalty on a RDSP if it has reasonable grounds to believe that the RDSP has failed to comply with a duty referred to in regulation 17(2) or the duty set out in regulation (3A) and considers that a penalty is warranted having regard to the facts and circumstances of the case.

(3)

A F3notice of intention to impose a penalty must be in writing and must specify the following—

(a)

the reasons for imposing a penalty;

(b)

the sum that is F4intended to be imposed as a penalty and how it is to be paid;

(c)

the date on which the notice F5of intention to impose a penalty is given;

F6(d)

the period within which a penalty will be required to be paid if a penalty notice is served;

(e)

that the payment of a penalty under a penalty notice (if any) is without prejudice to the requirements of any enforcement notice (if any); and

(f)

how and when representations may be made about the content of the notice of intention to impose a penalty and any related matters.

F7(3A)

The relevant competent authority may, after considering any representations submitted in accordance with paragraph (3)(f), serve a penalty notice on the OES with a final penalty decision if the authority is satisfied that a penalty is warranted having regard to the facts and circumstances of the case.

(3B)

The F8Information Commission may, after considering any representations submitted in accordance with paragraph (3)(f), serve a penalty notice on the RDSP with a final penalty decision if the Information Commission is satisfied that a penalty is warranted having regard to the facts and circumstances of the case.

(3C)

The relevant competent authority or the Information Commission may serve a notice of intention to impose a penalty or a penalty notice irrespective of whether it has served or is contemporaneously serving an enforcement notice on the OES or RDSP under regulation 17(1) or (2).

(3D)

A penalty notice must—

(a)

be given in writing to the OES or RDSP;

(b)

include reasons for the final penalty decision;

(c)

require the OES or RDSP to pay—

(i)

the penalty specified in the notice of intention to impose a penalty; or

(ii)

such penalty as the relevant competent authority or the F9Information Commission considers appropriate in the light of any representations made by the OES or RDSP and any steps taken by the OES or RDSP to rectify the failure or to do one or more of the things required by an enforcement notice under regulation 17(3);

(d)

specify the period within which the penalty must be paid (“the payment period”) and the date on which the payment period is to commence;

(e)

provide details of the appeal process under regulation 19A; and

(f)

specify the consequences of failing to make payment within the payment period.

(3E)

It is the duty of the OES or RDSP to comply with any requirement imposed by a penalty notice.

(4)

A competent authority or the F10Information Commission may withdraw a penalty notice by informing the person upon whom it was served in writing.

(5)

The sum F11of any penalty imposed under this regulation must be an amount that—

(a)

the competent authority or F12Information Commission determines is appropriate and proportionate to the failure in respect of which it is imposed; and

(b)

is in accordance with paragraph (6).

(6)

The amount F13... must—

(a)

not exceed £1,000,000 for any contravention which the F14NIS enforcement authority determines F15was not a material contravention;

F16(b)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(c)

not exceed £8,500,000 for a material contravention which the F17NIS enforcement authority determines F18does not meet the criteria set out in sub-paragraph (d); and

(d)

not exceed £17,000,000 for a material contravention which the F19NIS enforcement authority determines F20has or could have created a significant risk to, or significant impact on, or in relation to, the service provision by the OES or RDSP.

(7)

In this regulation—

F21(a)

“a material contravention” means—

(i)

F22a failure to take, or adequately take, one or more of the steps required under an enforcement notice within the period specified in that notice to rectify a failure described in one or more of—

(aa)

sub-paragraphs (a) to (d) of regulation 17(1); or

(bb)

sub- paragraphs (a) to (d) of regulation 17(2); or

(ii)

where an enforcement notice was not served or where no steps were required to be taken under an enforcement notice, a failure described in one or more of—

(aa)

sub-paragraphs (a) to (d) of regulation 17(1); or

(bb)

sub-paragraphs (a) to (d) of regulation 17(2).

F23(b)

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Annotations

Textual amendments

F1: Reg. 18(1)(2) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(a) (with reg. 21)
F2: Words in reg. 18(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(j); S.I. 2026/1015, reg. 2(c)
F3: Words in reg. 18(3) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(b)(i) (with reg. 21)
F4: Word in reg. 18(3)(b) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(b)(ii) (with reg. 21)
F5: Words in reg. 18(3)(c) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(b)(iii) (with reg. 21)
F6: Reg. 18(3)(d)-(f) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(b)(iv) (with reg. 21)
F7: Reg. 18(3A)-(3E) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(c) (with reg. 21)
F8: Words in reg. 18(3B)(3C) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(j); S.I. 2026/1015, reg. 2(c)
F9: Words in reg. 18(3D)(c)(ii) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(j); S.I. 2026/1015, reg. 2(c)
F10: Words in reg. 18(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(j); S.I. 2026/1015, reg. 2(c)
F11: Words in reg. 18(5) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(d) (with reg. 21)
F12: Words in reg. 18(5)(a) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(j); S.I. 2026/1015, reg. 2(c)
F13: Words in reg. 18(6) omitted (31.12.2020) by virtue of The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(e)(i) (with reg. 21)
F14: Word in reg. 18(6)(a) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(e)(ii)(aa) (with reg. 21)
F15: Words in reg. 18(6)(a) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(e)(ii)(bb) (with reg. 21)
F16: Reg. 18(6)(b) omitted (31.12.2020) by virtue of The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(e)(iii) (with reg. 21)
F17: Word in reg. 18(6)(c) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(e)(iv)(aa) (with reg. 21)
F18: Words in reg. 18(6)(c) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(e)(iv)(bb) (with reg. 21)
F19: Word in reg. 18(6)(d) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(e)(v)(aa) (with reg. 21)
F20: Words in reg. 18(6)(d) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(e)(v)(bb) (with reg. 21)
F21: Reg. 18(7)(a) substituted (20.6.2018) by The Network and Information Systems (Amendment) Regulations 2018 (S.I. 2018/629), regs. 1, 2(9)(b)
F22: Reg. 18(7)(a)(i)(ii) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(f)(i) (with reg. 21)
F23: Reg. 18(7)(b) omitted (31.12.2020) by virtue of The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 14(f)(ii) (with reg. 21)