Regulation 3 Designation of national competent authorities
United Kingdom
The person specified in column 3 of the table in Schedule 1 is designated as the competent authority, for the territorial jurisdiction indicated in that column, and for the subsector specified in column 2 of that table (“the designated competent authorities”).
The F1Information Commission is designated as the competent authority for the United Kingdom for RDSPs.
In relation to the subsector for which it is designated under paragraph (1), the competent authority must—
review the application of these Regulations;
prepare and publish guidance;
keep a list of all the operators of essential services who are designated, or deemed to be designated, under regulation 8 F2...;
keep a list of all the revocations made under regulation 9;
send a copy of the lists mentioned in sub-paragraphs (c) and (d) to GCHQ, as the SPOC designated under regulation 4, to enable it to prepare the report mentioned in regulation 4(3);
consult and co-operate with the F3Information Commission when addressing incidents that result in breaches of personal data; and
in order to fulfil the requirements of these Regulations, consult and co-operate with—
relevant law-enforcement authorities;
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
other competent authorities in the United Kingdom;
the SPOC that is designated under regulation 4; and
the CSIRT that is designated under regulation 5.
In relation to the subsector for which it is designated under paragraph (1), the competent authority may consult and co-operate with a public authority in the EU if it is in the interests of effective regulation of that subsector (whether inside or outside the United Kingdom).
In relation to digital services, the F6Information Commission must—
review the application of these Regulations;
prepare and publish guidance; and
consult and co-operate with the persons mentioned in paragraph (3)(g), in order to fulfil the requirements of these Regulations.
The guidance that is published F7... under paragraph (3)(b) or (4)(b) may be—
published in such form and manner as the competent authority or F8Information Commission considers appropriate; and
reviewed at any time, and if it is revised following such a review, the competent authority or Information Commission must publish revised guidance as soon as reasonably practicable.
The competent authorities designated under paragraph (1) and the F9Information Commission must have regard to the national strategy that is published under regulation 2(1) when carrying out their duties under these Regulations.
Annotations
Textual amendments
- F1
Words in reg. 3(2) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(b); S.I. 2026/1015, reg. 2(c)
- F2
Words in reg. 3(3)(c) omitted (20.1.2021) by virtue of The Network and Information Systems (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/653), reg. 1(2), Sch. para. 4(a); 2020 c. 1, Sch. 5 para. 1(1)
- F3
Words in reg. 3(3)(f) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(b); S.I. 2026/1015, reg. 2(c)
- F4
Reg. 3(3)(g)(ii) omitted (20.1.2021) by virtue of The Network and Information Systems (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/653), reg. 1(2), Sch. para. 4(b); 2020 c. 1, Sch. 5 para. 1(1)
- F5
Reg. 3(3A) inserted (20.1.2021) by The Network and Information Systems (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/653), reg. 1(2), Sch. para. 4(c); 2020 c. 1, Sch. 5 para. 1(1)
- F6
Words in reg. 3(4) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(b); S.I. 2026/1015, reg. 2(c)
- F7
Word in reg. 3(5) omitted (20.6.2018) by virtue of The Network and Information Systems (Amendment) Regulations 2018 (S.I. 2018/629), regs. 1, 2(4)
- F8
Words in reg. 3(5)(a)(b) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(b); S.I. 2026/1015, reg. 2(c)
- F9
Words in reg. 3(6) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 3 para. 24(2)(3)(b); S.I. 2026/1015, reg. 2(c)