{
  "url": "https://openlegislation.uk/telecommunications-data-protection-and-privacy-regulations-1999/regulation-28",
  "json_url": "https://openlegislation.uk/telecommunications-data-protection-and-privacy-regulations-1999/regulation-28.json",
  "legislation": "uksi/1999/2093",
  "legislation_title": "The Telecommunications (Data Protection and Privacy) Regulations 1999",
  "legislation_url": "https://openlegislation.uk/telecommunications-data-protection-and-privacy-regulations-1999",
  "path": "regulation/28",
  "kind": "regulation",
  "number": "28",
  "heading": "Security of telecommunications services",
  "text": "(1) Subject to paragraph (2), a telecommunications service provider shall take technical and organisational measures which are appropriate to secure the security of the service he provides.\n(2) If necessary, the measures required by paragraph (1) shall be taken by a telecommunications service provider in conjunction with the provider of the relevant telecommunications network who shall comply with any reasonable requests made by the service provider for the purposes hereof.\n(3) Where, notwithstanding the taking of measures required hereby, there is a significant risk to the security of the relevant telecommunications network, the telecommunications service provider shall inform the subscribers concerned of–\n(a) that risk;\n(b) any measures appropriate to afford safeguards against that risk which they themselves might take, and\n(c) the costs involved in the taking of such measures.\n(4) For the purposes of this regulation, measures shall only be taken to be appropriate if, having regard to–\n(a) the state of technological development, and\n(b) the cost of implementing the measures,\nthey are proportionate to the risks against which they would afford safeguards.\n(5) For the purposes of this regulation the security of a public telecommunications service or network shall not be taken to be at risk by reason of the intentional disclosure, or possibility of such disclosure, of any matter falling within subsection (1)(a) or (b) of section 45 of the Act of 1984 by a telecommunications service or network provider in a case or circumstances in which he would not be guilty of an offence under that section which, for the purposes of this paragraph, shall have effect as if–\n(a) the reference in subsection (1) thereof to a person engaged in the running of a public telecommunications system were a reference to such a provider;\n(b) for the words “that system”, in both places where they occur in subsection (1)(a) and (b) thereof, there were substituted the words “a public telecommunications system”; and\n(c) the reference in subsection (1)(a) thereof to a message were a reference to a communication.",
  "extent": null,
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "footnote",
      "label": "f1",
      "text": "Section 45 was amended by section 11(1) of the Interception of Communications Act 1985 (c. 56)."
    }
  ],
  "outstanding_effects": [
    {
      "type": "revoked",
      "affecting": "uksi/2003/2155",
      "affecting_title": "The Communications Act 2003 (Consequential Amendments) Order 2003"
    }
  ],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/uksi/1999/2093/regulation/28",
    "retrieved_at": "2026-10-29T10:14:43.005246+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}