Lewis Silkin are most popular: <\/p>\n
\n within Cannabis & Hemp, Law Practice Management and Criminal Law topic(s)
\n in United Kingdom
\n with readers working within the Retail & Leisure industries
<\/p>\n
Proposed reforms to cyber security laws in the UK have been a
The government’s press release<\/a> states that the Bill is designed
The government is looking to significantly modernise to the
There are 3 ‘pillars’ of reforms to update NIS; (1) to
Who is caught?<\/p>\n NIS primarily applies to ‘operators of essential
The Bill will significantly expand this scope. In particular,
This means that organisations that are not currently regulated
What are the new requirements?<\/p>\n Under NIS, incident notification is required without undue delay
The Bill replaces this with a more structured and time-critical
The Bill also introduces new obligations to notify affected
Data centre operators will be subject to a different reporting
What are the implications of getting this
The Bill significantly strengthens the enforcement regime and
Regulators will be granted broader investigatory and audit
The proposed penalty regime includes:<\/p>\n
Interestingly, these figures exceed the higher maximum fines
Separate penalties may also apply for failures to comply with
So, when will the new Bill be in force?<\/p>\n The government has indicated that the Bill will be implemented
\nlong time coming, as the government has finally introduced<\/a> the Cyber Security and Resilience
\nBill (the “Bill”) to parliament for its
\nfirst reading on 12 November 2025. The new law is expected to come
\ninto force at some point in 2026 with commencement to be phased and
\ndelivered largely through secondary legislation. The Bill will
\nupdate the Network and Information Systems Regulations 2018
\n(“NIS”), which places ‘security and
\nresilience duties’ on organisations ‘involved in the
\ndelivery of essential services and some digital services’.<\/p>\n
\nto increase UK defences against cyber-attacks and the protection of
\npublic services. The Bill seeks to achieve this by widening the
\napplication of NIS, imposing additional notification obligations,
\nand tightening up the enforcement regime.<\/p>\n
\nUK’s existing cyber law framework, and will bring the
\nlegislative framework more closely aligned to the EU’s NIS2
\nDirective. Along with an existing raft of cyber regulation across
\nthe EU, organisations will need to be aware of the expanding scope
\nof entities who will be subject to the Bill, and this will mean
\nthat more organisations will be in scope.<\/p>\n
\n‘protect services people rely on, (2) deliver a step change in
\nnational security, and (3) underpin economic stability’.<\/p>\n
\nservices’ (such as organisations in the energy, transport,
\nhealth, water and digital infrastructure sectors) and certain
\ndigital service providers.<\/p>\n
\norganisations are likely to be caught where they provide services
\nthat are considered so essential that their disruption could affect
\ndaily life, economic stability, or national security in the UK,
\naccording to the government’s policy paper<\/a> on the Bill. The range of
\nentities that will fall within the scope is expected to
\ninclude:<\/p>\n
\nManaged service providers, including outsourced IT providers,
\ncyber security service providers, and entities providing services
\nessential to the resilience or security of another
\norganisation’s network or information systems.
\n
\nData centre operators above specified capacity thresholds,
\nreflecting the government’s view that data infrastructure is
\nnow critical national infrastructure.
\n
\nCertain entities in the energy sector, including large load
\ncontrollers.
\n
\nCritical suppliers, meaning organisations that support or
\nunderpin the delivery of essential or digital services and whose
\ndisruption could have a significant impact on the economy or the
\nday-to-day functioning of society in all or part of the UK.
<\/p>\n
\nunder NIS, particularly suppliers and technology providers, may
\nfind themselves brought within scope for the first time.<\/p>\n
\nwhere an incident has a significant impact on the continuity of
\nessential or digital services.<\/p>\n
\nreporting framework. In-scope organisations will be required
\nto:<\/p>\n
\nSubmit an initial notification within 24 hours of becoming
\naware of a significant cyber incident;
\n
\nProvide a full incident report within 72 hours; and
\n
\nNotify both their competent authority and the National Cyber
\nSecurity Centre.
<\/p>\n
\ncustomers where they are likely to be adversely affected by an
\nincident.<\/p>\n
\nregime, including reporting incidents that have had, could have
\nhad, or are likely to have a significant impact on the operation,
\nsecurity, or continuity of data centre services in the UK. In these
\ncases, affected customers must also be informed.<\/p>\n
\nwrong?<\/p>\n
\nincreases the consequences of non-compliance.<\/p>\n
\npowers, alongside a revamped penalty framework designed to create
\nstronger incentives for compliance.<\/p>\n
\nMaximum fines of the greater of \u00a317 million or 4% of
\nworldwide annual turnover for serious breaches;
\n
\nMaximum fines of the greater of \u00a310 million or 2% of
\nworldwide annual turnover for less serious breaches; and
\n
\nDaily penalties in specified circumstances for continuing
\nnon-compliance (\u00a350,000 per day).
<\/p>\n
\navailable across the European Union under NIS2.<\/p>\n
\ninformation notices or non-disclosure requirements.<\/p>\n
\nusing a ‘sequenced’ and phased approach, to allow
\nregulators and industry time to prepare. While precise commencement
\ndates have not yet been confirmed, the Bill is expected to receive
\nRoyal Assent at some point in 2026, with many obligations brought
\ninto force (as with the Data (Use and Access) Act 2025) through
\nsecondary legislation thereafter. A further consultation on
\nimplementation proposals is anticipated.<\/p>\n