Cybersecurity is now a leadership responsibility. UK rules connect data protection, service security and accountability.
Laws differ across jurisdictions. Organizations within scope must identify obligations, document risk, test controls and maintain evidence. The selected country determines the legal framework shown below.
Change jurisdiction while keeping the language
United Kingdom · Relevant UK competent authorities / ICO
NIS Regulations 2018
In force · 2018-05-10
Security and incident reporting duties apply to covered essential services and relevant digital service providers.
Business impact
Determine the correct sector regulator and maintain proportionate security and incident reporting arrangements.
Scope and application / Audit focus
The Network and Information Systems Regulations 2018, SI 2018/506
Coverage and notification criteria depend on service and designation. The EU NIS2 Directive does not automatically apply as UK domestic law.
Applicability and obligation register
Risk assessment, control testing and evidence
Incident response, reporting and supplier processes
Last verified:
United Kingdom · Information Commissioner’s Office
UK GDPR • DPA 2018
In force · 2018-05-25
The UK data protection framework governs personal data processing, security and individual rights.
Business impact
Maintain lawful bases, accountability records, rights handling and breach assessment.
Scope and application / Audit focus
UK General Data Protection Regulation and Data Protection Act 2018, as amended
The Data (Use and Access) Act 2025 amends rather than replaces UK GDPR and DPA 2018. Most Part 5 data protection changes commenced on 5 February 2026; commencement remains provision-specific.
Applicability and obligation register
Risk assessment, control testing and evidence
Incident response, reporting and supplier processes
General information. Assess scope, sector, thresholds and transitional provisions for each organization. The official text controls.
Country selection changes the legal information shown; it does not change governing contract law or the provider’s privacy documents.
Do you accept cookies?
We use mandatory cookies for secure use and analytics cookies for visitor measurement only with your consent. Even if you decline, you can use the site. Cookie Policy · Personal data notice (Turkey — KVKK)