Run a compliant information service business

Every information service business — a data-processing bureau, a hosting provider, a web portal, a news agency or a media-monitoring service — shares a set of duties that do not depend on what it operates. Data protection leads: information is your product, so the data protection regime is your core compliance work, not a back-office formality. Put these duties in place first, then add the rules for your kind of service.

Handle personal data as controller and processor

You are a controller of the personal data you hold for your own purposes — staff, customers and marketing lists. When you process client data on a client's instructions — hosting it, processing it, compiling it — you are usually also a processor. UK GDPR Article 28 requires a written contract with each controller setting out the processing, your security obligations, and the rules for engaging sub-processors. Map which role you hold for each dataset. Your duties differ by role. This applies UK-wide.

For the operational work, see data protection for businesses, and for client-facing transparency see writing a privacy notice that meets UK GDPR requirements.

Register with the ICO and pay the data protection fee

Unless a narrow exemption applies, you must register with the Information Commissioner's Office and pay the annual data protection fee — for an information service business, processing personal data is the business, so assume you must register unless you have confirmed otherwise. This applies UK-wide.

Follow register with the ICO and pay the data protection fee to do this step by step.

Follow the electronic marketing and cookie rules

If your service sets cookies or similar tracking technologies, or you market by email, SMS or telephone, you must follow the Privacy and Electronic Communications Regulations (PECR), whose consent rules sit alongside and are stricter than the UK GDPR alone. For portals and hosted services that rely on analytics and advertising cookies this is day-one compliance work. Enforced by the ICO. Applies UK-wide.

For the practical steps, see cookie consent and email marketing compliance.

Insure your employees

If you employ anyone — developers, operations staff, journalists or researchers — you must hold employers' liability insurance of at least £5 million from an authorised insurer. This is a duty in Great Britain. Equivalent rules apply in Northern Ireland.

Keep your workplace safe

You owe a general duty to protect employees and others affected by the business — offices, server rooms and data centres included. The Health and Safety at Work etc. Act 1974 applies in Great Britain. Northern Ireland has its own corresponding health and safety order.

Keep your premises fire-safe

The responsible person for non-domestic premises — offices, server rooms and data centres — must carry out and maintain a fire risk assessment. This is devolved: the Regulatory Reform (Fire Safety) Order 2005 covers England and Wales, with the Fire (Scotland) Act 2005 in Scotland and the Fire and Rescue Services (Northern Ireland) Order 2006 in Northern Ireland.

Do not discriminate

You must not discriminate against employees or in services to the public because of a protected characteristic — and for an information service that includes the accessibility of your customer-facing digital services. The Equality Act 2010 applies in England, Scotland and Wales. Northern Ireland has its own equality law enforced by the Equality Commission for Northern Ireland.

Next steps

With the shared duties in place, follow the rules for your kind of information service:

• Data processing, hosting and web portal rules — NIS security duties and Online Safety Act scope
• Rules for news agencies and information services — copyright, press standards, media monitoring

Then confirm everything with the information services compliance checklist.