Information services are businesses built on handling information for others — processing and hosting data, running web portals and search services, supplying news, or monitoring and brokering information. Whatever you operate, the defining regime is data protection: you almost certainly process personal data both as a controller and, for client data, as a processor. Beyond the shared duties, what you must do depends on what you operate. Start with the shared duties, then follow the section for your kind of service — if you do more than one, follow each.
-
Put the shared duties in place
Whatever your service, start with the universal spine. Follow "Run a compliant information service business" for data protection and the ICO fee, electronic marketing and cookie rules (PECR), employers' liability insurance, health and safety, fire safety and equality.
-
If you process or host data, or run a cloud service
Work out whether the NIS Regulations catch what you operate — only cloud computing services at or above the size threshold are in scope from this group — and check your Online Safety Act position if users interact on your service. Your processor contract duties for client data sit in the shared-duties guide. Follow "Data processing, hosting and web portal rules".
-
If you run a web portal or search service
Portals that host user-generated content, and search services, are regulated services under the Online Safety Act 2023, with illegal-content and children's-safety duties phased in through Ofcom codes. Online search engines and marketplaces at or above the NIS size threshold also carry network-security duties. Follow "Data processing, hosting and web portal rules".
-
If you run a news agency or other information service
You own copyright in the news you create and license, must respect third-party rights when you syndicate or monitor media, and most publishers join a press self-regulator (IPSO or Impress) voluntarily. Follow "Rules for news agencies and information services".
-
Confirm you have covered everything
Finish with the information services compliance checklist to confirm every obligation that applies to you is in place.
Legal basis
Primary legislation and key regulations
Browse UK legislation (opens in a new tab) legislation.gov.ukOfficial guidance
ICO — information for organisations (opens in a new tab)
ICO
Ofcom — online safety (opens in a new tab)
Ofcom
Statement: Ofcom's changes to the NIS Guidance on incident reporting thresholds for the digital infrastructure subsector (opens in a new tab)
Ofcom
How should we tell people what we’re doing? (opens in a new tab)
ICO
What is NIS? (opens in a new tab)
ICO
The role of the National Cyber Security Centre (NCSC) (opens in a new tab)
ICO
NIS registration (opens in a new tab)
ICO
Key concepts and definitions (opens in a new tab)
ICO