Respond to an Ofcom investigation

Check your correspondence carefully. Ofcom uses a graduated enforcement toolkit and the type of action determines your obligations and the urgency of your response.

Ofcom enforcement escalation (least to most severe)

• Information notice (s.103): Ofcom requires information about your service, compliance measures, or user data. You must respond by the deadline stated in the notice. Failure to comply is a criminal offence
• Skilled person's report (s.112): Ofcom requires you to commission an independent expert report on your compliance. You bear the cost
• Provisional notice of contravention (s.121): Ofcom considers your service is failing to comply. You have a right to make representations before a final decision
• Confirmation decision (s.122): Ofcom confirms the contravention. May include requirements to take specific steps, a financial penalty, or both
• Business disruption measures (ss.130-138): In the most serious cases, Ofcom can seek court orders requiring ISPs, payment providers, or advertisers to withdraw services from you

Regardless of the type of enforcement action, take these steps within 48 hours to protect your position.

• Obtain specialist legal advice: Instruct a solicitor experienced in telecommunications and online safety regulation before responding substantively to Ofcom. This is essential for provisional notices and confirmation decisions
• Preserve all records: Do not delete, alter, or destroy any documents, system logs, content moderation records, risk assessments, or correspondence. Destroying or altering information required by Ofcom is a criminal offence under section 109
• Note the response deadline: Ofcom notices specify deadlines. Request an extension in writing before the deadline if you need more time
• Identify named senior managers: If you responded to an information notice naming senior managers, those individuals face personal criminal liability and should seek separate legal advice
• Notify your professional indemnity insurer: Many PI policies require prompt notification of regulatory proceedings

The Online Safety Act creates personal criminal liability for senior managers in a way that goes beyond most other UK regulatory frameworks. This is not a theoretical risk.

How you respond affects the outcome. Ofcom considers cooperation, remedial action, and the seriousness and duration of the breach when determining penalties.

Key considerations

• Cooperation: Full and prompt cooperation is a mitigating factor. Evasion, delay, or obstruction is an aggravating factor that can increase penalties
• Representations: If you have received a provisional notice, you have a right to make representations before Ofcom issues a confirmation decision. Use this opportunity — it is your formal chance to present your case
• Voluntary remediation: Proactively fixing compliance gaps and demonstrating improvement before Ofcom requires it shows responsible management
• Penalty mitigation: Ofcom must ensure penalties are proportionate. Factors include the seriousness and duration of the breach, your turnover, any gain from the contravention, and steps taken after the breach was identified
• Appeal: You can appeal a confirmation decision or penalty to the Upper Tribunal. The appeal deadline will be stated in the decision

Whether or not Ofcom takes formal action, use this as an opportunity to close compliance gaps. Regulators view proactive improvement favourably and it reduces the risk of escalation or repeat enforcement.

Record lessons learned and maintain evidence of all improvements. Ofcom may follow up and will expect demonstrable progress against any issues identified.