Journey

Run a tech business

Ongoing compliance, operations, and growth guidance for established UK tech and software businesses

Technology & Digital Running Updated 3 November 2026

Data protection and privacy compliance
UK GDPR compliance is fundamental for tech businesses. Review your data practices regularly, especially when launching new features or processing new data types.

Data protection for businesses

Understand your obligations for processing personal data, from lawful bases to data subject rights

Data protection fees

Most tech businesses must pay an annual data protection fee to the Information Commission (formerly the ICO). The amount depends on your turnover and staff numbers.

Tier 1 (micro organisations)

£52/year (max 10 staff, under £632K turnover)

Tier 2 (small/medium)

£78/year (under 250 staff, under £36M turnover)

Tier 3 (large)

£3,763/year (250+ staff or £36M+ turnover)

Effective date

From February 2025

Exemptions

Some charities and public authorities exempt

Most organisations processing personal data must pay an annual data protection fee to the Information Commission (formerly the ICO). The tier depends on your staff numbers and turnover.

Information Commission data protection fee (opens in a new tab)

International data transfers

Requirements for transferring personal data outside the UK

Data breach response

Know the 72-hour reporting rule and how to respond to data breaches
GDPR penalty scale

Fines from the Commission can reach 4% of annual turnover or £17.5 million. Data protection failures can also trigger class action lawsuits from affected users.
The Commission can issue administrative fines under UK GDPR Article 83 and DPA 2018 Section 157. There are two tiers of maximum fines depending on the type of infringement.

Higher tier maximum

£17.5 million or 4% of annual worldwide turnover, whichever is HIGHER

Higher tier applies to

Breaches of data protection principles (Article 5), lawful basis requirements (Articles 6, 7, 9), data subject rights (Articles 12-22), unlawful international transfers (Articles 44-49)

Standard tier maximum

£8.7 million or 2% of annual worldwide turnover, whichever is HIGHER

Standard tier applies to

Failure to comply with controller/processor obligations, processing children's data incorrectly, certification failures, breach notification failures

Infringements attracting higher tier fines (£17.5m / 4%)

Breaching data protection principles (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability)

Processing without valid lawful basis

Failing to obtain valid consent where required

Processing special category data without a valid condition

Failing to respect data subject rights (access, rectification, erasure, portability, objection)

Unlawful transfers of personal data to third countries

Infringements attracting standard tier fines (£8.7m / 2%)

Failure to comply with controller or processor obligations under Chapter IV

Processing children's data incorrectly (Article 8)

Failure to notify data breaches to the Commission within 72 hours

Failure to notify individuals of high-risk breaches

Failure to comply with certification requirements

Multiple infringements

For same or linked processing operations, total fine cannot exceed amount for gravest infringement

Unlinked operations

Separate fines for unlinked operations can exceed statutory maximum when summed

Information Commission approach

Fines should be effective, proportionate, and dissuasive in each individual case

Legislation reference

UK GDPR Article 83, DPA 2018 Sections 155-157

ICO fining guidance (opens in a new tab)

ICO enforcement actions (opens in a new tab)
Electronic marketing and cookie compliance

PECR works alongside UK GDPR to regulate cookies, email marketing, and electronic communications. Get this wrong and the Commission can fine you up to £17.5 million or 4% of worldwide annual turnover, whichever is higher.

Electronic marketing rules (PECR)

Understand consent requirements for email, SMS, and phone marketing

PECR enforcement penalties

Review your cookie consent mechanism regularly. Many cookie banners fail to meet legal requirements - genuine consent means making rejection as easy as acceptance.

From 5 February 2026, maximum penalties for PECR breaches have been aligned with UK GDPR levels under the Data (Use and Access) Act 2025.

Previous maximum fine

£500,000

New maximum fine (from 5 February 2026)

£17.5 million or 4% of global annual turnover, whichever is higher

Effective date

5 February 2026

Legal basis

Data (Use and Access) Act 2025

Applies to

Unlawful email/SMS marketing, telemarketing, cookies/tracking breaches

Regulator

Information Commission

Common PECR breaches

Unsolicited marketing, ignoring opt-outs, manipulative cookie consent

ICO enforcement (2022-2025)

49 PECR fines totalling £4.63 million

Average fine (pre-2025)

£94,490

Expected focus areas

Mass unsolicited communications, TPS/CTPS violations, deceptive consent flows

ICO PECR enforcement guidance (opens in a new tab)

Tip

Cookie consent best practice

Implement a compliant cookie consent banner that gives users a real choice. Pre-ticked boxes and dark patterns that push users toward accepting cookies do not give valid consent.
Official guidance (opens in a new tab)
Digital service regulations

If you operate a platform with user-generated content, search functionality, or cloud services, you may be subject to the Online Safety Act or NIS Regulations.

Online Safety Act compliance

Compliance requirements for platforms hosting user-generated content

Platform categorisation thresholds

The Online Safety Act categorises platforms by user numbers and functionality. Category 1 platforms face the strictest requirements.

The Online Safety Act 2023 sorts the largest user-to-user and search services into categories by UK user numbers and features, and gives each category extra duties. Ofcom decides which services meet the thresholds in the Category 1, Category 2A and Category 2B Threshold Conditions Regulations 2025, using the average number of monthly active UK users over six months.

Category 1 (Option A)

Over 34 million UK users + content recommender system

Category 1 (Option B)

Over 7 million UK users + recommender + sharing functionality

Category 2A (Search engines)

Over 7 million UK users (non-vertical search engines)

Category 2B (Direct messaging)

Over 3 million UK users + direct messaging functionality

Fee threshold (Qualifying Worldwide Revenue)

£250 million

Maximum penalty

£18 million or 10% of qualifying worldwide revenue (whichever is greater)

What platform categories mean

Every regulated user-to-user and search service, whatever its size, must carry out an illegal content risk assessment, deal with illegal content, and provide content reporting and complaints procedures. Every service likely to be accessed by children must also carry out a children's risk assessment and meet the duties to protect children's online safety (sections 7(4) and 24(4)). Categorisation adds duties on top of these.

Category 1 services have the most extra duties. They include duties to give adult users tools to control what they see, to protect content of democratic importance, news publisher content and journalistic content, and to tackle fraudulent advertising (sections 7(5) and 38).

Category 2A search services have extra duties on fraudulent advertising in search results, and on publishing risk assessment summaries and keeping records (sections 24(5) and 39).

Category 1, 2A and 2B services can all be required by Ofcom to publish annual transparency reports (section 77).

Implementation timeline

Key compliance deadlines are staggered. Check which apply to your platform type.

Illegal content duties in force

Since 17 March 2025

Children's safety duties in force

Since 25 July 2025

Illegal content risk assessment for a new service

Within 3 months of launch

Children's access assessment for a new service

Within 3 months of the service becoming available to UK users

Children's risk assessment

Within 3 months of concluding that children are likely to access the service

Before a significant change to the service

Carry out a new risk assessment first

Fee notification

Each charging year, if qualifying worldwide revenue is £250 million or more

The Online Safety Act 2023 duties are in force. Every service in scope must already have an illegal content risk assessment and a children's access assessment. A new service has 3 months from launch to complete both. Keep your assessments up to date, and carry out a new risk assessment before you make a significant change to your service.

Ofcom Online Safety guidance (opens in a new tab)

Meet your duties under the NIS Regulations

You are covered if you provide an essential service in energy, transport, health, drinking water or digital infrastructure above set thresholds, or run an online marketplace, search engine or cloud computing service.

NIS applicability

NIS Regulations apply to operators of essential services and relevant digital service providers including cloud, online marketplaces, and search engines.

The Network and Information Systems (NIS) Regulations 2018 apply to operators of essential services (OES) in the energy, transport, health, drinking water and digital infrastructure sectors, and to relevant digital service providers (RDSP): online marketplaces, online search engines and cloud computing services whose head office is in the United Kingdom, or that have nominated a UK representative, and that are not micro or small enterprises (regulation 1(3)).

OES sectors

Energy, transport, health, drinking water, digital infrastructure

RDSP services

Online marketplaces, online search engines, cloud computing

RDSP size exemption

Micro and small enterprises, as defined in Commission Recommendation 2003/361/EC

RDSP UK link

Head office in the UK, or a nominated UK representative

Incident notification

No later than 72 hours after becoming aware of the incident

Penalty maximum

£17 million for the most serious breaches

GCHQ role

Single point of contact and computer security incident response team

Competent authorities
Each OES has a designated competent authority under Schedule 1. The Information Commission (formerly the ICO) is the competent authority for RDSPs (regulation 3).

Energy competent authority

Secretary of State for Energy Security and Net Zero; acts jointly with the Gas and Electricity Markets Authority for electricity and most gas

Transport competent authority

Secretary of State for Transport (air: jointly with the Civil Aviation Authority); road in Scotland: Scottish Ministers

Health competent authority

Secretary of State for Health (England), Welsh Ministers, Scottish Ministers

Drinking water competent authority

Secretary of State for Environment, Food and Rural Affairs (England), Welsh Ministers, Drinking Water Quality Regulator for Scotland

Digital infrastructure competent authority

Office of Communications (Ofcom)

Northern Ireland

Department of Finance (Northern Ireland) for energy, rail, road, health and drinking water

Relevant digital service providers

Information Commission

NIS Regulations guidance (opens in a new tab)

Info

Cross-border platform operators

Online Safety Act applies to user-to-user services and search services accessible in the UK, regardless of where your company is based. If you have UK users, you are likely in scope.
Official guidance (opens in a new tab)
E-commerce and consumer rights
Selling software, SaaS, or digital products online triggers specific legal requirements around pre-contract information, cancellation rights, and consumer remedies.

E-commerce regulations for online selling

Legal requirements for selling online including pre-contract information and delivery rules
Consumer rights for digital content

Digital content consumers have different refund rights than physical goods. Ensure your terms and checkout flow handle this correctly.
What is digital content?

Digital content means data produced and supplied in digital form, including:

Software and applications

Music, video, and e-books

Games and in-game content

SaaS and cloud services

Digital downloads

Rights for digital content

Digital content must be:

Satisfactory quality: Meets standard a reasonable person would consider satisfactory (free from bugs, fit for common purposes)

Fit for particular purpose: Suitable for any specific purpose the consumer made known

As described: Matches any description, demonstration, or sample

Consumer remedies

If digital content doesn't meet these standards:

Repair or replacement first: Unlike goods, digital content has no 30-day short-term rejection right - repair/replacement is the first remedy

If repair/replacement fails: Right to price reduction or refund

No 30-day rejection: Digital content remedies differ from physical goods - be aware of this distinction

Compensation for damage

If faulty digital content damages a consumer's device or other digital content, you may be liable for repair or compensation.

Pre-contract information requirements

Before purchase, you must provide:

Main characteristics of the digital content

Functionality and compatibility requirements

Whether ongoing updates will be provided

Total price including taxes

Step 1

Test software thoroughly before release to ensure satisfactory quality

Step 2

Clearly describe functionality, features, and system requirements

Step 3

Provide prominent information about compatibility and device requirements

Step 4

Implement quality assurance processes to identify bugs before release

Step 5

Create clear terms of service explaining update policies and support duration

Step 6

Establish customer support channels for reporting issues

Step 7

Develop procedures for handling refund requests within legal timeframes

Step 8

Include warranty information and consumer rights in purchase confirmation

Step 9

For subscription services, clearly state trial periods and cancellation terms

Step 10

Document all testing and quality control measures

Consumer Rights Act guidance (opens in a new tab)
Distance selling requirements

Understand the 14-day cooling-off period and cancellation rules for digital products

Cooling-off period

Consumers can cancel within 14 days unless they gave explicit consent to immediate digital content download and acknowledged losing cancellation rights.

Cooling-off period

14 days after delivery

Extension without cancellation information

12 months after the normal period ends

Cancellation information given late

Period ends 14 days after customer receives it

Customer return deadline

14 days after cancelling

Return, trader offered to collect

Trader collects; customer need not send goods back

Refund deadline, customer returns goods

14 days after goods or proof of return received

Refund deadline, trader collects

14 days after trader is told of cancellation

Refund includes

Standard delivery charge

Return postage

Customer pays

Return postage, trader offered free returns

Trader pays

Return postage, customer not told beforehand

Trader pays

Fee for refunding

Not permitted

Deduction for handling

Only for excess handling; barred where cancellation information was not given

Digital content

Right lost once download starts with consent and acknowledgement
Managing contractors and IR35
Tech businesses often rely on contractors and freelancers. Getting IR35 wrong can result in significant tax liabilities and penalties.

IR35 off-payroll working rules

Understand off-payroll working rules and who determines employment status

Small company exemption thresholds

Small companies are exempt from making IR35 determinations - the contractor remains responsible. Check if you meet the thresholds.

Annual turnover

Not more than £15 million

Balance sheet total

Not more than £7.5 million

Average employees

Not more than 50

Criteria to meet

2 of 3 thresholds

Assessment period

Previous financial year

Accounting periods from

1 April 2025

IR35 exemption earliest from

6 April 2027 (requires 2 consecutive qualifying years)

Two-year qualification requirement

Company must meet 2 of 3 criteria for both 2025/26 and 2026/27 financial years before IR35 exemption applies

Previous turnover threshold

£10.2 million (before April 2025)

Previous balance sheet threshold

£5.1 million (before April 2025)

Who determines status

Medium and large businesses must determine contractor status and can be liable for tax if determinations are incorrect. Keep detailed records of your reasoning.

Small private sector clients

Contractor (through PSC) determines own status

Medium/large private sector clients

Client must determine status and issue Status Determination Statement (SDS)

Public sector clients

Client always determines status and operates PAYE if inside IR35

Status Determination Statement

Written statement with reasons, required from medium/large clients

Disagreement process

Client must respond to status disagreements within 45 days
Employment status tests

Key factors include personal service, mutuality of obligation, and control. Use HMRC's CEST tool but understand its limitations.
Key tests for determining IR35 status:

Control: Does the client control how, when, and where work is done?

Substitution: Can the contractor send a substitute to do the work?

Mutuality of obligation: Is there obligation to offer work and accept it?

Financial risk: Does the contractor bear financial risk?

Equipment provision: Does the contractor provide own tools/equipment?

Part of organisation: Is the contractor integrated into the client's business?

HMRC status tool

Check Employment Status for Tax (CEST)

Inside IR35

Taxed as employee - PAYE and NI deducted

Outside IR35

Taxed as self-employed business
Warning

IR35 compliance documentation

Document your reasoning for each contractor engagement. If HMRC challenges a determination, you need evidence showing you took reasonable care. Consider obtaining professional advice for borderline cases.
Official guidance (opens in a new tab)
Protecting your intellectual property
Your code, designs, and branding are valuable assets. Understanding IP protection helps you defend your work and avoid infringing others' rights.

Software intellectual property

Copyright, patents, and trade secrets for software and technology
Software copyright protection

Copyright protects your source code automatically - no registration needed. But ensure contractor agreements assign IP to your company.
Software automatically receives copyright protection in the UK as soon as you create it. No registration is required and there is no cost.

Your source code is protected as a "literary work" under UK copyright law, giving you exclusive rights to control copying, distribution, and adaptation of your software.

Protection type

Automatic (no registration required)

Classification

Literary work

Cost

£0 (free automatic protection)

Duration (human author)

Life + 70 years from end of calendar year of death

Duration (computer-generated)

50 years from creation

Database rights

Automatic + 15 years from creation

Registration required

None

International protection

Extends internationally through treaties

What copyright protects

Copyright protection applies to:

Source code (in any programming language)

Object code and compiled binaries

Database structures and content

Software documentation

User interfaces (as artistic works)

Copyright does not protect ideas, methods, or algorithms themselves – only the specific expression of them in your code.

Copyright for employees vs contractors

If your employees write code as part of their employment, your company automatically owns the copyright (unless your employment contract states otherwise).

If you hire contractors or freelancers to write code, the contractor owns the copyright by default – must have a written agreement assigning copyright to your company.

Copyright protection guidance (opens in a new tab)
Software patent eligibility

Software patents are possible but must demonstrate a technical contribution beyond the program itself. Patent applications are expensive - consider whether they are justified.
Computer programs "as such" are excluded from patenting in the UK. In February 2026 the Supreme Court changed how this exclusion is applied: the four-step Aerotel test should no longer be followed, and UK law now interprets the exclusion in the same way as the European Patent Office. Software is no longer excluded just because it runs on a computer, but features that are not technical are unlikely to count towards an inventive step.

Pure business methods, mathematical algorithms, and programs that only manipulate data without external technical effect cannot be patented, regardless of how clever or commercially valuable they are.

Basic legal position

Computer programs 'as such' are excluded from patentability

Key requirement

Software is no longer excluded from patenting just because it runs on a computer, but features that are not technical are unlikely to count towards an inventive step

Test applied

The European Patent Office approach (decision G1/19), following Emotional Perception AI Ltd v Comptroller-General [2026] UKSC 3. IPO guidance is being updated

Assessment principle

Substance not form – what the invention actually achieves matters

Patentable example

✅ Driverless car control software (technical process outside computer)

Patentable example

✅ Image processing algorithms (solve technical problem)

Patentable example

✅ X-ray machine control systems (external technical effect)

Non-patentable example

❌ Chess playing app (non-technical purpose)

Non-patentable example

❌ Trading system business logic (pure business method)

Non-patentable example

❌ Text analysis algorithms (data manipulation without external effect)

How the test changed in 2026

In Emotional Perception AI Ltd v Comptroller-General [2026] UKSC 3 (11 February 2026) the Supreme Court held that the Aerotel test should not be followed and that the UK should adopt the European Patent Office's interpretation in decision G1/19. Under that approach:

a claim that involves a computer or other technical means is not excluded simply for being a computer program "as such"

only the features that contribute to the technical character of the invention count when deciding whether it involves an inventive step

In practice, it may be easier to get past the exclusion but no easier to show an inventive step for software whose contribution is not technical. The IPO has said its Manual of Patent Practice will be updated to reflect the judgment. Get advice from a patent attorney before filing.

Five AT&T signposts for technical contribution

These signposts come from case law decided under the Aerotel approach and may be revised when the IPO updates its guidance. Your software is more likely to be patentable if it demonstrates one or more of these technical characteristics:

1. External technical process

Does your program solve a technical problem outside the computer? Examples: controlling physical machinery, processing sensor data, optimising drill bit design.

2. Architecture-level effect

Does your program improve computer operation regardless of what data or applications are running? Examples: operating system improvements, memory management, processor optimisation.

3. New computer operation

Does your program make the computer operate in a fundamentally new way, beyond merely running a new program?

4. Efficiency enhancement

Does your program make the computer function more efficiently overall, not just for specific applications?

5. Technical problem solution

Does your invention solve (not circumvent) a genuine technical problem, either internal or external to the computer?

Non-technical contributions (cannot be patented)

Pure business methods implemented on a computer (e.g., trading systems, accounting methods)

Improved algorithms for mathematical operations (e.g., faster square root calculation)

Data manipulation without external effect (e.g., text analysis, document storage formats)

Generic "makes computer work better" claims without demonstrated technical improvement

User interface designs based purely on aesthetic or usability preferences

The mere presence of a computer does not make an invention technical. The contribution must go beyond implementing a known process on standard computer hardware.

Manual of Patent Practice - Section 1: Patentability (opens in a new tab)

Guidelines for examining AI patent applications (opens in a new tab)
Protect your intellectual property

Comprehensive guide to trademarks, patents, and design rights
Trademark registration

Register your brand name and logo as trade marks. Registration lasts 10 years from filing, and the fee depends on how many classes you apply in.
A trade mark protects your brand identity - including business names, logos, slogans, sounds, and colours. Registration gives you exclusive rights to use your trade mark for the goods and services you register it for, and the right to take legal action against anyone who uses it without permission.

Application fee (1 class, online)

£205

Each additional class

+£60 per class

Examination report

Usually within 2 to 3 weeks

Time to resolve objections

2 months

Opposition period

2 months after publication

Total registration time

3 to 4 months if no objections

Protection duration

10 years from filing date

Renewal fee (1 class)

£245 every 10 years

Renewal fee additional classes

+£60 per class

Important considerations
You must use your trade mark within 5 years of registration, or it can be cancelled for non-use.
UK registration protects your mark only in the UK. For protection in the EU, apply for an EU trade mark. For other countries, consider the Madrid Protocol system.
Consider using a trade mark attorney for complex applications, especially if your mark is similar to existing marks or covers several classes.
The examiner may raise objections to your application. You can often resolve them by amending the application or explaining why the mark should be registered.

Register a trade mark (opens in a new tab)
Software licensing compliance

Ensure you comply with open source and third-party software licences

Tip

Open source licence review

Review third-party licence terms before incorporating open source code. Some licences (GPL, AGPL) have copyleft provisions that could affect your entire codebase. Consider using tools to audit your dependencies.
Cybersecurity requirements
Beyond being good practice, cybersecurity is increasingly a legal and commercial requirement. Cyber Essentials is mandatory for many government contracts.

Cyber security basics for small businesses

Most cyber attacks on small businesses can be prevented cheaply.

Cyber Essentials certification

Two certification levels: basic (self-assessment, from £320 plus VAT) and Plus (external testing, priced by quote). Valid for 12 months.

Cyber Essentials is a government-backed, industry-supported scheme to help organisations protect against common online threats. The scheme helps protect against almost all cyber threats and is administered by the National Cyber Security Centre (NCSC).

Over 215,000 certificates have been awarded, with 49,248 issued in the past 12 months. Organisations implementing the controls see a 92% reduction in insurance claims.

Certificate validity

12 months (annual renewal required)

Basic level process

Self-assessment questionnaire reviewed by Certification Body (1-3 business days)

Plus level process

First obtain basic certification, then technical audit with authenticated vulnerability scanning

Plus includes

Authenticated vulnerability scanning, configuration checks, validation of all five controls

Current question set

Danzell, effective 27 April 2026

Previous question set

Willow, effective 28 April 2025 and now superseded

Accreditation body

IASME (sole accreditation body since April 2020)

Number of Certification Bodies

Over 350 across UK and Crown Dependencies

Government contract requirement

Mandatory for suppliers bidding on certain public sector contracts involving personal data or ICT services
Five technical controls

Cyber Essentials focuses on five technical controls that prevent most common attacks.
Cyber Essentials sets its requirements under five technical controls. The NCSC document Requirements for IT Infrastructure v3.3 (April 2026) states them. Your organisation must meet every requirement for the scope you set, and cloud services cannot be excluded from scope.
Firewalls: protect every device in scope with a correctly configured firewall, change default administrative passwords or disable remote administration, block unauthenticated inbound connections by default, and document and approve inbound rules with the business need.
Secure configuration: remove or disable unnecessary accounts and software, change default passwords, disable auto-run, and protect device unlock credentials against brute-force guessing.
Security update management: use licensed, supported software, turn on automatic updates where possible, and apply updates for critical or high-risk vulnerabilities within 14 days.
User access control: create and approve accounts through a process, give each user unique credentials, remove accounts and privileges when no longer needed, and use separate accounts for administration.
Malware protection: run active anti-malware software on every in-scope device, or allow only approved, code-signed applications to run.

Firewalls

Every device protected; inbound connections blocked by default

Secure configuration

Unnecessary accounts and software removed; default passwords changed

Device unlock limits

No more than 10 guesses in 5 minutes, or lock after no more than 10 failed attempts

Device unlock length

At least 6 characters for a PIN or password that only unlocks a device

Security update management

Critical or high-risk fixes within 14 days

Critical or high-risk

CVSS v3 base score of 7 or above, or rated critical or high risk by the vendor

User access control

Unique credentials; separate administrator accounts

Multi-factor authentication

Use where available; always for cloud services

Passwords without multi-factor authentication

At least 12 characters, or 8 with a deny list

Malware protection

Active anti-malware, or application allow listing with code signing

Cyber Essentials scheme overview (opens in a new tab)
Cyber Essentials certification

Get certified to demonstrate security standards and win government contracts

Cyber incident reporting

Know who to report incidents to. Report data breaches to the Commission within 72 hours if they pose a risk to individuals.

Different cyber incidents are reported to different authorities. Know your reporting obligations and keep the key contacts to hand.

Cyber crime reporting (England, Wales, NI)

Report Fraud (formerly Action Fraud) - reportfraud.police.uk or 0300 123 2040

Cyber crime reporting (Scotland)

Police Scotland on 101 (Report Fraud does not cover Scotland)

Report Fraud phone hours

Monday-Friday 8am-8pm (24/7 for organisations under live attack)

Report Fraud from abroad

+44 300 123 2040

Data breach reporting (all UK)

Information Commission at ico.org.uk/for-organisations/report-a-breach (within 72 hours if risk to individuals)

Information Commission helpline

0303 123 1113 (Monday-Friday 9am-5pm)

Phishing email reporting

NCSC Suspicious Email Reporting Service (SERS) - forward to report@phishing.gov.uk

NCSC Cyber Incident Response (CIR) Scheme

NCSC-assured incident response providers

NHS organisations (NIS OES in England)

NHS England, within 72 hours

Financial services firms

FCA or PRA, under your firm's notification procedures

Operators of Essential Services

Sector regulator, within 72 hours

Digital service providers

Information Commission, within 72 hours if impact is substantial

Under active cyber attack (need help)

NCSC and a CIR provider, immediately

Report Fraud limits

Does not guarantee an investigation or advise on reports

Why report anyway

Builds the national intelligence picture

Info

Government contract requirements

Cyber Essentials Plus is increasingly required for government contracts handling sensitive data. Consider certification as a competitive advantage even if not yet required.
Official guidance (opens in a new tab)
AI regulation and emerging technology

The UK takes a pro-innovation, sector-specific approach to AI regulation. However, existing laws (GDPR, Equality Act, consumer protection) apply to AI systems.

AI regulation framework

Current UK approach to AI regulation and the five principles framework

UK AI five principles

UK regulators apply these five principles proportionately across sectors. No single AI-specific law, but existing laws apply.

The UK government's AI regulatory framework is based on five cross-cutting principles that existing sector regulators must apply within their remits. These principles were established in the March 2023 White Paper and confirmed in the February 2024 consultation response.

The principles are not currently on a statutory footing. Regulators are expected to apply them but are not legally required to do so. The government has announced that a comprehensive AI Bill (expected second half of 2026) may place these principles on a statutory basis.

Principle 1

Safety, security and robustness — AI systems should function in a robust, secure and safe way throughout their lifecycle

Principle 2

Appropriate transparency and explainability — people should be able to access information about AI systems that affect them

Principle 3

Fairness — AI systems should not undermine legal rights, discriminate unfairly, or create unfair market outcomes

Principle 4

Accountability and governance — governance measures should ensure effective oversight with clear lines of accountability

Principle 5

Contestability and redress — people should be able to contest AI outcomes where rights have been violated or harm has occurred

Statutory basis

Non-statutory (regulators expected to apply, not legally required)

White Paper published

29 March 2023

Consultation response

6 February 2024

DSIT regulator support funding

£10 million to boost regulator AI capabilities

Info

Automated decision-making under GDPR

While there is no specific AI Act in the UK, data protection law restricts significant decisions made solely by automated means. Individuals must be told about the decision and be able to contest it and ask for human intervention. Ensure your AI systems can provide meaningful explanations.
Official guidance (opens in a new tab)
Export controls for dual-use technology
Exporting certain technology, software, and cryptographic products may require a licence. This includes dual-use items with potential military applications.

Export control for dual-use technology

When you need an export licence for technology and software
Tech export controls

Dual-use controls cover encryption software, cyber-surveillance tools, and technology with potential military applications.
Controlled items

You need an export licence for:

Cryptography: Encryption software exceeding certain key lengths (56-bit symmetric, 512-bit asymmetric thresholds, with exceptions for mass-market products)

Intrusion software: Tools designed to avoid detection by monitoring tools or defeat protective countermeasures

Surveillance technology: Interception, monitoring, or forensic analysis tools

Dual-use technology: Software/tech with potential military applications (network analysis, cybersecurity tools beyond certain thresholds)

Technology transfer: Technical data, blueprints, know-how for developing controlled items

What counts as export?

Export includes:

Physical export from the UK

Electronic transmission to persons outside the UK (including cloud storage)

Making technology available to non-UK nationals in the UK

Providing services enabling use of controlled items abroad

Mass-market cryptography exemption

Generally available encryption products sold through retail channels without restriction may be exempt, but you must submit a classification request for confirmation.

Open source exemption

Cryptographic software in the public domain (open source) may be exempt, but notification to Export Control Joint Unit may be required.

Embargoed destinations

Additional restrictions apply for exports to sanctioned countries (Russia, Belarus, Iran, North Korea, Syria, etc.). Check current sanctions before any export.

Step 1

Review your software and technology against the dual-use list in Annex I of the Export Control Order

Step 2

For cryptography, determine key lengths and whether products qualify as mass-market

Step 3

Submit classification requests to Export Control Joint Unit if uncertain

Step 4

For controlled items, apply for export licence before shipping or transmitting

Step 5

Check destination country against current UK sanctions lists

Step 6

Implement internal compliance procedures to screen customers and destinations

Step 7

Train staff on export control obligations, especially sales and technical teams

Step 8

Maintain records of export licence applications and decisions

Step 9

For cloud services, consider data residency implications

Step 10

If open source, determine if notification to ECJU is required

Export controls for technology (opens in a new tab)
UK export licensing controls

Understanding UK strategic export controls and the licensing process

Export control penalties

Exporting controlled technology without a licence is a criminal offence. Penalties include unlimited fines and up to 10 years imprisonment.

Maximum imprisonment

10 years for criminal conviction

Criminal fines

Unlimited

Civil penalties

Up to 3 times value of goods (record: £1.16 million in 2025)

Enforcement authority

HMRC (criminal) and Export Control Joint Unit (licensing)

Voluntary disclosure benefit

50-70% penalty reduction if you self-report immediately

Export control breaches are taken extremely seriously. Recent enforcement shows million-pound penalties are increasingly common, with the record £1.16 million civil settlement in 2025 described as a 'wake up call for UK exporters'.
HMRC has primary enforcement responsibility and can offer compound settlements (civil penalties) as alternative to criminal prosecution. The Export Control Joint Unit conducts compliance inspections with statutory rights to review your export records.

ECJU contact for compliance advice (opens in a new tab)

Export control red flags

Know the warning signs that suggest diversion to end-users of concern.

Customer red flags
• Reluctance to provide end-use information or vague responses
• Unfamiliarity with product technical details
• Requests for unusual specifications
• Willingness to pay significantly above market price
• Requests for non-standard shipping or routing
• No established business in relevant sector
• Located in high-risk jurisdiction
• Previous export control violations
Transaction red flags
• Ship to freight forwarder instead of end-user
• Request for labeling inconsistent with end-use
• Requests to falsify documents
• Cash payments or unusual financial arrangements
• Multiple intermediaries without clear reason
• Last-minute destination changes
• Secrecy about final destination
Product red flags
• Orders inconsistent with customer's business
• Quantities inconsistent with stated use
• Equipment beyond customer's technical capacity
• Discussion of controlled items without mentioning licensing

Export control compliance (opens in a new tab)

Warning

Encryption software controls

Strong encryption software may require export licences. The UK Control List includes cryptographic items at Category 5. Check before exporting security software to any destination.
Official guidance (opens in a new tab)
Ongoing compliance and growth

As your tech business grows, compliance requirements change. Monitor thresholds for VAT, audit exemptions, and enhanced regulatory obligations.

Company size thresholds

Company size determines audit requirements, IR35 responsibility, and other obligations. The thresholds apply to financial years beginning on or after 6 April 2025.

The limits below apply to financial years beginning on or after 6 April 2025, following the Companies (Accounts and Reports) (Amendment and Transitional Provision) Regulations 2024 (SI 2024/1303). A financial year that began before that date uses the previous, lower limits. Your size decides which accounts you prepare and whether your company is exempt from audit.

Micro-entity

Turnover £1m or less, balance sheet total £500,000 or less, 10 employees or fewer

Small company

Turnover £15m or less, balance sheet total £7.5m or less, 50 employees or fewer

Medium-sized company

Turnover £54m or less, balance sheet total £27m or less, 250 employees or fewer

Large company

Does not meet two of the three medium-sized limits

A company meets a size band if it satisfies at least two of the three limits. In its first financial year it qualifies if it meets them in that year. After that, meeting or ceasing to meet the limits changes its size only if that happens in two consecutive financial years. The number of employees is the average over the year. Turnover limits are adjusted pro rata for a financial year shorter or longer than 12 months.

A company that qualifies as small, which includes a micro-entity, can claim exemption from audit unless it is excluded from the exemption, for example because of the type of business it carries on. A medium-sized or large company cannot use the small companies audit exemption.

Win public sector contracts

Find public sector opportunities, work out which rules apply to a contract, and put in a tender that scores well.

Tip

Annual compliance calendar

Set calendar reminders for annual compliance tasks: data protection fee renewal, Cyber Essentials recertification, reviewing your data protection practices, and filing deadlines. Proactive compliance is cheaper than reactive firefighting.

Official guidance

Quick guide to online safety risk assessments (opens in a new tab)

Ofcom

GOV.UK Online Safety Act collection (opens in a new tab)

GOV.UK

Run a tech business

Data protection and privacy compliance

Electronic marketing and cookie compliance

Digital service regulations

E-commerce and consumer rights

Managing contractors and IR35

Protecting your intellectual property

Cybersecurity requirements

AI regulation and emerging technology

Export controls for dual-use technology

Ongoing compliance and growth

Official guidance

Next steps

Growing your business

Start importing goods to the UK

Transfer ownership of your business

Related journeys

Grow your tech business

Start a fintech business

Meet your data protection obligations

Online Safety Act compliance quick check