Information services cover very different operations — data processing and hosting, web portals and search, news agencies and media monitoring — but they share one defining regime: data protection. This path takes you through it in order: put the shared duties in place, then follow the rules for your kind of service, and finish by checking you have covered everything.
Step 1 — Put the shared duties in place
Every information service must handle personal data lawfully as controller and processor, register with the ICO and pay the data protection fee, follow the electronic marketing and cookie rules, insure its employees, and keep the workplace safe, fire-safe and free of discrimination.
Step 2 — Follow the rules for what you operate
Now work through the guide for your kind of information service. If you run more than one kind of service, follow each relevant guide.
If you process or host data, or run a portal or search service
Check whether the NIS Regulations catch your service (cloud computing, online search and online marketplaces at or above the size threshold) and whether the Online Safety Act applies (user-to-user and search services), then put the duties that apply in place.
If you run a news agency or other information service
Manage copyright in both directions — your own output and what you copy from other publishers — decide your press self-regulation position, and check your Online Safety Act position.
Step 3 — Confirm you are compliant
Work through the information services compliance checklist to confirm every obligation that applies to your business is in place.