Respond to a data breach
- 1 step
UK Statutory Instrument
2018
United Kingdom
Network and Information Systems Regulations 2018
At a glance
Who this Act binds
Business-side actors with duties under this Act, ranked by how often they appear.
- Any Person 7
- Operator 2
Plus 9 non-business duties on Crown ministers, regulators, local authorities or tribunals — shown collapsed under each section below.
Step-by-step journeys using this legislation
Walkthroughs that take you from a real business situation to compliance.
Data breach 72-hour checklist
- 1 step
Respond to a cyber attack
- 2 steps
Cyber security fundamentals
- 2 steps
Cyber security quick wins
- 1 step
Grow your construction business
- 1 step
Relevant guidance
Practical guides for businesses affected by this Act, ordered by how closely they engage with it.
Direct — cites this Act
2 guidesSupporting — topic alignment
11 guidesMentioned in related content
1 guidesOther Acts binding the same actors
For each actor bound by this Act, the other UK Acts that bind them most often. Useful for understanding the full compliance landscape facing each role.
Any Person also bound by 2338 other Acts (top 5 shown)
- Human Medicines Regulations 2012 2012 169 duties
- Merchant Shipping Act 1995 1995 144 duties
- Insolvency (England and Wales) Rules 2016 2016 101 duties
- Road Traffic Act 1988 1988 95 duties
- Air Navigation Order 2016 2016 95 duties
Operators also bound by 730 other Acts (top 5 shown)
- Regulation (EU) No 965/2012 (Air Operations) 2012 138 duties
- Commission Implementing Regulation (EU) 2018/2066 of 19 December 2018 on the monitoring and reporting of greenhouse gas emissions pursuant to Directive 2003/87/EC of the European Parliament and of the Council and amending Commission Regulation (EU) No 601/2012 (Text with EEA relevance) 2018 121 duties
- Commission Regulation (EU) No 601/2012 of 21 June 2012 on the monitoring and reporting of greenhouse gas emissions pursuant to Directive 2003/87/EC of the European Parliament and of the Council (Text with EEA relevance) (repealed) 2012 112 duties
- Space Industry Regulations 2021 2021 75 duties
- Regulation (EU) 2016/429 of the European Parliament and of the Council of 9 March 2016 on transmissible animal diseases and amending and repealing certain acts in the area of animal health (‘Animal Health Law’) (Text with EEA relevance) 2016 66 duties
What this Act requires
Sections that create concrete duties on businesses or carry penalties. Procedural and definitional sections are folded into the “Browse other sections” expander at the bottom of each group. Click any section title to read the source text on legislation.gov.uk.
Part 1 — Introduction
Browse 1 other section in this Part — procedural / definitional / commencement
Part 2 — The National Framework
Designation of national competent authorities
Other duties (1) — Crown / regulator
- Regulators must provide guidance and maintain lists of essential services Statutory regulator
Designation of the single point of contact
Other duties (1) — Crown / regulator
- GCHQ (SPOC) must cooperate with enforcement authorities Statutory regulator
Designation of computer security incident response team
Other duties (1) — Crown / regulator
- GCHQ (as CSIRT) must monitor and support UK businesses against cyber incidents Statutory regulator
Information sharing – enforcement authorities
Other duties (1) — Crown / regulator
- Enforcement authorities may share your information with other bodies Statutory regulator
Information sharing – Northern Ireland
Other duties (1) — Crown / regulator
- Northern Ireland Departments and regulators may share NIS information Crown / Minister / Government department
Browse 1 other section in this Part — procedural / definitional / commencement
The NIS national strategy
Part 3 — Operators of essential services
Nomination by an OES of a person to act on its behalf in the United Kingdom
- Nominate a UK representative for essential services Any Person
The security duties of operators of essential services
- Manage and secure network systems for essential services Any Person
The duty to notify incidents
- Notify your regulator of significant service disruptions Any Person
Browse 2 other sections in this Part — procedural / definitional / commencement
Part 4 — Digital Services
Relevant digital service providers
Fine up to £17,500,000- Secure network systems and notify the ICO of substantial incidents Operator
Representatives of digital service providers established outside the United Kingdom
- Appoint a UK representative for overseas digital services Operator
Registration with the Information Commissioner
- Register your business as a relevant digital service provider (RDSP) Any Person
Browse 1 other section in this Part — procedural / definitional / commencement
Part 5 — Enforcement and penalties
Information notices
- Respond to formal Information Notices from regulators Any Person
Enforcement notices for breach of duties
- Comply with enforcement notices regarding digital and network security Any Person
Appeal by an OES or RDSP to the First-tier Tribunal
Other duties (1) — Crown / regulator
- Tribunal must hear appeals against regulator decisions under NIS Regulations Tribunal / Court
Decision of the First-tier Tribunal
Other duties (1) — Crown / regulator
- Tribunal must determine appeals against NIS enforcement or designation Tribunal / Court
Enforcement by civil proceedings
Other duties (1) — Crown / regulator
- Regulators may start court proceedings to enforce NIS compliance Statutory regulator
Browse 4 other sections in this Part — procedural / definitional / commencement
Part 6 — Miscellaneous
Fees
- Pay costs incurred by the enforcement authority Any Person
Proceeds of penalties
Other duties (1) — Crown / regulator
- Regulators must pay penalty proceeds into government funds Statutory regulator
Browse 3 other sections in this Part — procedural / definitional / commencement
Enforcement action – general considerations
Service of documents
Review and report
Schedules
Browse 11 other Schedules — structural / supplementary
Essential Services and Threshold Requirements
The electricity subsector
The digital infrastructure subsector
The oil subsector
The gas subsector
The air transport subsector
The water transport subsector
The rail transport subsector
The road transport subsector
The healthcare subsector
The drinking water supply and distribution subsector
Official guidance
Authoritative sources published by regulators or government explaining this legislation.
- NHS Scotland information governance (opens in a new tab) Detailed Guidance
- NIS Directive and NIS Regulations 2018: Ofgem guidance for Operators of Essential Services | Ofgem (opens in a new tab) from Ofgem Detailed Guidance
- Network and Information Systems Enforcement Guidelines and Penalty Policy | Ofgem (opens in a new tab) from Ofgem Detailed Guidance
- Reporting a cyber security incident | UK Civil Aviation Authority (opens in a new tab) from CAA Detailed Guidance
- Cyber security regulation | UK Civil Aviation Authority (opens in a new tab) from CAA Detailed Guidance
- Statement: Ofcom's changes to the NIS Guidance on incident reporting thresholds for the digital infrastructure subsector (opens in a new tab) from Ofcom Detailed Guidance
- Guidance for communications providers and operators of essential services (opens in a new tab) from Ofcom Detailed Guidance
- Understanding the business drivers and cloud opportunities | National Cyber Security Centre (opens in a new tab) from NCSC Detailed Guidance
- CAF Supplementary information (opens in a new tab) from NCSC Detailed Guidance
- #5 Understanding legal and regulatory requirements | National Cyber Security Centre (opens in a new tab) from NCSC Detailed Guidance
- ... and 43 more
Enforcement and responsible bodies
The regulators that administer or enforce this legislation.
ICO
PrimaryInformation Commissioner's Office
Data protection, freedom of information, privacy and electronic communications regulation. Enforces UK GDPR and Data Protection Act 2018. Issues fines for breaches. …
Office of Gas and Electricity Markets
Regulates gas and electricity markets in Great Britain. Issues licences for generation, transmission, distribution, and supply. Protects consumers and promotes competition. Also …
Office of Communications
Regulates telecoms, TV, radio, video-on-demand, postal services, and online safety. Issues licences for telecoms providers, manages spectrum. Now enforces Online Safety Act …
Water Services Regulation Authority
Economic regulator for the water and sewerage sectors in England and Wales. Sets price limits, monitors service quality, and enforces environmental duties. …
Utility Regulator (Northern Ireland)
Regulates electricity, gas, and water industries in Northern Ireland. Protects consumers, promotes competition, and ensures adequate utility supply.
Explore more
Browse legislation
Find other UK business legislation with related guidance.
Regulators
Learn more about the bodies that enforce this legislation.