Division 63
Information Services
Requirements for all information services
These requirements apply to all business activities in this division.
Health and Safety at Work etc. Act 1974 — general duties
Enforced by HSE
Health and Safety at Work etc. Act 1974
General duty to ensure the health, safety and welfare of employees and others affected by the business — offices, server rooms and data centres included.
Employers' Liability Insurance
Enforced by HSE
Employers' Liability (Compulsory Insurance) Act 1969
Compulsory for any business employing at least one person.
UK GDPR + Data Protection Act 2018
Enforced by ICO
Data Protection Act 2018; UK GDPR (retained EU law)
Central to this industry. Data-processing, hosting and portal businesses are typically both controllers (of their own staff/customer data) and processors (handling client data under Article 28 processor contracts). ICO registration and payment of the data protection fee unless specifically exempt.
PECR rules on electronic marketing
Enforced by ICO
Privacy and Electronic Communications (EC Directive) Regulations 2003
You need consent before sending marketing by email or text to an individual, unless they are an existing customer who bought something similar from you and was given a chance to opt out — the soft opt-in. Every message must say who it is from and give a free way to unsubscribe. Live and automated marketing calls have their own rules, including screening against the Telephone Preference Service. The ICO enforces this alongside the UK GDPR. Consent for cookies and similar tracking is a separate duty and is covered by the cross-sector PECR cookies rule.
Equality Act 2010 — protected characteristics
Enforced by EHRC
Equality Act 2010
Discrimination, harassment and victimisation prohibited across the nine protected characteristics, in employment and in services provided to the public (including accessibility of customer-facing digital services).
Regulatory Reform (Fire Safety) Order 2005
Enforced by LOCAL_FIRE_AUTHORITY
Regulatory Reform (Fire Safety) Order 2005
The 'responsible person' for commercial premises (offices, data centres) must carry out a fire risk assessment and maintain fire-safety arrangements. Devolved variants: Fire (Scotland) Act 2005; Fire and Rescue Services (NI) Order 2006.