Technology & Digital

Information services compliance checklist

A confirmation checklist for information service businesses. Work through the cross-cutting duties every information service shares, then the section for what you operate — data processing, hosting and web portals, or news agency and other information services.

Relevant to a specific activity in this sector.

Print and periodical publishing rules

If you publish books, newspapers, journals or directories — in print or online — three duties apply on top of the rules every publisher shares: you must deposit copies of what you publish with the legal deposit libraries, meet consumer subscription and cancellation rules, and (for directories and mailing lists) handle personal data lawfully.

Relevant to a specific activity in this sector.

Which information service rules apply to your business

Information service businesses — data processing and hosting providers, web portals, news agencies, media-monitoring and other information services — share one defining regime: data protection. Beyond that, what you must do depends on what you operate: cloud, search and marketplace services above a size threshold have network-security duties, services hosting user content have Online Safety Act duties, and news agencies have copyright and press standards to manage. Work out which you are and follow the right guide.

Relevant to a specific activity in this sector.

Which publishing rules apply to your business

Publishing covers two very different businesses: print and periodical publishers (books, newspapers, journals, directories) and software and video-game publishers. Both share a core of duties — copyright, data protection, electronic-marketing rules and the usual workplace duties — but print publishers also have legal deposit and subscription rules, while game publishers must get age ratings. Work out which you are and follow the right guide.

Relevant to a specific activity in this sector.

Data processing, hosting and web portal rules

If you process or host data, run a cloud service, or operate a web portal or search service, two regimes may apply on top of the rules every information service shares — and both scope by what you operate, not by your sector. The NIS Regulations 2018 put security and incident-reporting duties on cloud computing, online search and online marketplace services at or above a size threshold. The Online Safety Act 2023 puts illegal-content and children's-safety duties on services that host user-generated content or provide search.

Relevant to a specific activity in this sector.

Publishing compliance checklist

A confirmation checklist for publishing businesses. Work through the cross-cutting duties every publisher shares, then the section for what you publish — print and periodical, or software and video games.

Relevant to a specific activity in this sector.

Rules for news agencies and information services

If you run a news agency, a media-monitoring or press-clipping service, or another information service, your specific rules centre on copyright — in both directions. You own copyright in the news you create and license to subscribers, and you must license what you copy from other publishers. Most news publishers also join a press self-regulator (IPSO or Impress) voluntarily — there is no statutory press licensing in the UK — and a news agency's own website is generally outside the Online Safety Act.

Relevant to a specific activity in this sector.

Software and video-game publishing rules

If you publish software or video games, the standout duty is age rating: video games that are not exempt must carry a statutory age rating before supply, and supplying an unrated game is a criminal offence. You also need to protect and license your software copyright, and — if your game has chat or user-generated content — consider your Online Safety Act duties.

Relevant to a specific activity in this sector.

Which telecommunications regulations apply to your business

Telecommunications operators — mobile network operators, fixed-line providers, internet service providers, satellite operators, MVNOs and wholesale connectivity providers — share a workplace-safety foundation, then face sector-specific Ofcom notification, spectrum licensing, security and lawful-intercept duties that other businesses do not.

Relevant to a specific activity in this sector.

Which IT and programming regulations apply to your business

Computer programming, consultancy and IT service businesses share workplace-safety duties with every employer, then carry data protection duties that bite harder given the volume of personal data you handle, and — if you provide a relevant digital service above the NIS threshold — network and information systems security duties.

Relevant to a specific activity in this sector.

Conduct a children's access assessment

Step-by-step guide to assessing whether children are likely to access your online service under the Online Safety Act 2023. Covers the legal test, Ofcom's April 2025 guidance, factors to consider, and what additional duties are triggered if children can access your service.

Relevant across several parts of this sector.

Conduct an illegal content risk assessment

Step-by-step guide to conducting the mandatory illegal content risk assessment under the Online Safety Act 2023. Covers how to identify risks from Schedule 7 priority offences, assess your service's features, document safety measures, and produce the required written record.

Relevant across several parts of this sector.

Online Safety Act compliance checklist

Quick-check verification of your Online Safety Act compliance status. Covers scope assessment, risk assessments, content moderation, terms of service, complaints, age assurance, Ofcom registration, and record-keeping.

Relevant across several parts of this sector.

Online Safety Act penalties and enforcement powers

Quick reference to Ofcom's enforcement powers, penalty calculations, and senior manager criminal liability under the Online Safety Act 2023.

Relevant across several parts of this sector.

Register with Ofcom for Online Safety Act compliance

How to register with Ofcom as a regulated online service and understand fee requirements under the Online Safety Act 2023. Covers scope, the registration portal, qualifying worldwide revenue thresholds, and annual fee obligations.

Relevant across several parts of this sector.

Set up content moderation to meet Online Safety Act requirements

How to build a content moderation system that meets Online Safety Act 2023 duties. Covers automated detection tools, human moderation teams, user reporting mechanisms, content review workflows, removal timelines, record-keeping, and moderator wellbeing.

Relevant across several parts of this sector.

Understanding the Online Safety Act

A strategic overview of the Online Safety Act 2023, explaining what it is, who it affects, how the regulatory framework operates, and where it sits within the broader UK digital regulation landscape. Essential reading for any business operating an online platform or service with user interaction.

Relevant across several parts of this sector.

Write terms of service that meet Online Safety Act requirements

How to draft or update your platform's terms of service to comply with Online Safety Act 2023 duties. Covers required content, prohibited content policies, enforcement, accessibility, and Category 1 additional obligations.

Relevant across several parts of this sector.

Cyber Essentials Certification

Government-backed scheme helping organisations guard against common cyber attacks. Required for many government contracts involving handling of sensitive information.

Relevant across several parts of this sector.

Electronic Communications Code

Rights and obligations for communications network operators to install and maintain electronic communications apparatus on public and private land.

Relevant to a specific activity in this sector.

General Authorisation for Electronic Communications Services

Any provider of electronic communications services or networks in the UK operates under a general authorisation regime. No individual licence required, but providers must comply with general conditions.

Relevant to a specific activity in this sector.

Network and Information Systems (NIS) Regulations

The NIS Regulations 2018 (as amended in 2022) require operators of essential services and relevant digital service providers to implement appropriate security measures, report significant incidents within 72 hours, and cooperate with sector-specific competent authorities. The Cyber Security and Resilience Bill (introduced November 2025) will further expand scope to managed service providers, data centres, and critical suppliers.

Relevant across several parts of this sector.

Software and AI as medical devices (SaMD/AIaMD)

How MHRA regulates software and AI-powered medical devices. Covers the SaMD definition and boundary guidance, current classification under UK MDR 2002, future reclassification to Class IIa minimum, Good Machine Learning Practice principles, predetermined change control plans, and clinical evidence for AI.

Relevant across several parts of this sector.

Reinstatement standards for highway works

Reinstatement categories, guarantee periods, materials specifications, inspection regime, and defect correction requirements under the Specification for the Reinstatement of Openings in Highways (SROH). Covers road categories, compaction standards, coring powers, and penalties for non-compliance.

Applies if you dig up, break open or work in the public road or footway