How this links to the Cyber Security and Resilience Bill
The enforcement notice is the regulator’s main corrective tool, and it sits alongside financial penalties. Schedule 1 paragraph 3 rewrites the list of duties it can enforce, adds managed service providers and information notices, and makes clear that paying a penalty does not end the duty to fix the problem.
- Sch 1 para 3(2)-(3): new and restated grounds for OESs (reg 17(1)) and RDSPs (reg 17(2)), including incident timing, customer notification and CSIRT copying.
- New reg 17(2ZA): the Information Commission can serve notices on RMSPs for eleven listed failures.
- New reg 17(2ZB): any regulator can serve a notice on any person that fails to comply with an information notice.
- New reg 17(3ZA) and (3A): required steps can be outside the UK, and must be taken whether or not a penalty has been paid.
When can a regulator serve an enforcement notice?
A designated competent authority or the Information Commission may serve a notice where it has reasonable grounds to believe the person has failed to comply with one of the duties listed in reg 17. Before doing so, the regulator must tell the person of its intention, give reasons and allow representations (reg 17(2A) to (2C), which the Bill amends so they apply to any person rather than only OESs and RDSPs).
The listed duties are the same ones that appear in the two penalty bands. Every failure in the standard maximum penalty and higher maximum penalty lists is cross-referenced to a ground in reg 17.
What does a notice require, and what if it is ignored?
Under reg 17(3), the notice sets out the reasons, the steps needed to put things right and the period for taking them. The Bill adds reg 17(3ZA), which confirms that steps can be required outside the United Kingdom, which is relevant to cloud and managed service providers with overseas operations.
New reg 17(3A) says a person must comply with the notice regardless of whether it has paid any penalty under reg 18. If it does not comply, the regulator can bring civil proceedings under reg A20, as amended by Schedule 1 paragraph 6, for example for an injunction. A decision to serve a notice can be appealed to the First-tier Tribunal under reg 19A, and regulators must weigh the general considerations in reg 23 before acting.
Common misconceptions
Myth: Paying the fine closes the matter.
Reality: New reg 17(3A) requires compliance with an enforcement notice whether or not any penalty has been paid.
Where it appears in the Bill
- cl.22Introduces Schedule 1 (enforcement and appeals).
- Sch 1 para 3Amends reg 17, including new paragraphs (2ZA), (2ZB), (3ZA) and (3A).
- Sch 1 para 4Amends reg 19A to give RMSPs and other persons a right of appeal.
- Sch 1 para 6Amends reg A20 so civil proceedings can enforce any reg 17 notice.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Can we receive an enforcement notice and a fine for the same failure?
Yes. The regulator can serve an enforcement notice under reg 17 and a penalty notice under reg 18 for the same breach. DSIT’s enforcement factsheet confirms this. New reg 17(3A) also makes clear that paying the penalty does not remove the duty to take the steps the enforcement notice requires.
Can we challenge an enforcement notice?
Yes. Regulation 19A gives a right of appeal to the First-tier Tribunal, and Schedule 1 paragraph 4 extends it to RMSPs and to any person served with a notice for failing to comply with an information notice. Before serving the notice, the regulator must also tell you of its intention and consider your representations.
Can an enforcement notice require action outside the UK?
Yes. New reg 17(3ZA) states that the steps a notice specifies may include steps outside the United Kingdom. This matters for organisations whose systems, staff or suppliers sit overseas but whose services are provided in the UK, such as cloud platforms and managed service providers.