How this links to the Cyber Security and Resilience Bill
Clause 20 replaces the 2018 information-gathering power with a broader one. Regulators can now demand information from people they do not regulate, publish general requests, reach data held overseas and require new information to be generated. Failure to comply becomes a free-standing enforcement ground.
- New reg 15(1) to (3): a designated competent authority or the Information Commission may require information from its regulated persons and from any other person likely to hold it, other than the SPOC or the CSIRT.
- New reg 15(6) sets out what every notice must contain, and reg 15(7) allows general, published notices to categories of person.
- New reg 15A: a notice can require information to be obtained, generated or retained, applies whether or not the recipient is UK-established, and covers data stored outside the UK. Privileged communications are protected.
- Sch 1 para 3(4) adds reg 17(2ZB), and new reg 18(11)(d) places non-compliance in the higher maximum penalty band.
What must an information notice contain?
New regulation 15(6) requires the notice to be in writing and to specify or describe the information or documents sought, explain why they are sought, state the manner and form in which they must be given, set a deadline, and explain the possible consequences of not complying.
Regulation 15(4) and (5) list typical purposes. They include establishing whether a person is in scope, deciding on critical supplier designations, assessing the security of systems, investigating incidents, following up an inspection, identifying failures, and setting the amount of a penalty or of a charge under a cost recovery scheme.
Who can receive one?
Any person regulated by the authority, and any other person (except the SPOC and the CSIRT) that appears likely to hold the information. This matters for suppliers, auditors and group companies that are not themselves regulated. For those other persons, reg 15(7) allows a notice to be a general request to a described category of persons and to be served by publication.
Reg 15A(2) and (3) confirm that a notice can be given to someone established outside the UK and can reach information stored abroad. Reg 15A(4) and (5) protect communications covered by legal professional privilege, or confidentiality of communications in Scotland.
What happens if you do not comply?
New reg 15(8) makes compliance mandatory. The regulator can serve an enforcement notice under reg 17(2ZB) and a penalty under reg 18(2B), up to the higher maximum: the greater of £17 million and 4% of worldwide turnover for an undertaking. A decision to serve either notice can be appealed to the First-tier Tribunal.
Part 4 has its own information notice (cl.46), used by the Secretary of State and by regulators monitoring national security directions. A regulated person that contravenes one faces up to £10 million under cl.49(2)(c), plus up to £50,000 a day for a continuing contravention under cl.49(3)(b). These figures apply to Part 4 information notices only, not to reg 15.
Where it appears in the Bill
- cl.20(3)Substitutes new reg 15 (information gathering) and inserts reg 15A.
- New reg 15(6)-(8)Required contents of a notice, general published notices and the duty to comply.
- Sch 1 para 3(4)Inserts reg 17(2ZB): an enforcement notice for failing to comply with an information notice.
- New reg 18(11)(d)Places information notice failures in the higher penalty band.
- cl.46, cl.49(2)(c), (3)(b)Part 4 information notices and their £10m and £50,000 a day penalties.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Can a supplier that is not regulated receive an information notice?
Yes. New reg 15(3) extends the power to any person, other than the SPOC or the CSIRT, that appears to the regulator likely to have the information or documents sought. A regulator could, for example, ask a supplier for information when deciding whether to designate it as a critical supplier. The notice can also be a published general request to a category of persons.
Can a regulator ask for information we do not already hold?
Yes. New reg 15A(1) lets a regulator require a person to obtain or generate information, or to collect or retain information it would not otherwise keep. The power applies to data stored inside or outside the United Kingdom, and to recipients whether or not they are established in the UK. Privileged legal communications cannot be demanded.
Does the £50,000 a day penalty apply to NIS information notices?
No. The £50,000 daily rate in cl.49(3)(b) applies only to Part 4 information notices and inspection requirements linked to national security directions. Failing to comply with a reg 15 information notice under the NIS Regulations leads to an enforcement notice and a penalty of up to the higher maximum, with no daily rate.