How this links to the Cyber Security and Resilience Bill
RDSPs already exist under the NIS Regulations 2018, but the Cyber Security and Resilience Bill rewrites the test. It replaces the cloud definition, adds a public authority oversight exemption, separates RDSPs from critical suppliers and managed service providers, and brings RDSP incident reporting onto the same 24-hour and 72-hour timetable as other regulated entities.
- Cl.7(3) substitutes a new, more detailed definition of cloud computing service, which expressly excludes managed services.
- Cl.7(8) substitutes reg 1(3)(e): the four-limb RDSP test, covering providers whether or not they are established in the UK.
- Cl.7(9) inserts reg 1(3A): providing a public electronic communications network or service is not a relevant digital service.
- Cl.8 sharpens the reg 12 security duty and requires RDSPs to have regard to Information Commission guidance.
- Cl.14 tightens registration with the Information Commission (reg 14) and the UK representative rule (reg 14A) for RDSPs based abroad.
Who counts as a relevant digital service provider?
Under the substituted reg 1(3)(e), an RDSP is a person which meets all four limbs of the test:
- It provides a relevant digital service in the United Kingdom, whether or not it is established in the UK.
- It is not designated as a critical supplier under reg 14H in relation to that service.
- It is not a micro or small enterprise as defined in Commission Recommendation 2003/361/EC.
- Either it is not subject to public authority oversight, or it is but derives more than half of its income from activities of a commercial nature.
What is a relevant digital service?
The Bill defines a relevant digital service as an online marketplace, an online search engine or a cloud computing service. The marketplace and search engine definitions remain in reg 1(2) of the NIS Regulations 2018; the cloud definition is replaced by cl.7(3).
The old catch-all terms "digital service" and "digital service provider" are removed (cl.7(4)). That matters because the test now attaches to the specific service, so a group can be an RDSP for its cloud platform while its other activities fall outside the regime.
How big does a provider need to be?
The Bill gives no numbers of its own. It relies on Commission Recommendation 2003/361/EC, under which a small enterprise has fewer than 50 staff and annual turnover or balance sheet total of no more than €10m. A provider must exceed that to be an RDSP.
Two points are unsettled. The ceilings are in euro and no sterling conversion has been published. And the Recommendation aggregates linked and partner enterprises, but the Bill does not say expressly whether that applies, so a small subsidiary of a large group should not assume it is exempt.
Common misconceptions
Myth: Any public body running a cloud or online service is automatically out of scope.
Reality: Only if it is subject to public authority oversight and half or less of its income comes from commercial activities. A publicly controlled body with mostly commercial income can still be an RDSP.
Where it appears in the Bill
- cl.7(3), reg 1(2)New definition of cloud computing service.
- cl.7(5), reg 1(2)Relevant digital service means an online marketplace, online search engine or cloud computing service.
- cl.7(8), reg 1(3)(e)The four-limb RDSP test.
- cl.7(9), reg 1(3A)Telecoms networks and services excluded.
- cl.11, reg 1(3E)Meaning of subject to public authority oversight.
- cl.8, reg 12(2A)Duty to have regard to Information Commission guidance.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Who regulates RDSPs?
The Information Commission, for the whole of the United Kingdom. It keeps the register of RDSPs, issues guidance, receives incident notifications and enforces the security duty. The body was renamed from the Information Commissioner by the Data (Use and Access) Act 2025, and the Bill uses the new name throughout.
Does an overseas cloud provider have to comply?
Yes, if it provides a relevant digital service in the UK and is not exempt. The RDSP test applies whether or not the provider is established in the UK. An RDSP whose principal office is outside the UK must nominate a UK representative in writing and notify the Information Commission of the representative’s details.
Are telecoms companies RDSPs?
Not in relation to their networks. New reg 1(3A) says a person does not provide a relevant digital service by virtue of providing a public electronic communications network or service as defined in the Communications Act 2003. A telecoms group that also runs a separate cloud platform could still be an RDSP for that platform.
What penalties can an RDSP face?
Security duty, incident notification, direction and inspection failures sit in the higher band: the greater of £17m and 4% of turnover. Registration, UK representative and CSIRT copying failures sit in the standard band: the greater of £10m and 2%. These bands apply once the relevant provisions commence.