How this links to the Cyber Security and Resilience Bill
The 2018 Regulations had a single set of penalty tiers. Clause 21 replaces them with two bands and lists, failure by failure, which band applies. The standard band is reserved for administrative and procedural duties, so the heavier higher maximum penalty is kept for security and incident failures.
- Clause 21(7) substitutes new reg 18(5) to (11), creating the standard and higher maximum amounts.
- New reg 18(8): the greater of £10,000,000 and 2% of turnover (inside and outside the UK) for an undertaking; £10,000,000 for anyone else.
- New reg 18(10) lists the failures in this band for OESs, RDSPs and RMSPs.
- The figure is a ceiling set by the greater of two amounts, so for a large undertaking the 2% limb will usually be the higher.
Which failures fall in the standard band?
New regulation 18(10) applies the standard maximum to a closed list of failures, each cross-referenced to the enforcement notice grounds in regulation 17. Anything not on this list or the regulation 18(11) list is not a penalty ground under the amended regulation 18.
- OESs (reg 17(1)): failing to notify the competent authority under reg 8(2) that it meets the threshold; failing to comply with reg 8ZA (information duties of data centre operators) or reg 8A (nominating a UK representative); failing to copy an incident notification to the CSIRT under reg 11(8) or 11A(7); and making a further disclosure in breach of reg 11B(12), 12B(11) or 14F(11).
- RDSPs (reg 17(2)): failing to copy a notification to the CSIRT under reg 12A(7); further disclosure in breach of reg 11B(12), 12B(11) or 14F(11); failing to comply with reg 14(2) or (3) (providing details to the Information Commission); and failing to comply with reg 14A (UK representative).
- RMSPs (reg 17(2ZA)): failing to comply with reg 14C(2) or (5) (registration); reg 14D (UK representative); reg 14E(7) (copying a notification to the CSIRT); and further disclosure in breach of reg 11B(12), 12B(11) or 14F(11).
How is a standard band penalty actually set?
The band sets only the ceiling. New reg 18(5) requires every penalty to be an amount the regulator considers appropriate and proportionate, having regard to the impact of the failure, any steps taken to remedy or mitigate it, and the person’s previous compliance record (new reg 18(6)).
The process is unchanged in outline. The regulator serves a notice of intention to impose a penalty, considers representations and then serves a penalty notice with a final decision under reg 18(3B). The person can appeal that decision to the First-tier Tribunal under reg 19A. A regulator can also serve an enforcement notice for the same failure.
Common misconceptions
Myth: Failing to answer an information notice is a standard band failure.
Reality: No. New reg 18(11)(d) puts a failure to comply with an information notice (reg 17(2ZB)) in the higher band.
Myth: The standard maximum is capped at £10 million.
Reality: For an undertaking it is the greater of £10 million and 2% of worldwide turnover, so £10 million is a floor for the ceiling, not a cap.
Where it appears in the Bill
- cl.21(7)Substitutes new reg 18(5) to (11), creating the two penalty bands.
- New reg 18(8)Defines the standard maximum amount.
- New reg 18(10)Lists the failures to which the standard maximum applies.
- Sch 1 para 3Amends reg 17, adding the enforcement grounds that reg 18(10) cross-refers to.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Yes. Failing to comply with reg 14C(2) or (5), which covers submitting registration details to the Information Commission, is listed in new reg 18(10)(c). The maximum penalty for an undertaking is therefore the greater of £10 million and 2% of worldwide turnover. DSIT’s enforcement factsheet also gives registration failures as the standard band example.
Only partly. Failing to copy an incident notification to the CSIRT is a standard band failure. Failing to notify the regulator of an incident at all, or missing the 24-hour and 72-hour timing and content rules, falls in the higher band under new reg 18(11). Both reporting deadlines run from the moment the organisation first became aware of the incident.
New reg 18(8) refers to the turnover of the undertaking both inside and outside the United Kingdom. The amended regulation 18 does not itself define how turnover is measured for groups, so the detail depends on the regulation as finally made and on regulator guidance. That point is not yet settled.