Ofcom and the Cyber Security and Resilience Bill
Under the Cyber Security and Resilience Bill (CSRB), Ofcom would regulate data centres, alongside its existing NIS role for digital infrastructure such as DNS services and internet exchange points. We found no Ofcom NIS guidance for data centres yet, though the Bill will require guidance on them.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Report Stage update: VinciWorks reports that Government amendments on 26 October 2026 narrowed the incident definition to incidents that have actually adversely affected systems, and removed mandatory near-miss reporting for data centre operators. We could not check this against the amended Bill, so the wording below reflects HL Bill 32 and may be out of date. See what Parliament changed.
Ofcom's role
Schedule 1 of the NIS Regulations 2018 names the Office of Communications as competent authority for digital infrastructure across the UK. Section 4 of the Cyber Security and Resilience Bill (CSRB) adds a new "data infrastructure" subsector with Ofcom as regulator.
Who Ofcom would regulate
| Service | Threshold |
|---|---|
| Data centre service, not on an enterprise basis | Rated IT load of 1 MW or more |
| Data centre service on an enterprise basis | Rated IT load of 10 MW or more |
| TLD name registry | 14 billion or more queries from UK devices in any 168 hours |
| DNS resolver service | 500,000 or more distinct UK-used IP addresses in any 168 hours |
| DNS authoritative hosting | 100,000 or more domains registered to UK addresses |
| Internet exchange point | 30% or more of UK IXP market share |
An enterprise data centre is one owned or managed for a person's own undertaking, with the sole purpose of providing IT services to that undertaking.
What is published, and what isn't
| Item | Status when checked |
|---|---|
| NIS guidance for digital infrastructure | Published, 31 May 2023; a statutory guidance document |
| Incident reporting thresholds for digital infrastructure | Included in that guidance |
| Data centre security guidance | Not found |
| Data centre notification form | Not found |
| Charging scheme under the Bill | Not found |
Checked 2 November 2026. Regulators may publish more once the Bill passes, so check their own pages. Section 19 of the Bill requires guidance on data centre duties, so expect material on security measures, information and incident reporting.
What Ofcom could do
Once in force, regulated data centres must give information under regulation 8ZA, report incidents within 24 and 72 hours with a copy to the CSIRT, and notify likely affected UK customers. Note that the data centre incident test is wider than for other regulated organisations, because it includes incidents that "could have had" a significant impact. Ofcom would also have powers on information, inspection and penalties, and may charge under a scheme to recover its costs.
Points that are easy to miss
- The test looks at rated IT load. It is not a measure of actual use, so a site running well below capacity can still meet the threshold.
- Crown services can be covered. The Bill applies the data centre rules to services provided by or on behalf of the Crown, except for the intelligence agencies and commercial services to the extent they handle material classified secret or top secret.
- Ofcom is not your only regulator. Tenants' data, customer contracts and any telecoms services bring in other regimes, and a data centre service is excluded from the managed service definition only for that service.
- Telecoms networks are separate. Public electronic communications networks and services are carved out of the essential service route, so a telecoms group should assess its data centre and other businesses separately.
What to do now
- Measure rated IT load for each site, using the Bill's definition.
- Decide whether each site is enterprise or not.
- Check Ofcom's existing NIS guidance to see how it approaches the sector.
- Prepare the regulation 8ZA details and incident contacts.
Sources
Frequently asked questions
No. Data centres become regulated once the relevant parts of the Bill start. Ofcom is named as the regulator for the new data infrastructure subsector.
Public electronic communications networks and services are carved out of the essential service route. Ofcom regulates telecoms security under separate telecoms law.
Ofcom’s current NIS guidance for the digital infrastructure subsector dates from 31 May 2023. We found no data centre guidance when we checked in November 2026.
Yes. New regulation 8ZA requires designated data centre operators to provide details including name, address, directors and contact information within a three-month period.