UK cyber security laws and regulations: the complete map
The UK has no single cyber security law. The main rules are the Computer Misuse Act 1990, UK GDPR and the Data Protection Act 2018, the NIS Regulations 2018 and sector rules for telecoms, products and finance. The Cyber Security and Resilience Bill (CSRB) would strengthen the NIS Regulations.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short answer
No single law covers cyber security in the UK. Different laws cover essential services, personal data, hacking, telecoms networks, connected products and financial firms. Most organisations are subject to more than one, and the Cyber Security and Resilience Bill (CSRB) would add to this by strengthening the NIS Regulations.
The table below shows the main rules and who enforces them.
The main laws
| Law | What it covers | Who enforces it | Who it mainly affects |
|---|---|---|---|
| Computer Misuse Act 1990 | Crimes including unauthorised access and impairing a computer | Police and prosecutors | Everyone |
| UK GDPR and Data Protection Act 2018 | Security of personal data and breach reporting | ICO, which the Data (Use and Access) Act 2025 is replacing with the Information Commission | Anyone handling personal data |
| NIS Regulations 2018 | Security and incident reporting for essential services and certain digital services | Sector regulators and the ICO | Energy, transport, healthcare, drinking water, digital infrastructure and some digital services |
| Telecommunications (Security) Act 2021 | Security duties for public telecoms networks and services, and vendor directions | Ofcom and the Secretary of State | Telecoms providers |
| Product Security and Telecommunications Infrastructure Act 2022, Part 1 | Security of connectable consumer products | Office for Product Safety and Standards | Manufacturers, importers and distributors |
| FCA and PRA rules | Operational resilience and third party risk in financial services | FCA, PRA and Bank of England | Regulated financial firms |
The Bill: what is coming
The Bill is not yet law. It would amend the NIS Regulations 2018 to:
- Bring data centres, large load controllers and medium and large managed service providers into regulation
- Let regulators designate critical suppliers
- Introduce 24-hour and 72-hour incident notification, and notification to affected customers for some providers
- Increase penalties and let regulators recover their costs
- Give ministers powers to update the regime and issue national security directions
See what the Bill changes, the NIS Regulations compared with the Bill and when it comes into force.
Frameworks and codes that are not laws
These often come up alongside legal duties, but they're different in status. A contract or regulator can still make them matter in practice.
| Name | What it is | Status |
|---|---|---|
| Cyber Assessment Framework | NCSC framework for assessing cyber resilience | Not legislation; regulators can use it for assessment |
| Cyber Essentials | Government-backed certification of basic controls | No general legal duty; contracts can require it |
| Cyber Governance Code of Practice | Actions for boards and directors, published April 2025 | Guidance, not a statute |
| Software Security Code of Practice | 14 principles for software vendors, published May 2025 | Voluntary |
Proposals that are not yet law
Two important changes are still in progress, so check their status before relying on them:
- Ransomware measures: in July 2025 the Government said it would take forward a ban on ransom payments for the public sector and critical national infrastructure, plus notification before other businesses pay. The announcement described these as proposals.
- Computer Misuse Act reform: ministers have said the Home Office is proposing a defence for accredited researchers. It has not been enacted.
Which rules apply to you?
Work through these questions:
- Do you handle personal data? Almost every organisation does, so UK GDPR applies.
- Do you run an essential service? Check the Schedule 2 thresholds.
- Do you provide cloud, marketplace, search or managed IT services? See OES vs RDSP vs RMSP.
- Are you a telecoms provider, or do you sell connected consumer products? The sector laws above apply.
- Are you regulated by the FCA or PRA? Financial rules apply. Banking is not a Schedule 2 subsector, so don't assume the Bill covers you for that reason alone.
- Do you supply any of these organisations? Expect requirements through contracts, and consider critical supplier designation.
- Do you operate in the EU? See DORA and NIS2.
This map covers the main cyber-specific rules and is not exhaustive. General duties, such as directors' duties and contract law, may also apply.
Sources
- Computer Misuse Act 1990
- NIS Regulations 2018
- Telecommunications (Security) Act 2021
- Product Security and Telecommunications Infrastructure Act 2022, Part 1
- Cyber Governance Code of Practice
- Software Security Code of Practice
- GOV.UK: ransomware measures, July 2025
- Cyber Security and Resilience Bill, HL Bill 32
Frequently asked questions
There is no single law. The NIS Regulations 2018 cover essential and certain digital services, UK GDPR covers security of personal data, and the Computer Misuse Act 1990 criminalises hacking.
The CAF is a framework, not legislation. Regulators can use it to assess organisations, and the Government has signalled it will underpin requirements under the new regime.
There is no general legal requirement to hold it. It is a government-backed certification scheme, and government or private contracts can require it.
Not outright. Part 2 of the Bill amends the NIS Regulations 2018, and Part 3 gives ministers powers to update the regime through regulations.