UK data centre regulations: cyber security and resilience
UK data centres have no single rulebook. The Cyber Security and Resilience Bill (CSRB) would regulate sites of 1 megawatt or more, or 10 megawatts for enterprise sites, as essential services under Ofcom. UK GDPR and customer contracts already apply, while critical national infrastructure status mainly brings government support.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Report Stage update: VinciWorks reports that Government amendments on 26 October 2026 narrowed the incident definition to incidents that have actually adversely affected systems, and removed mandatory near-miss reporting for data centre operators. We could not check this against the amended Bill, so the wording below reflects HL Bill 32 and may be out of date. See what Parliament changed.
The short version
No single UK law covers data centres. For cyber security and resilience, the big change is the Cyber Security and Resilience Bill (CSRB), which would make data centres above set power thresholds operators of essential services, with Ofcom as their regulator. UK GDPR and customer contracts already apply, and data centres' critical national infrastructure status gives them government support rather than new legal duties.
This guide covers cyber and resilience rules. Planning, energy and environmental law also affect data centres, but they are outside its scope.
What applies to a UK data centre
| Rule | What it does | Status |
|---|---|---|
| Cyber Security and Resilience Bill | Security duties, incident reporting, customer notification and enforcement above the thresholds | Not yet law |
| Critical national infrastructure designation | Access to government support and threat information. One law firm notes it brought no immediate legislative change | Announced 12 September 2024 |
| UK GDPR | Security and breach duties where personal data is processed | In force |
| Customer contracts and certifications | Service levels, audit rights and standards that customers require | Depends on the contract |
Are you in scope of the Bill?
A data centre service means providing a physical structure with an area to house, connect and operate IT equipment, plus supporting infrastructure such as power, environmental control, security or resilience systems.
The test is based on rated IT load, meaning the maximum electrical power available for operating the IT equipment in the data centre:
- 1 megawatt or more for a data centre service provided otherwise than on an enterprise basis.
- 10 megawatts or more where the service is provided on an enterprise basis, meaning the data centre's sole purpose is to provide IT services for the undertaking that owns or manages it. See what is an enterprise data centre?.
Three details are easy to miss:
- "Structure" can include a group of structures. Work out how your site should be measured before assuming each building stands alone.
- Company size does not matter here. The micro and small enterprise exclusion is written into the digital and managed service definitions, not the data centre threshold.
- The Crown is included, with exceptions for the intelligence agencies and for certain commercial services handling material classified secret or top secret.
What you would have to do
Ofcom is the proposed competent authority for the new data infrastructure subsector. Operators in scope would need to:
- Tell Ofcom you are in scope and give basic information within three months of becoming an operator of essential services.
- Manage risks to network and information systems, and prevent and minimise the impact of incidents.
- Report incidents under regulation 11A: an initial notification within 24 hours and a full notification within 72 hours of first becoming aware, copied to the CSIRT.
- Notify customers in the UK who are likely to be adversely affected, as soon as reasonably practicable after the full notification, under regulation 11C.
- Cooperate with oversight, including information requests and inspections. The Government's factsheet says Ofcom could also issue notifications, direct interim measures and impose financial penalties, including daily fines.
Why the data centre reporting test is wider
For most regulated organisations, the incident must have affected or be affecting operation or security. For data centres, regulation 11A covers an incident that could have had, has had, is having or is likely to have a significant impact. So some near misses that other sectors would not need to report could be reportable for a data centre.
Set your own criteria now, and record why each event was or was not reported.
Who else might be regulated in the same building
Data centre operators are often only one layer in a stack. The Bill says providing a data centre service does not in itself count as a managed service. But a business that also manages customers' IT could be a relevant managed service provider, regulated by the Information Commission. A cloud service run from the same site could make its provider a relevant digital service provider.
Map each service you offer separately. You could answer to Ofcom for the building and the Information Commission for services delivered from it.
Your first steps
- Calculate rated IT load for each site, and document your method.
- Decide whether each site is on an enterprise basis, and record who it serves.
- List all services, not only the data centre service.
- Build a customer contact list you can filter by affected service.
- Add the 24-hour and 72-hour steps to your incident plan. Use our notification template as a starting point.
- Look out for Ofcom guidance, because the form of notifications is for the regulator to decide.
Sources
Frequently asked questions
Under the Bill, Ofcom would be the competent authority for the new data infrastructure subsector.
Data centres with a rated IT load of 1 megawatt or more are covered, or 10 megawatts or more if provided on an enterprise basis. Company size is not the test.
Not by itself. Data centres were designated in September 2024, which gave them access to government support. The Bill is the route for legal duties.
Under the Bill, in-scope data centre operators must take reasonable steps to identify UK customers likely to be adversely affected, then notify them as soon as reasonably practicable after the full notification.