UK law for managed service providers
No single UK law covers everything an MSP does. The Cyber Security and Resilience Bill (CSRB) will regulate medium and large MSPs directly for the first time, while UK GDPR, the Computer Misuse Act, contract law and your customers’ sector rules already apply.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short answer
There is no "Managed Services Act" in the UK. MSPs are covered by several general laws today, and the Cyber Security and Resilience Bill (CSRB) would regulate medium and large MSPs directly for the first time. This guide covers every layer. For the steps to take under the Bill, use the MSP compliance checklist.
The laws at a glance
| Layer | Applies today? | What it means for an MSP |
|---|---|---|
| The Bill (as an RMSP) | Not yet | Registration, security duties, incident reporting and customer notices |
| UK GDPR and Data Protection Act 2018 | Yes | Security and breach duties when handling personal data |
| Computer Misuse Act 1990 | Yes | Your access to customer systems must stay within your authority |
| Contract law | Yes | Your service agreement sets most day-to-day liability |
| Customer sector rules | Yes, through contracts | Customers pass their regulators' requirements on to you |
The Bill
The Bill defines a managed service by what you actually do. It is a service provided under a contract for the ongoing management of a customer's IT systems, whether through support and maintenance, monitoring, active administration or other activities. You must also connect to or access systems the customer relies on, either remotely or on site.
You are a relevant managed service provider (RMSP) if you provide this in the UK, wherever you are established, and you aren't a micro or small enterprise. There is also a condition about public authority oversight, and data centre services and public telecoms networks and services don't count as managed services.
If you are an RMSP, the Information Commission will be your regulator. Your duties are in the full MSP reference.
UK GDPR
Most MSPs handle personal data for customers, which usually makes them processors, though they are controllers for their own staff and customer contact data.
As a processor, you need:
- A contract with the customer that meets Article 28
- Appropriate security under Article 32
- A process to tell the customer about a personal data breach without undue delay, under Article 33(2)
This is not a theoretical risk. In March 2025 the ICO fined Advanced Computer Software Group £3,076,320 as a processor, following a 2022 ransomware attack. Attackers got in through a customer account without multi-factor authentication, and data on 79,404 people was taken. The ICO cited gaps in multi-factor authentication, vulnerability scanning and patching.
Computer Misuse Act
Your access to customer systems is lawful because you have authority for it. Under section 17(5), access is unauthorised if you aren't entitled to control that kind of access and don't have consent from someone who is.
In practice:
- Define your access in the contract, including the systems covered
- Remove access when staff leave or the contract ends
- Get written authority before doing anything unusual, such as penetration testing
- Check who can authorise work on third-party platforms
Contract law
Between you and your customer, the contract usually decides who pays for what after an incident. Review these terms:
- Security responsibilities on each side
- Liability caps and exclusions, which the Unfair Contract Terms Act 1977 may limit
- Incident notice periods, which should allow you both to meet your legal deadlines
- Audit rights and evidence you must provide
- What happens at exit
See who is liable when an MSP's client is breached.
Your customers' rules
Your customer's regulator may not regulate you directly, but its rules can still reach you through the contract. Examples include:
- FCA and PRA rules for financial firms
- NHS standards for health customers
- Supply chain expectations from customers regulated under the Bill
- DORA and NIS2 for EU customers
If a contract promises compliance with a named standard, you can be held to that promise even where the underlying rule doesn't apply to you.
What to do first
- Work out whether each legal entity in your group meets the RMSP definition, including linked business size rules.
- Check your data processing agreements against Article 28.
- Audit customer access, especially accounts without multi-factor authentication.
- Review standard contract terms for liability and incident notice periods.
- Make one list of the compliance promises in your customer contracts.
Sources
Frequently asked questions
No. The nearest thing is the Cyber Security and Resilience Bill, which would amend the NIS Regulations 2018 to bring relevant managed service providers into regulation.
MSPs are not a regulated category under the NIS Regulations 2018 today, but general laws already apply, including UK GDPR when they process personal data for customers.
Yes, where the MSP has its own UK GDPR obligations. In March 2025 the ICO fined Advanced Computer Software Group £3.07 million as a data processor, after a ransomware attack affected NHS and care services.
It depends on the facts and the contract. Regulatory duties sit separately on each regulated organisation, while liability between the MSP and customer usually turns on contract terms, the cause of the breach and data protection law. Take legal advice on a specific incident.