What is an enterprise data centre?
An enterprise data centre is one an organisation runs for its own IT. Under the Cyber Security and Resilience Bill (CSRB), the test is stricter: its sole purpose must be providing IT services for the undertaking that owns or manages it. Those sites are regulated at 10 megawatts, rather than the usual 1 megawatt.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Two meanings of the same phrase
In everyday industry use, "enterprise data centre" usually means a facility that an organisation runs for its own IT, as opposed to colocation or a hyperscale cloud site. It can also be used more loosely, to describe high-specification or "enterprise-class" facilities.
The Cyber Security and Resilience Bill (CSRB) gives it a narrower legal role. The phrase matters because it can decide whether you face a 1 megawatt threshold or a 10 megawatt one.
The legal test
Under the Bill's new paragraph 11 of Schedule 2 to the NIS Regulations, a data centre service is provided on an enterprise basis if both of these are true:
- The data centre is owned or managed by a person in connection with carrying on an undertaking by that person.
- The sole purpose of the data centre is to provide information technology services for that undertaking.
Thresholds then depend on the result:
| Type | Threshold (rated IT load) |
|---|---|
| Enterprise basis | 10 megawatts or more |
| Any other basis | 1 megawatt or more |
Rated IT load means the maximum electrical power available to operate the relevant IT equipment housed in the data centre. So this is not necessarily the same as what you draw on a typical day.
Worked examples
These examples show how the wording appears to work. They are illustrations, not legal advice.
| Scenario | Likely basis | In scope on load alone? |
|---|---|---|
| A retailer's own 5 MW facility, used only for its own systems | Enterprise | No, below 10 MW |
| A manufacturer's own 12 MW facility, used only for its own systems | Enterprise | Yes |
| A 2 MW colocation site with several customers | Not enterprise | Yes |
| A company's 5 MW facility that also rents space to one outside customer | Probably not enterprise, because IT services for itself would no longer be the sole purpose | Probably yes |
Grey areas to check
"Sole purpose" is a strict phrase, and several common arrangements are not spelled out in the wording.
- Corporate groups. If one group company runs a data centre for its sister companies, is that one undertaking or several? Take advice if this is your structure.
- Small amounts of third-party use. The text has no minimum level. Even a modest hosting arrangement could undermine the argument that IT services for your own undertaking are the sole purpose.
- Outsourced management. The test refers to a data centre "owned or managed" by a person in connection with its undertaking. Check your position if another company operates your site, or you operate someone else's.
- Several buildings. References to a structure can include a group of structures, so don't assume every building counts separately.
- Thresholds may change. The Government's factsheet says the scope can be adjusted over time.
Regulator guidance may clarify some of this. Until then, record your reasoning and the facts you relied on.
What happens if you are in scope
You would be an operator of essential services, with Ofcom as your regulator. That means risk management duties, 24-hour and 72-hour incident notifications, customer notification and enforcement powers. Read the full picture in UK data centre regulations.
If your site falls below the thresholds, you are not regulated under this route. You could still be reached in other ways: UK GDPR, customer contracts or another service you provide, such as a managed or cloud service.
How to document your decision
Create a one-page record for each site that covers:
- The site and the legal entity that owns or manages it.
- Rated IT load and how you calculated it.
- Who the facility serves, including any group companies or third parties.
- Your conclusion: enterprise or not, and in scope or not.
- Triggers for review, such as a new tenant, new capacity or a group reorganisation.
- Who signed it off, and the date.
A review trigger matters as much as the first answer. A new tenant could move a site from a 10 megawatt threshold to a 1 megawatt one.
Sources
Frequently asked questions
An enterprise data centre serves its own organisation, whereas a colocation site rents space and services to customers. Under the Bill, a site serving others would generally face the 1 megawatt threshold rather than the 10 megawatt one.
The Bill defines it as the maximum electrical power available for operating the relevant IT equipment housed in the data centre.
It could. The Bill’s test depends on the sole purpose being IT services for the undertaking itself, and it has no minimum level for third-party use. Take advice on your arrangement.
The wording does not spell this out, so it is a grey area. Record your reasoning and check for regulator guidance.