September 17, 2018

In March 2018, the Government published a targeted consultation on how the NIS Directive will apply to DSPs in the UK.  The consultation covered three main topics:

• identification of DSPs;
• security measures; and
• further guidance.

The Government received 12 responses to its consultation.  The majority of responses indicated there was broad support for the Government’s overall approach towards DSPs, but there continued to be uncertainty over exactly who was in scope, particularly in relation to cloud service providers, and that greater clarification was needed on the subject of cost recovery.

The Network and Information Systems Regulations 2018 are now in effect.  The Government therefore proposes to use the outcome of this consultation to assist the Information Commissioner’s Office in clarifying its guidance to DSPs.  The key areas the Government will look to clarify are:

• how DSPs can more easily identify whether they are within scope of the NIS Regulations;
• how cloud services in particular are defined; and
• how the ICO’s cost recovery process will operate.

To read the Government’s response, click here.