UK cyber regulation outlook to 2027: the NIS overhaul nears the finish line

The one thing a UK board should know right now: the Cyber Security and Resilience Bill is close to becoming law. It reaches report stage in the House of Lords on 26 October 2026 [1]. Once in force, regulated firms must give their regulator and the National Cyber Security Centre (NCSC) first notice of a significant incident within 24 hours, and a full report within 72 hours [3]. Managed IT service providers and data centres come into scope for the first time [2]. Fines can reach 4% of worldwide turnover [4]. Most duties will start through later regulations, so the detail is still to come [2].

At a glance

• Cyber law: the Cyber Security and Resilience (Network and Information Systems) Bill updates the 2018 NIS Regulations. It has passed the Commons and is in the Lords [1].
• Data protection: the main Data (Use and Access) Act 2025 changes took effect on 5 February 2026. A new duty to handle complaints followed on 19 June 2026 [6].
• The data regulator: the Information Commissioner's Office (ICO) became the Information Commission, led by a board, on 30 September 2026. It keeps the name "ICO" [13].
• Finance: new incident and third-party reporting rules apply from 18 March 2027 [17]. Four cloud providers have been designated "critical third parties" [19].
• AI: there is no AI bill. The May 2026 King's Speech put AI into a wider "Regulating for Growth" bill on sandboxes [5].

The rulebook now

Data protection. UK GDPR still requires personal data breaches to be reported within 72 hours. The Data (Use and Access) Act 2025 (DUAA) changed parts of UK GDPR and the e-privacy rules (PECR) from 5 February 2026. That included bringing the ICO's PECR enforcement powers up to the UK GDPR level [6]. Since 19 June 2026, every organisation must give people a clear way to complain about data handling. It must acknowledge a complaint within 30 days, investigate it and report the outcome [6][7]. The European Commission renewed the UK's adequacy decisions on 19 December 2025, so data can keep flowing from the EU until 27 December 2031 [23].

Critical infrastructure. The NIS Regulations 2018 still apply until the Bill takes effect. Oversight is split across sector "competent authorities": Ofgem and the Department for Energy Security and Net Zero (DESNZ) for energy, the Department for Transport and the Civil Aviation Authority for transport, Ofcom for digital infrastructure, and the ICO for digital service providers [24].

Telecoms and products. Telecoms providers have security duties under the 2022 Security Measures Regulations. A revised Telecoms Security Code of Practice (version 1.1) was issued on 14 July 2026 [22]. Since 29 April 2024, consumer connected products sold in the UK must not ship with universal default passwords [26].

Financial services. Firms had until 31 March 2025 to show they can keep important business services within set tolerances for disruption ("impact tolerances") [27]. On 10 July 2026, HM Treasury designated Microsoft, Google Cloud, Amazon Web Services and Oracle as critical third parties (CTPs). The Bank of England, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) have overseen them directly since 13 July [19].

Voluntary codes. The government's Cyber Governance Code of Practice for boards (8 April 2025) is voluntary [25]. Only 31% of businesses have a board member responsible for cyber security. In large businesses the figure is 68% [28].

The regulators and how they behave

The ICO is the main enforcer and focuses on security failures. It fined Capita £14m in October 2025 after a 2023 attack exposed data on over 6 million people [8]. LastPass was fined £1.23m in November 2025 [9], and South Staffordshire Water £963,900 in May 2026 [10]. Its largest recent fine, £14.47m against Reddit in February 2026, was about children's data, not security [11]. Its posture is selective: a handful of large security fines each year, often two years or more after the breach (Capita: attack April 2023, fine October 2025) [8]. The office has also been through a governance shock. Commissioner John Edwards resigned on 19 June 2026 after an investigation found "a case to answer" over his conduct [12]. Seven non-executive members joined the new board on 30 September [13]. A permanent chair is expected by spring 2027 [14] [CHECK: secondary source only]. The draft corporate strategy, consulted on until 23 August 2026, makes cyber resilience one of four priorities [15][29].

DSIT (Department for Science, Innovation and Technology) owns the policy. Under the Bill, ministers will be able to direct regulators and regulated firms on national-security grounds [5].

The NCSC is not a regulator, but its numbers set the tone. It counted 204 nationally significant incidents in the year to August 2025, up from 89, out of 429 it handled. Eighteen were highly significant [16].

Ofcom enforces actively under the Online Safety Act. By 19 March 2026 it had issued 16 fines against six companies, totalling nearly £4m [21]. Under the Bill it will also become the regulator for data centres [2].

The FCA and PRA are cooperative and work through supervision. Their joint reporting rules were finalised on 18 March 2026 [17].

What's coming in the next 12 months

• 26 October 2026: Lords report stage of the Cyber Security and Resilience Bill [1]. Third reading and Royal Assent follow; no dates are set.
• After Royal Assent (expected): the strategic-priorities statement and information-sharing powers start two months after Royal Assent [2]. Incident reporting, managed service providers, data centres and critical suppliers wait for regulations, on dates the Secretary of State will set [2].
• October–November 2026 (expected): NCSC Annual Review 2026. Last year's edition came out on 14 October [16].
• Late 2026 (expected): the ICO's final corporate strategy [15].
• 18 March 2027: FCA and PRA operational incident and third-party reporting rules apply. Most firms must report within 24 hours of deciding an incident meets the thresholds [17][18].
• Spring 2027 (expected): a permanent chair for the Information Commission [14]. The Cyber Security Breaches Survey 2026/27 should also appear; last year's came out on 30 April [28].
• Session 2026–27 (expected): a National Security Bill to update the Computer Misuse Act 1990, including a new Cyber Crime Risk Order. It was announced in the King's Speech on 13 May 2026 [5] and had not been introduced by 8 October [CHECK].
• No date: the Home Office's plans to ban ransomware payments by public bodies and regulated critical infrastructure, and to require 72-hour ransomware reports. These were confirmed in July 2025 but are not yet in a bill [20].

What it means for organisations

• Check whether you will be in scope as a managed service provider, a data centre or a designated critical supplier. Then map who your regulator would be [2].
• Rehearse a 24-hour first report and a 72-hour full report now. Financial firms face a 24-hour clock under the FCA and PRA rules from March 2027 as well [3][18].
• Customer notice becomes a legal duty for service providers and data centres. Contracts should say who tells whom, and how fast [3].
• Treat security fines as a real risk. ICO fines since 2025 have followed attacks on outsourcers and suppliers [8][9][10].
• Set up the new data-protection complaints process and keep records of it. It has applied since 19 June 2026 [7].
• Give the board clear ownership of cyber risk. The voluntary governance code is the benchmark regulators will reach for [25].

Sources

1. UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill, stages (via Bills API, 8 Oct 2026): https://bills.parliament.uk/bills/4035
2. DSIT, Bill factsheet: summary of the Bill (updated 30 Jun 2026): https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/summary-of-the-bill
3. DSIT, Bill factsheet: incident reporting: https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/incident-reporting
4. DSIT, Bill factsheet: enforcement: https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/enforcement
5. Prime Minister's Office, The King's Speech 2026: background briefing notes (13 May 2026): https://assets.publishing.service.gov.uk/media/6a046665c0cc74b4523e4d3b/The_King_s_Speech_2026_-_background_briefing_notes.pdf
6. Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, SI 2026/82: https://www.legislation.gov.uk/uksi/2026/82/made
7. ICO, "New data protection complaints law now in force" (23 Jun 2026): https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/06/new-data-protection-complaints-law-now-in-force/
8. ICO, Capita plc and Capita Pension Solutions Ltd monetary penalty (15 Oct 2025): https://ico.org.uk/action-weve-taken/enforcement/2025/10/capita-plc/
9. ICO, LastPass UK Ltd monetary penalty (20 Nov 2025): https://ico.org.uk/action-weve-taken/enforcement/2025/11/lastpass-uk-ltd/
10. ICO, South Staffordshire Plc and South Staffordshire Water Plc monetary penalty (7 May 2026): https://ico.org.uk/action-weve-taken/enforcement/2026/05/south-staffordshire-plc-and-south-staffordshire-water-plc/
11. ICO, Reddit, Inc. monetary penalty (23 Feb 2026): https://ico.org.uk/action-weve-taken/enforcement/2026/02/reddit-inc/
12. ICO, "ICO confirms John Edwards resignation" (19 Jun 2026): https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/06/ico-confirms-john-edwards-resignation/
13. ICO, "ICO to become Information Commission on 30 September 2026" (15 Sep 2026): https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-to-become-information-commission-on-30-september-2026
14. Local Government Lawyer, "ICO formally becomes the Information Commission as new board takes charge" (30 Sep 2026): https://www.localgovernmentlawyer.co.uk/information-law/398-information-law-news/101814-ico-formally-becomes-the-information-commission-as-new-board-takes-charge
15. ICO, Corporate strategy consultation (10 Jul – 23 Aug 2026): https://citizen-space.ico.org.uk/strategy/ico-corporate-strategy-consultation/
16. NCSC, "UK experiencing four 'nationally significant' cyber attacks every week" (14 Oct 2025): https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly
17. FCA, PS26/2: Operational incident and third party reporting (18 Mar 2026): https://www.fca.org.uk/publications/policy-statements/ps26-2-operational-incident-third-party-reporting
18. TLT, "FCA and PRA publish final rules on operational incident reporting" (second source for reporting deadlines and PRA PS7/26): https://www.tlt.com/insights-and-events/insight/fca-and-pra-publish-final-rules-on-operational-incident-reporting-firms-have-to-ready-by-18-march-2027
19. HM Treasury, "UK financial system strengthened with new safeguards for major technology providers" (10 Jul 2026): https://www.gov.uk/government/news/uk-financial-system-strengthened-with-new-safeguards-for-major-technology-providers
20. Home Office, Government response to ransomware legislative proposals (22 Jul 2025): https://www.gov.uk/government/consultations/ransomware-proposals-to-increase-incident-reporting-and-reduce-payments-to-criminals/outcome/government-response-to-ransomware-legislative-proposals-reducing-payments-to-cyber-criminals-and-increasing-incident-reporting-accessible
21. Ofcom, "4chan fined £450,000 for not protecting children from online pornography" (19 Mar 2026): https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/4chan-fined-450000-for-not-protecting-children-from-online-pornography
22. DSIT, Revised Telecommunications Security Code of Practice 2026 (version 1.1) (14 Jul 2026): https://www.gov.uk/government/publications/revised-telecommunications-security-code-of-practice-2026-version-11
23. eucrim, "Commission Renewed Adequacy Decisions for Data Transfers to the UK": https://eucrim.eu/news/commission-renewed-adequacy-decisions-for-data-transfers-to-the-uk/
24. Network and Information Systems Regulations 2018, Schedule 1: https://www.legislation.gov.uk/uksi/2018/506/schedule/1
25. DSIT, Cyber Governance Code of Practice (8 Apr 2025): https://www.gov.uk/government/publications/cyber-governance-code-of-practice
26. Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, reg. 1: https://www.legislation.gov.uk/uksi/2023/1007/regulation/1/made
27. FCA, Operational resilience (updated 15 Sep 2026): https://www.fca.org.uk/firms/operational-resilience
28. DSIT, Cyber security breaches survey 2025/2026 (30 Apr 2026): https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
29. Baker McKenzie, "The future of the ICO: governance changes and draft corporate strategy" (28 Sep 2026): https://connectontech.bakermckenzie.com/the-future-of-the-ico-governance-changes-and-draft-corporate-strategy-signal-key-regulatory-priorities/

This article is for information only and is not legal advice.