Cyber security and data protection compliance in the United Kingdom

Which cyber security and data protection rules apply in the United Kingdom?

It depends on the sector and on who the customer is. Operators of essential services in energy, transport, health, drinking water and digital infrastructure, and relevant digital service providers (online marketplaces, online search engines and cloud computing services), are regulated under the NIS Regulations 2018 by the competent authority for their sector, and NCSC says the CAF is now used by nearly all UK cyber regulators. Central government assures its critical systems against the CAF through GovAssure, councils in England use MHCLG's CAF for local government, and NHS bodies submit the Data Security and Protection Toolkit, whose 2026-27 version is aligned to CAF v4.0.

Cyber Essentials is the baseline most often asked for in contracts, from central government under PPN 014 to the MOD's Defence Cyber Certification. Banks, insurers, payment firms and other regulated financial firms add the FCA and PRA operational resilience rules, and every organisation that processes personal data is bound by the UK GDPR and the Data Protection Act 2018, with PECR for marketing and cookies. A group can sit under several at once, which is why GRCLens runs them on one control model with ISO/IEC 27001 and the rest of the library, so a control evidenced once counts wherever it applies.

What is the NCSC Cyber Assessment Framework?

The CAF is the National Cyber Security Centre's outcome-based method for assessing how well an organisation manages cyber risk to its essential functions. Version 4.0, released on 4 August 2025, has 4 objectives, 14 principles and 41 contributing outcomes, each judged Achieved, Partially achieved or Not achieved against indicators of good practice. Regulators and schemes set a profile, the minimum result expected per outcome: GovAssure assigns a Basic or Enhanced profile to each government system, and Ofgem uses Basic and Enhanced profiles for downstream gas and electricity.

In GovAssure the assessment runs through WebCAF: a self-assessment at stage 3, an independent assurance review at stage 4 and a targeted improvement plan at stage 5. Under the NIS Regulations an operator of essential services notifies its competent authority of an incident with a significant impact on its essential service without undue delay and within 72 hours of becoming aware of it. GRCLens carries all 373 indicators of good practice, 225 in Achieved columns and 148 in Partially achieved columns, and scores each outcome against the profile selected.

What changed in Cyber Essentials in 2026?

Version 3.3 of the requirements, answered through IASME's Danzell question set, applies to assessment accounts created from 27 April 2026. Missing multi-factor authentication on any cloud service that offers it is now an automatic fail, and so is failing to install high-risk or critical updates within 14 days. Cloud services cannot be excluded from scope, every in-scope legal entity is listed on the certificate, the board-level declaration covers ongoing compliance, and a second failed Cyber Essentials Plus update-management test revokes the Cyber Essentials certificate.

Issuance is at a record: 61,430 certificates were awarded between July 2025 and June 2026, 46,245 Cyber Essentials and 15,185 Cyber Essentials Plus. Certificates last 12 months, and a CE+ audit must be completed within three months of the Cyber Essentials certificate. GRCLens carries 115 requirements in 8 domains, 18 of them automatic-fail checks, together with the CE+ test cases. It prepares the submission; certificates are issued through IASME's licensed certification bodies.

What do the FCA and PRA require on operational resilience?

Firms in scope of FCA SYSC 15A and the PRA's Operational Resilience Part identify their important business services, set an impact tolerance for each, map the people, processes, technology, facilities, information and third parties that deliver them, test against severe but plausible scenarios and keep a self-assessment approved by the board. Since 31 March 2025 they have had to be able to remain within their impact tolerances. PRA SS2/21 and FCA SYSC 8 govern outsourcing and third-party risk.

Two changes are reshaping the third-party side. HM Treasury's first critical third parties (Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited and Oracle Corporation UK Limited) were designated with effect from 13 July 2026 and are overseen by the Bank of England, the PRA and the FCA. From 18 March 2027, FCA PS26/2 and PRA PS7/26 require operational incidents to be reported on one form, with the initial report expected within 24 hours of a threshold being met (4 hours for payment service providers), and material third-party arrangements to be notified in advance and listed in a register submitted every year.

What changed in UK data protection in 2025 and 2026?

The Data (Use and Access) Act 2025 amended the UK GDPR, the Data Protection Act 2018 and PECR in phases. Most data-protection changes commenced on 5 February 2026, among them recognised legitimate interests, Articles 22A to 22D on automated decision-making, new DSAR time limits, cookie exemptions and PECR enforcement at UK GDPR levels. The duty to handle data-protection complaints applied from 19 June 2026, and on 30 September 2026 the Information Commission, a body corporate with a board, replaced the Information Commissioner; it is still branded ICO.

A personal data breach is still notified without undue delay and, where feasible, within 72 hours. Maximum fines are £17.5 million or 4% of worldwide turnover at the higher tier and £8.7 million or 2% at the standard tier. Enforcement is active: the ICO fined Capita £14 million in October 2025 for a 2023 breach affecting 6.6 million people, and received 17,431 personal data breach reports in 2025/26, 40% more than in 2024/25.

Is the Cyber Security and Resilience Bill law yet?

Not as of October 2026. The Bill amends the NIS Regulations 2018; it passed the Commons on 16 June 2026, and its Lords Report stage was provisionally scheduled for 26 October 2026. It would bring data centres (regulated by Ofcom) and managed service providers that are not small or micro enterprises (regulated by the Information Commission) into scope, widen reporting to incidents with the potential for significant impact, require an initial notification within 24 hours and a full report within 72, and raise maximum fines to the greater of £17 million or 4% of worldwide turnover. Most substantive duties will follow in secondary legislation, and NCSC says the CAF will evolve to match.

How GRCLens runs the UK frameworks together

Each framework is assessed per group or per legal entity and rolls up into a group view with a heat map across 15 risk areas: the CAF with 373 indicators of good practice across 41 contributing outcomes, Cyber Essentials with 115 requirements including 18 automatic-fail checks, operational resilience with 218 requirements in 11 domains, and UK data protection with 178 requirements in 10 domains. Each has four stakeholder dashboards: board and management, CISO and risk (the DPO for UK GDPR), operations, and third party and supply chain.

Connectors for incident records, backup and restore, vulnerability and patch, identity and MFA, the third-party register, resilience testing, training and log monitoring validate the answers alongside the existing Entra, Tenable, Qualys, Splunk and ITSM connectors. Gaps flow into a multi-owner assurance register and a remediation and risk treatment plan, key risk indicators trace to the requirements they measure, Baseerah writes the executive summary on a self-hosted language model, and reports export as Word and PDF.

Official portals and publications

• NCSC, Cyber Assessment Framework collection
• NCSC, Cyber Essentials
• IASME, Cyber Essentials certification
• FCA Handbook, SYSC 15A Operational resilience
• PRA SS1/21 Operational resilience: impact tolerances for important business services
• ICO: report a personal data breach