Cyber Security and Resilience (Network and Information Systems) Bill – in a Public Bill Committee at 3:15 pm on 5 February 2026.
Esther McVey
Conservative, Tatton
With this it will be convenient to discuss Clause 14 stand part.
Kanishka Narayan
Parliamentary Under Secretary of State (Department for Science, Innovation and Technology)
Clause 13 ensures that operators of data centres provide essential information to regulators, enabling them to properly monitor their sector and its cyber-resilience. The clause requires operators to submit key details, such as names, addresses and contact information, within three months of designation, and to update regulators within seven days if anything changes. Regulators are required to maintain a list of designated entities. By keeping regulatory records current, the clause strengthens our ability to monitor and protect essential services and respond to incidents that could affect businesses, public services and national security. The clause plays a key foundational role in the Bill’s wider framework for cyber-security and resilience.
Like clause 13, clause 14 places legal duties on digital and managed services providers to provide essential information to their regulator—in this case, the information commission. Like operators of data centre services, RDSPs and MSPs will be required to register with the information commission within three months, submitting key details, such as names and contact information, and to update regulators within seven days if anything changes. Organisations based outside the UK will be required to nominate a UK representative and provide contact details. To strengthen cross-agency support and recognise the key role that these businesses play in the UK economy and society, the information commission will be required to share its registers of relevant digital and managed service providers with GCHQ. Those proportionate steps will enable authorities to do their job and respond when it matters.
Ben Spencer
Shadow Minister (Science, Innovation and Technology)
Clause 13 requires in-scope data centre operators to provide certain information to their designated competent authorities, which—subject to Government Amendment 11, which we passed earlier—will now be solely ofcom, and to keep that information up to date. The information includes the data centre operator’s address and the names of directors. It must be provided within three months of the data centre operator’s designation. For data centres that meet the threshold criteria, that would be three months after clause 4 comes into force. Other OESs are not subject to an equivalent requirement to provide information to their sector regulator. That reflects the fact that the Government currently have limited information about the data centre sector.
RDSPs are already required, under regulation 14 of the NIS regulations 2018, to provide their contact details to the information commission, as their sector regulator. Clause 14(2) amends regulation 14 to require RDSPs to provide more information, including about their directors and the digital services they provide. It would also require the information commission to share a copy of its register of RDSPs with GCHQ. Clause 14(9) requires RMSPs to register with the information commission and to submit the same contact details as RDSPs. RMSPs must nominate a UK representative if they are based outside the UK. The information commission will be required to maintain a register of RMSPs and to share it with GCHQ. Clauses 13 and 14 give Ofcom and the information commission access to more detailed information about regulated entities and facilitate regulatory oversight of the data centre RDSP and RMSP industries in the UK.
A parliamentary bill is divided into sections called clauses.
Printed in the margin next to each clause is a brief explanatory `side-note' giving details of what the effect of the clause will be.
During the committee stage of a bill, MPs examine these clauses in detail and may introduce new clauses of their own or table amendments to the existing clauses.
When a bill becomes an Act of Parliament, clauses become known as sections.
A parliamentary bill is divided into sections called clauses.
Printed in the margin next to each clause is a brief explanatory `side-note' giving details of what the effect of the clause will be.
During the committee stage of a bill, MPs examine these clauses in detail and may introduce new clauses of their own or table amendments to the existing clauses.
When a bill becomes an Act of Parliament, clauses become known as sections.
As a bill passes through Parliament, MPs and peers may suggest amendments - or changes - which they believe will improve the quality of the legislation.
Many hundreds of amendments are proposed by members to major bills as they pass through committee stage, report stage and third reading in both Houses of Parliament.
In the end only a handful of amendments will be incorporated into any bill.
The Speaker - or the chairman in the case of standing committees - has the power to select which amendments should be debated.
Ofcom is the independent regulator and competition authority for the UK communications industries, with responsibilities across television, radio, telecommunications and wireless communications services.
Ofcom Web Site http://www.ofcom.org.uk
