Summary
- Lords agreed amendments 12–15 removing potential-impact wording from proposed data-centre incident reporting.
- Amendment 30 requires updates to affected data-centre service customers after initial notification, if enacted.
- The minister committed to a voluntary near-miss reporting arrangement outside primary legislation, while further customer-update amendments were agreed.
The House of Lords has agreed amendments to the UK’s Cyber Security and Resilience (Network and Information Systems) Bill that would change how qualifying data-centre operators report significant incidents and communicate with customers. The decisions were made during Report Stage on 26 October and concern the wording of proposed legal duties rather than obligations already in force.
The amendments were moved by Baroness Lloyd of Effra and recorded in the official Hansard proceedings. Their passage provides a distinct development after ministers had earlier clarified the government’s intention to bring qualifying commercial data-centre services within the Network and Information Systems regulatory framework.
At Report Stage, peers accepted changes to the reporting trigger for data-centre incidents and to the way affected customers would receive updates. The amendments follow the government’s earlier clarification of which commercial data-centre services it intends to regulate, but address different provisions of the Bill.
Actual effects rather than possible consequences
Government amendment 12 removes the words ‘could have had’ from the data-centre reporting provision. Along with consequential amendment 17, the change narrows an approach that could have captured incidents based on possible significant effects, even if those consequences did not materialise.
The alteration should not be described as abolishing incident reporting or making notification optional for genuinely significant events. It changes part of the test for when the duty would apply, subject to the complete statutory wording and any subsequent regulations.
Amendments 13 and 15 address the operation or security of a data-centre service when the incident relates to network and information systems relied upon by the operator or to a customer’s systems. Amendment 14 removes separate wording that referred to an impact in the United Kingdom being significant.
The new formulation is relevant to the division of responsibilities in shared data-centre environments. Facility operators may provide electricity, environmental controls, physical security and some communications functions, while customers own or manage other elements of computing infrastructure.
A disturbance can involve several parties without each controlling every affected system. The proposed wording makes the relationship between a service, its supporting systems and customer systems central to the reporting assessment. It does not eliminate the need to establish the legal scope of the operator’s services.
During debate, peers raised concerns that very broad reporting triggers could create excessive notifications without improving resilience. Others argued that objective factors such as electricity loss, cooling interruption, network availability and the duration of disruption should help operators assess significance.
Baroness Neville-Jones tabled amendment 16 specifying such factors, but did not move it after the minister indicated that related detail would be considered in consultation. It would therefore be incorrect to reproduce that proposed list as if it had become part of the Bill.
Further updates to affected customers
The Lords agreed government amendment 30, which would require an operator of an essential service providing a data-centre service to give customers further updates about an incident and its impact after initial notification, as the operator considers necessary. This is a different function from reporting an incident to a regulator.
Customer communications can depend on incomplete information during the first stages of a disruption. An operator may initially know that a facility power system, cooling plant or network path has failed, but may not yet know the full effect on customer equipment or workloads. A continuing update obligation is intended to address the interval between initial notice and clearer incident assessment.
Equivalent customer-update amendments 35 and 40 were also agreed for relevant digital service providers and managed service providers. The distinction matters because cloud, colocation and managed-service businesses may fall within different regulatory definitions even where their services depend on similar buildings and infrastructure.
The minister committed to developing voluntary near-miss reporting without putting that mechanism into the Bill. Other proposed amendments requiring additional prescribed mitigation advice in customer updates were not moved. The adopted text must therefore be distinguished from proposals discussed but not agreed during the debate.
A credible incident-reporting process requires timely information from security monitoring, engineering, service management and customer liaison teams. In multi-tenant facilities, identifying affected services and supplying useful updates may depend on the operator’s contracts and the access it has to tenant-held information.
The Bill still requires further parliamentary consideration. Its exact obligations, commencement dates, regulatory guidance and any additional rules cannot be assumed from a Report Stage debate. Operators may prepare escalation and communications procedures, but should not present the proposed changes as already enforceable statutory duties.
The agreed amendments would narrow the potential-impact test for significant incidents and require further customer updates in specified circumstances. They remain changes to a Bill, not enforceable obligations today. Final compliance thresholds, commencement dates and associated regulatory guidance depend on later parliamentary and implementation steps.
