- Latest available (Revised)
- Original (As made)
This is the original version (as it was originally made). This item of legislation is currently only available in its original format.
2.—(1) The NIS Regulations are amended as follows.
(2) In regulation 1(2), after “relevant law-enforcement authority” insert—
““representative” means any natural or legal person established in the United Kingdom who is able to act on behalf of a digital service provider established outside the United Kingdom with regard to its obligations under these Regulations; and”.
(3) After regulation 14 insert—
14A.—(1) This regulation applies to any digital service provider which—
(a)has its head office outside the United Kingdom, but which offers digital services within the United Kingdom; and
(b)is not a small or micro enterprise as defined in Commission Recommendation 2003/361/EC(1).
(2) The digital service provider must—
(a)nominate in writing a representative in the United Kingdom; and
(b)notify the Information Commissioner of the name and contact details of that representative.
(3) The digital service provider must comply with paragraph (2)—
(a)in the case of a provider which is offering digital services within the United Kingdom on the coming into force date of these regulations, within three months of the date on which these regulations come into force; or
(b)in any other case, within three months of the provider first offering digital services in the United Kingdom.
(4) The Information Commissioner or GCHQ may contact the representative instead of or in addition to the digital service provider for the purposes of ensuring compliance with these Regulations.
(5) A nomination under paragraph (1) is without prejudice to any legal action which could be initiated against the nominating digital service provider.”
3. Regulation (EU) 2019/881 of the European Parliament and of the Council of 17th April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) is revoked.
Commission Recommendation concerning the definition of micro, small and medium-sized enterprises (OJ No. L 124, 20.5.2003, p. 36).
Latest Available (revised):The latest available updated version of the legislation incorporating changes made by subsequent legislation and applied by our editorial team. Changes we have not yet applied to the text, can be found in the ‘Changes to Legislation’ area.
Original (As Enacted or Made): The original version of the legislation as it stood when it was enacted or made. No changes have been applied to the text.
Explanatory Memorandum sets out a brief statement of the purpose of a Statutory Instrument and provides information about its policy objective and policy implications. They aim to make the Statutory Instrument accessible to readers who are not legally qualified and accompany any Statutory Instrument or Draft Statutory Instrument laid before Parliament from June 2004 onwards.
Access essential accompanying documents and information for this legislation item from this tab. Dependent on the legislation item being viewed this may include:
Use this menu to access essential accompanying documents and information for this legislation item. Dependent on the legislation item being viewed this may include:
Click 'View More' or select 'More Resources' tab for additional information including: