Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

UK Online Safety Act

In force United Kingdom · In force Mar 17, 2025 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

ReportingApr 11 · 7 months ago · Source
Fee notification window closes (2026/27)Fee-liable providers must notify Ofcom before the notification window for the first charging year closes.
Takes effectJul 25, 2025 · 15 months ago · Source
Protection of children duties applyChildren's safety duties and Protection of Children Codes take effect, including highly effective age assurance; children's risk assessments due by 24 July 2025.
ComplianceApr 16, 2025 · 18 months ago · Source
Children's access assessments dueServices had to complete children's access assessments to determine whether children are likely to access them.
Takes effectMar 17, 2025 · 19 months ago · Source
Illegal harms duties enforceableIllegal content safety duties apply; illegal content risk assessments had to be completed by 16 March 2025.
MilestoneOct 26, 2023 · 3 years ago · Source
Royal AssentThe Online Safety Act receives Royal Assent.

Summaries for reference, not legal advice. Check the official text.

What it does

Imposes duties of care on user-to-user services and search engines to assess and mitigate illegal content risks and, where children can access the service, to protect children (including highly effective age assurance for pornography and other primary priority content). Categorised services face additional transparency, user empowerment and fraudulent advertising duties.

Who it applies to
User-to-user services, search services and pornography providers with links to the UK (significant number of UK users or UK target market), regardless of where based. Categorised (Category 1/2A/2B) services based on UK user numbers and functionality thresholds in secondary legislation. Fees payable by providers with qualifying worldwide revenue at or above the threshold set by regulations.
Penalties
Up to GBP 18 million or 10% of qualifying worldwide revenue, whichever is greater; business disruption measures and criminal liability for senior managers in some cases.
Enforced by
Ofcom
Official name
Online Safety Act 2023
Citation
2023 c. 50
Topics
Online safety, Children
Verified 2026-09-22 ofcom.org.uk ofcom.org.uk rpclegal.com
Research notes

Ofcom published its register of categorised services on 10 July 2026 (per RPC and Bristows reporting; Ofcom page not fetched), with consultations on Category 1 duties open to 2 Oct 2026 and final codes expected by mid-2027. Fee notification close date (11 Apr 2026) taken from Ofcom-sourced reporting; Ofcom page returned 403 during verification.

Related

In forceUnited Kingdom
Data (Use and Access) ActAmends the UK GDPR, DPA 2018 and PECR (recognised legitimate interests, relaxed automated decision-making rules, reasonable-and-proportionate DSAR searches, new transfer test, cookie exemptions, PECR fines raised to UK GDPR levels), creates Smart Data schemes and digital verification services, and replaces the ICO with an Information Commission. Commenced in stages from August 2025 to 2026.In effect since Aug 20, 2025
ProposedUnited Kingdom
UK Cyber Security and Resilience BillUpdates the NIS Regulations 2018: brings managed service providers and data centres into scope, lets regulators designate critical suppliers, tightens incident reporting (initial notice within 24 hours, full report within 72 hours) and strengthens regulator powers. Substantive duties will follow via secondary legislation after Royal Assent.No date set
AmendedUnited Kingdom
UK Data Protection Act 2018Core UK data protection statute that sits alongside the UK GDPR. It sets exemptions and conditions for special category and criminal offence data, the law enforcement and intelligence services regimes, and the regulator's powers and fines. It has been substantially amended by the Data (Use and Access) Act 2025.In effect since May 25, 2018
AmendedUnited Kingdom
UK GDPRThe UK's core data protection regime: lawful bases, transparency, data subject rights, security, breach notification within 72 hours, and international transfer rules. Retained EU GDPR became the UK GDPR from 1 January 2021 and was materially amended by the Data (Use and Access) Act 2025 from 5 February 2026.In effect since May 25, 2018
EnactedUnited Kingdom
UK Investigatory Powers (Amendment) Act 2024Amends the Investigatory Powers Act 2016. It creates a lighter regime for intelligence agencies to hold bulk personal datasets with low or no expectation of privacy, widens communications data rules, and bars telecoms operators from making relevant changes to their services that would weaken lawful access capabilities while a retention notice is under review.No date set
In forceUnited Kingdom
UK PSTI Act (product security)Sets baseline security requirements for consumer connectable products sold in the UK. Manufacturers must ban universal default passwords, publish a way to report vulnerabilities, and state the minimum security update support period. Importers and distributors share compliance duties.In effect since Apr 29, 2024
In forceUnited Kingdom
UK Telecommunications Security ActImposes strengthened security duties on UK public telecoms providers, backed by detailed security measures regulations and a code of practice. It also gives the government powers to restrict the use of high-risk vendors' equipment through designated vendor directions.In effect since Oct 1, 2022
Questions about UK Online Safety Act
What are the UK Online Safety Act compliance deadlines?
Oct 26, 2023: Royal Assent. Mar 17, 2025: Illegal harms duties enforceable. Apr 16, 2025: Children's access assessments due. Jul 25, 2025: Protection of children duties apply. Apr 11, 2026: Fee notification window closes (2026/27).
When does UK Online Safety Act take effect?
UK Online Safety Act took effect on Mar 17, 2025.
Who does UK Online Safety Act apply to?
User-to-user services, search services and pornography providers with links to the UK (significant number of UK users or UK target market), regardless of where based. Categorised (Category 1/2A/2B) services based on UK user numbers and functionality thresholds in secondary legislation. Fees payable by providers with qualifying worldwide revenue at or above the threshold set by regulations.
What are the penalties under UK Online Safety Act?
Up to GBP 18 million or 10% of qualifying worldwide revenue, whichever is greater; business disruption measures and criminal liability for senior managers in some cases.