What are the UK Telecommunications Security Act compliance deadlines?

Nov 17, 2021: Royal Assent. Oct 1, 2022: Security measures regulations in force.

When does UK Telecommunications Security Act take effect?

UK Telecommunications Security Act took effect on Oct 1, 2022.

Who does UK Telecommunications Security Act apply to?

Public electronic communications network and service providers in the UK.

What are the penalties under UK Telecommunications Security Act?

Ofcom penalties up to 10% of relevant turnover, or up to GBP 100,000 per day for continuing contraventions.

UK Telecommunications Security Act

In force United Kingdom · In force Oct 1, 2022 · no upcoming deadlines

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

ComplianceOct 1, 2022 · 4.1 years ago · Source

Security measures regulations in forceElectronic Communications (Security Measures) Regulations 2022 come into force.

MilestoneNov 17, 2021 · 4.9 years ago · Source

Royal AssentTelecommunications (Security) Act receives Royal Assent.

Summaries for reference, not legal advice. Check the official text.

What it does

Imposes strengthened security duties on UK public telecoms providers, backed by detailed security measures regulations and a code of practice. It also gives the government powers to restrict the use of high-risk vendors' equipment through designated vendor directions.

Who it applies to: Public electronic communications network and service providers in the UK.
Penalties: Ofcom penalties up to 10% of relevant turnover, or up to GBP 100,000 per day for continuing contraventions.
Enforced by: Ofcom; Secretary of State for designated vendor directions.
Official name: Telecommunications (Security) Act 2021 and the Electronic Communications (Security Measures) Regulations 2022
Citation: 2021 c. 31; SI 2022/933
Topics: Cybersecurity, Breach notification

Verified 2026-09-25 legislation.gov.uk

Research notes

Tiered implementation timeframes for specific measures are set in the government's Telecommunications Security Code of Practice; those dates were not verified from an official page here and are left out.

In forceUnited Kingdom

Data (Use and Access) ActAmends the UK GDPR, DPA 2018 and PECR (recognised legitimate interests, relaxed automated decision-making rules, reasonable-and-proportionate DSAR searches, new transfer test, cookie exemptions, PECR fines raised to UK GDPR levels), creates Smart Data schemes and digital verification services, and replaces the ICO with an Information Commission. Commenced in stages from August 2025 to 2026.In effect since Aug 20, 2025

In forceSwitzerland

Swiss revised FADP (nFADP)Switzerland's modernised data protection law, closely aligned to GDPR: privacy by design/default, records of processing, DPIAs, breach notification to the FDPIC as soon as possible, and cross-border transfer rules. Protects only natural persons' data.In effect since Sep 1, 2023

ProposedUnited Kingdom

UK Cyber Security and Resilience BillUpdates the NIS Regulations 2018: brings managed service providers and data centres into scope, lets regulators designate critical suppliers, tightens incident reporting (initial notice within 24 hours, full report within 72 hours) and strengthens regulator powers. Substantive duties will follow via secondary legislation after Royal Assent.No date set

AmendedUnited Kingdom

UK Data Protection Act 2018Core UK data protection statute that sits alongside the UK GDPR. It sets exemptions and conditions for special category and criminal offence data, the law enforcement and intelligence services regimes, and the regulator's powers and fines. It has been substantially amended by the Data (Use and Access) Act 2025.In effect since May 25, 2018

AmendedUnited Kingdom

UK GDPRThe UK's core data protection regime: lawful bases, transparency, data subject rights, security, breach notification within 72 hours, and international transfer rules. Retained EU GDPR became the UK GDPR from 1 January 2021 and was materially amended by the Data (Use and Access) Act 2025 from 5 February 2026.In effect since May 25, 2018

EnactedUnited Kingdom

UK Investigatory Powers (Amendment) Act 2024Amends the Investigatory Powers Act 2016. It creates a lighter regime for intelligence agencies to hold bulk personal datasets with low or no expectation of privacy, widens communications data rules, and bars telecoms operators from making relevant changes to their services that would weaken lawful access capabilities while a retention notice is under review.No date set

In forceUnited Kingdom

UK Online Safety ActImposes duties of care on user-to-user services and search engines to assess and mitigate illegal content risks and, where children can access the service, to protect children (including highly effective age assurance for pornography and other primary priority content). Categorised services face additional transparency, user empowerment and fraudulent advertising duties.In effect since Mar 17, 2025

In forceUnited Kingdom

UK PSTI Act (product security)Sets baseline security requirements for consumer connectable products sold in the UK. Manufacturers must ban universal default passwords, publish a way to report vulnerabilities, and state the minimum security update support period. Importers and distributors share compliance duties.In effect since Apr 29, 2024

Questions about UK Telecommunications Security Act

What are the UK Telecommunications Security Act compliance deadlines?: Nov 17, 2021: Royal Assent. Oct 1, 2022: Security measures regulations in force.
When does UK Telecommunications Security Act take effect?: UK Telecommunications Security Act took effect on Oct 1, 2022.
Who does UK Telecommunications Security Act apply to?: Public electronic communications network and service providers in the UK.
What are the penalties under UK Telecommunications Security Act?: Ofcom penalties up to 10% of relevant turnover, or up to GBP 100,000 per day for continuing contraventions.

Deadlines

What it does

Related