The Department for Digital, Culture, Media & Sport ('DCMS') opened, on 26 July 2021, a call for views on its policy paper proposing amendments to the Network and Information Systems Regulations 2018 ('NIS Regulations') and the European Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down the rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council ('the DSP Regulation'), in light of the UK's exit from the EU. In particular, the paper indicates the Government's approach to rectify an EU-Exit related deficiency in the NIS legislation surrounding lowering the incident reporting thresholds for digital service providers ('DSPs'), noting that the current thresholds were established for a market size of 28 EU Member States and as such are now too high for the UK alone.

Consequently, the paper proposes the laying of a statutory instrument to amend the NIS Regulations and the DSP Regulation, which would revoke Article 4 from the DSP Regulation regarding thresholds and allow the Information Commissioner's Office ('ICO'), as the competent authority for DSPs, to set the thresholds at a more appropriate level through guidance following consultation with relevant DSPs. 

Furthermore, the call for views asks the extent to which respondents agree or disagree with the proposal to move incident thresholds from legislation to ICO guidance, and their reasoning for the same.

Responses may be submitted until 27 August 2021 via the online feedback survey tool, via email to [email protected] or by post to the NIS Team at the DCMS.

You can read the policy paper here.