A new law is making its way through Parliament that will fundamentally change how organisations report cyber incidents in the UK.
The Cyber Security and Resilience Bill completed its House of Lords stages on 2 November 2026 and now returns to the House of Commons for MPs to consider the Lords amendments. Royal Assent is expected before the end of 2026.
If you think this is just an IT issue, it is worth reading on.
What the Bill actually does
It updates and significantly expands the existing Network and Information Systems Regulations 2018, which currently only apply to critical national infrastructure and a limited set of digital services.
Under the new Bill that scope expands considerably:
- Managed Service Providers of a certain size are brought in scope for the first time.
- Data centres above 1MW capacity are classified as essential services.
- Critical suppliers to regulated organisations will face direct obligations.
- Only 27% of UK businesses had board level cyber accountability in the government's 2025 Cyber Security Breaches Survey. The Bill is designed to change that.
The reporting clock is getting shorter
This is the change that will affect the most organisations the most directly. Under the Bill, a two stage reporting process applies to significant cyber incidents:
- Initial notification to your sector regulator and the NCSC within 24 hours of becoming aware.
- Full incident report within 72 hours.
- Mandatory notification to affected customers where a breach puts them at risk.
That 24 hour initial notification is a new requirement. And it runs alongside, not instead of, the existing 72 hour UK GDPR breach notification obligation to the ICO for personal data incidents.
Two clocks. Different regulators. The same incident.
What this means for data protection
The Bill explicitly extends the definition of a reportable incident beyond service disruption to include confidentiality and integrity failures. That means a data breach or unauthorised access event can trigger the cyber reporting clock even if your systems never went down.
Organisations will need a single, unified incident response process that satisfies both the cyber reporting obligations under this Bill and the personal data breach obligations under UK GDPR. Most organisations currently have neither in a way that would meet both.
Fines under the Bill: up to £17 million or 4% of global turnover for the most serious failures.
Why act now
The Bill is not yet law and full implementation through secondary legislation is expected around 2028. But the organisations that will be best placed are the ones building their incident response and governance frameworks now, not after Royal Assent.
Does your organisation currently have an incident response process that covers both cyber security reporting and personal data breach notification? Our data breach support includes response planning as well as help during a live incident, or you can start with a free data protection review.
