Essential services must be ready for threats to our digital economy

Introduced to Westminster in November 2025, the Bill seeks to establish new and enhanced requirements for essential and digital services, expanding on the Network and Information Systems Regulations 2018 and reflecting the EU’s NIS 2, promoting robust cyber resilience to protect national security and economic growth.

Certain essential businesses are already under obligations imposed by the 2018 Regulations to implement security and resilience measures to strengthen their systems and networks against compromise. The Bill further expands the scope of these obligations beyond essential services (such as transport, energy and water) to include: data centres operating above certain capacity thresholds; large load controllers that handle electrical load networks across the country's grid (such as the e-vehicle charging network); and managed service providers, such as outsourced IT services who support the day to day running of essential services.

Regulators will also be able to designate critical suppliers as “in-scope”, beyond those who deliver essential services. The expansion of operators subject to these resilience requirements reflects the interconnected nature of our economy, and the growing reliance on digitisation to keep the economy running.

Alongside widened scope, there is an increase in reporting obligation. Keen to get ahead of any disruption, the Bill will now impose an early warning notification to the relevant regulator where a significant incident occurs, followed by a more detailed report within 72 hours of the incident.

The significance of an incident will centre on the extent of the disruption expected, as well as the number of individuals affected and the nature of any data that has been compromised. This is a key change for businesses delivering essential services to the public: enhanced monitoring measures and being overseen by regulators with stronger investigatory powers will be a feature of performing these extended duties.

The Scottish Government’s Green Datacentres and Digital Connectivity Vision and Action Plan aims to build Scotland’s profile as a leading zero-carbon, cost-competitive green data hosting location. On the back of this, more than 15 data centres are already functional in Scotland.

Given their strategic role in Scotland’s future economic growth, operators must ensure awareness and compliance with the additional and enhanced obligations the Bill introduces.

The UK Government recently highlighted that 28 per cent of UK businesses – and 62 per cent of large businesses – rely on data centre services and indicated that “the ripple effects of outages extend far beyond the tech sector”.

On this basis, and given the potential downstream implications, operators must consider the risks and resilience measures in a holistic, proactive manner to ensure compliance with this increased regulatory scope. Demonstrating resilience, in furtherance of ensuring businesses that provide essential services in our economy are prepared and can mitigate threats, will be critical to retaining the confidence of key stakeholders and partners.

James McGachie is a Partner at DLA Piper. This piece was co-written with Isla Neil and Morven Henderson, both Associates at DLA Piper.