Document Generated: 2022-06-22
Status: This is the original version (as it was originally made).
(7) Before publishing the NIS national strategy or communicating it to the Commission, the
Minister may redact any part of it which relates to national security.
(8) In this regulation “a Minister of the Crown” has the same meaning as in section 8(1) of the
Ministers of the Crown Act 1975(15).
Designation of national competent authorities
3.—(1) The person specified in column 3 of the table in Schedule 1 is designated as the competent
authority, for the territorial jurisdiction indicated in that column, and for the subsector specified in
column 2 of that table (“the designated competent authorities”).
(2) The Information Commissioner is designated as the competent authority for the United
Kingdom for RDSPs.
(3) In relation to the subsector for which it is designated under paragraph (1), the competent
authority must—
(a) review the application of these Regulations;
(b) prepare and publish guidance;
(c) keep a list of all the operators of essential services who are designated, or deemed to be
designated, under regulation 8, including an indication of the importance of each operator
in relation to the subsector in relation to which it provides an essential service;
(d) keep a list of all the revocations made under regulation 9;
(e) send a copy of the lists mentioned in sub-paragraphs (c) and (d) to GCHQ, as the
SPOC designated under regulation 4, to enable it to prepare the report mentioned in
regulation 4(3);
(f) consult and co-operate with the Information Commissioner when addressing incidents that
result in breaches of personal data; and
(g) in order to fulfil the requirements of these Regulations, consult and co-operate with—
(i) relevant law-enforcement authorities;
(ii) competent authorities in other Member States;
(iii) other competent authorities in the United Kingdom;
(iv) the SPOC that is designated under regulation 4; and
(v) the CSIRT that is designated under regulation 5.
(4) In relation to digital services, the Information Commissioner must—
(a) review the application of these Regulations;
(b) prepare and publish guidance; and
(c) consult and co-operate with the persons mentioned in paragraph (3)(g), in order to fulfil
the requirements of these Regulations.
(5) The guidance that is published by under paragraph (3)(b) or (4)(b) may be—
(a) published in such form and manner as the competent authority or Information
Commissioner considers appropriate; and
(b) reviewed at any time, and if it is revised following such a review, the competent authority
or Information Commissioner must publish revised guidance as soon as reasonably
practicable.
(15) 1975 c. 26.
5