Welcome to this month's edition of our commercial review,
which sees a new piece of security legislation seeking to give the
GDPR a run for its money, as well as a useful judgment on how to
vary a contract.
Enjoy.
I see your GDPR and raise you…
With all the focus being on the GDPR, you would be forgiven if
you had missed another security-related regulation coming into
force. The Network and Information Systems Regulations 2018
("NIS") came into force on 10 May 2018
and brought with it an extra layer of security related
obligations.
NIS is not limited to personal data and applies to the security
of data and its infrastructure. NIS applies to two groups of
organisations: operators of essential services
("OES") and digital service providers
("DSPs"). There are a number of
designated authorities in relation to OES, such as Ofcom for
digital infrastructure and the Secretary of State for Health
(England) for healthcare in England. The Information
Commissioner's
