A (sub)sea change: the UK government consults on new legislation to protect critical undersea digital infrastructure

The UK government is consulting on new legislation to protect critical undersea infrastructure, including subsea pipelines and interconnectors.  Subsea cable infrastructure carries 99% of the UK’s international data traffic and, until now, its security has principally been governed by the outdated Submarine Telegraph Act 1885.  The consultation follows the Starmer government’s announcement in May of plans to impose new security-related obligations on cable owners and operators, with the aim of minimising disruptions to UK connectivity.  Modern legislation to protect subsea cable infrastructure is long overdue and, directionally, the government’s proposals strike a broadly sensible balance between the practical day-to-day compliance burden on providers and ensuring the security and resilience of the infrastructure.  As with all new legislation, the devil will be in the detail: the government has not yet identified a proposed regulator, and a constructive working relationship between the regulator and providers will be critical to ensuring the new proposals work in practice.

The key proposals include broad new duties for providers of subsea data conveyance systems or services to: 

• take appropriate and proportionate measures to manage the risk of security compromises occurring (including identifying and assessing security compromise risks, actively reducing vulnerabilities and preparing for potential incidents); 
• take appropriate and proportionate measures in response to security compromises, aimed at restoring operations swiftly; 
• notify the government and relevant regulator of security compromises (including cable faults and outages); and
• inform direct users of significant risks of security compromise (although the government notes this is not intended to require providers to share sensitive operational details, security vulnerabilities or other information where disclosure could itself increase security risk).

The white paper acknowledges that hyperscale technology companies and financial investors are heavily investing in subsea data conveyance systems, and that evolving investment patterns are resulting in increasingly complex ownership structures and operating models.  Where a system or service is provided by a consortium, the government proposes to impose the duties on all members with a designated “lead entity” for regulator-facing reporting, notifications and coordination.

Failure to comply with the duties could have serious consequences: the proposals include powers for the relevant regulator to impose financial penalties of up to the higher of £10 million or 10% of a provider’s qualifying worldwide revenue.  

The government is also seeking views on: 

• a registration framework, to help the government identify in-scope infrastructure and support supervisory activity and engagement; and
• national security direction powers, which would enable the government to compel providers to take urgent action to prevent, mitigate or respond to acute national security risks to subsea data conveyance systems or services (including providing access to the infrastructure itself or implementing temporary security measures) – similar to the powers included in the Cyber Security and Resilience Bill currently before Parliament.

The government’s proposals are consistent with the current push by governments around the globe to bring critical cable infrastructure within the scope of national security oversight.  Cable systems underpin the digital economy, and we expect to continue to see them increasingly designated as critical, strategic national assets and regulated as such.

The consultation will close on 14 January 2027.