UK GDPR and DPA 2018: Primary data protection legislation requiring organizations to report certain types of personal data breaches within 72 hours and maintain records of all breaches
PECR: Privacy and Electronic Communications Regulations governing electronic communications and requiring specific security measures for service providers
NIS Regulations 2018: Network and Information Systems Regulations requiring essential service operators and digital service providers to report significant incidents
Health and Safety at Work Act 1974: Framework for workplace safety requiring reporting and documentation of incidents affecting worker safety
RIDDOR 2013: Reporting of Injuries, Diseases and Dangerous Occurrences Regulations requiring formal reporting of workplace incidents and accidents
Employment Rights Act 1996: Employment law framework relevant when incidents involve employee actions or affect employee rights
Computer Misuse Act 1990: Criminal law covering unauthorized access to computer systems and cyber-attacks, requiring consideration in cyber incident response
Fraud Act 2006: Legislation covering fraudulent activities, relevant for incidents involving financial fraud or deception
Civil Contingencies Act 2004: Framework for emergency response planning, particularly relevant for critical service providers
ISO 27001: International standard for information security management, providing framework for incident response and documentation requirements
FCA Requirements: Financial Conduct Authority regulations requiring specific incident reporting and response procedures for financial services firms
NHS Digital Security Requirements: Healthcare-specific security and incident reporting requirements for NHS organizations and suppliers
