Information requests from Ofcom: why you have one and what you need to do

If you have information that will help Ofcom fulfil its role, we might send you a request for that information.

Every request is unique to that case. When we send it, we will explain why we need the information.

We use formal information requests for many reasons, including (but not limited to):

1. to administer our regulatory fees process;
2. to better understand issues in the areas that we regulate and help us make more informed policy decisions;
3. to investigate processes and how decisions were made; and
4. to investigate potential non-compliance with our rules.

Our powers to request information are set out in law

Here are some of the relevant pieces of legislation:

• Communications Act 2003

  Ofcom has wide powers to require the provision of information under section 135 of the Communications Act. Ofcom has powers to impose financial penalties for non-compliance with a statutory information request and failure to comply can also constitute a criminal offence under sections 138 to 144 of the Communications Act.

• The Telecommunications (Security) Act 2021 (TSA)

  The Communications Act gives Ofcom powers to monitor and enforce industry’s compliance with their security duties (sections 105I and 105N to 105V). Ofcom can require providers to share information that we consider necessary for the purpose of carrying out its security functions.

  The TSA amends the security framework in the Communications Act with the aim of increasing the security of the UK's public electronic communications networks and services. All providers of public electronic communications networks or public electronic communications services must comply with this revised security framework.

  We will typically use the powers under section 135 of the Communications Act to gather any information we require.

• Wireless Telegraphy Act 2006 (WTA)

  Under section 32A of the WTA, Ofcom has wide powers to require the provision of information for the purpose of carrying out our radio spectrum functions. Ofcom has powers to impose financial penalties for non-compliance with a statutory information request and failure to comply can also constitute a criminal offence under sections 32C to 33 of the WTA.

• Postal Services Act 2011

  Under section 55 and Schedule 8 of the Postal Services Act, Ofcom can require the provision of information relating to a suspected contravention of any regulatory condition/direction imposed under Part 3 of the Postal Services Act or other postal legislation. Ofcom has powers to impose financial penalties for non-compliance with a statutory information request and failure to comply can also constitute a criminal offence under Part 2 of Schedule 8 to the Postal Services Act.

• Online Safety

  Under the Online Safety Bill, it is likely that Ofcom will be given the power to formally request any information from regulated services that may be required for exercising or deciding whether to exercise any of its powers, including information that needs to be obtained or generated by providers.

We also have powers in broadcasting and spectrum licences to request information from licensees.

We typically attach a formal information request to an email (as a PDF). If we ask for information from a company, the request is marked for the attention of the Company Secretary at the registered business address.

We send the email from information.registry@ofcom.org.uk.

In some cases, we will also send a hard copy by post, for example if you have not agreed for us to contact you by email only.

A formal information request generally consists of:

1. a cover letter attaching the information request;
2. the information request, generally called a ‘Notice’, which explains what we need the information for and the deadline for responding. The Notice typically contains a number of annexes:
   1. The actual questions you need to respond to will generally be contained in the first annex.
   2. Other annexes might contain information on how to provide information to Ofcom via a secure file transfer and information on potential offences and sanctions if you fail to comply with the requirements of the request. These may include criminal offences if you provide false or misleading information to Ofcom.

You will probably get a draft version first

Sending a request in draft version first allows us to make sure we have worded and targeted it clearly enough, so that we get the information we need and you can respond within the set time period. You don’t need to provide the actual information at this stage.

Once we have finalised the information request, we will send the formal ‘final’ Notice to you. You will then need to provide your response by the given deadline.

If you have any questions about the request, you can ask us to clarify.

In some situations, we might not consider it appropriate to send the request in draft form first. In those circumstances, we will make clear that you have been sent the ‘final’ Notice and need to respond by the given deadline.

In short, you need to provide clear, complete and accurate responses to all the questions by the deadline set out in the request.

You must also provide the information in the format requested. For example, this might be a document in .docx format or a spreadsheet in .csv format. We generally only accept information returned in the requested format.

The information you provide must be clear, complete and accurate

An incomplete response could mean failing to answer one or more questions (or sub-parts of a question), or failing to provide all information requested by a particular question.

If you do not have any of the information requested, then you should say so and explain what searches you have carried out to check.

A response can refer to other documents or information held by Ofcom, but it should not require us to interpret a response by reference to other information or documents you may have provided in order to understand your intended meaning.

If you can’t be sure that your response is 100% accurate, then you should clearly explain any problems to Ofcom and provide information with appropriate qualification.

We only extend deadlines for good reason – tell us promptly if you need more time

If you don’t think you can respond by the deadline, inform us immediately and clearly explain why. We only agree to extend deadlines where there are good reasons for doing so, like:

• unexpected absence of a key employee responsible for obtaining the required information;
• technical difficulties;  or
• other exceptional circumstances outside of your control.

We will consider requests for more time on a case-by-case basis.

If you run a business as an individual or as part of a small team, then the processes you can put in place for responding to information requests will be different to what larger businesses can do.

At a minimum, we expect anyone who receives an information request to:

• Review the request and consider the responses well in advance of the deadline to leave time for any issues to be resolved and for the information to be checked prior to submitting it.
  • You may find it helpful to set yourself some reminders and put the deadline in your calendar.
• Carefully read the requirements of all questions (including any applicable definitions) and ensure you understand what is being requested – if you don’t, then contact Ofcom as soon as possible.
• Consider the different systems or places where the requested information may be stored and carry out appropriate searches for the information.
• Prior to submitting your response, ensure:
  • You have provided a response to every question that has been asked.
  • Your response answers the question that has been asked.
  • You have thoroughly checked your responses to ensure they are clear, complete and accurate.
• Respond to the request by the deadline.

For established businesses, we expect:

• There to be a clear internal process for responding to information requests which ensures requests are logged, progress is monitored and requests are responded to by the deadline.
• Individuals to have the appropriate expertise (or know who else within the organisation may have the appropriate expertise) to identify the information within the scope of a request (or know what systems or places to search for it) to provide a clear, complete and accurate response.
• Appropriate checks to be implemented to ensure information is properly interrogated, cross-checked and reviewed through appropriate governance channels (including by the appropriate director/head of department or equivalent) prior to it being submitted.

It's important you provide clear, complete and accurate responses to all the questions by the deadline given in the request. If you don’t, we may open an investigation into your failure to comply. In turn, this may result in you receiving a significant financial penalty (and your service might be suspended).

Whether we investigate and decide to impose a financial penalty will depend on the circumstances. The maximum penalty depends on the relevant legislation. For example, we can impose a penalty of up to £2,000,000 for a contravention under the Communications Act plus up to £500 per day in respect of each day on which the contravention continues. Previous cases in which we have imposed financial penalties for non-compliance with a statutory information request are available in our Enforcement Bulletin.

Any information that is unclear will at a minimum result in additional correspondence with Ofcom, so take the time up-front to ensure your response is clear.

Failure to comply

• Failing to comply with a statutory information request, or providing false or misleading information to Ofcom, can lead to a formal investigation and may also constitute a criminal offence, which can result in a financial penalty and/or imprisonment.
• Failing to comply with a formal request for information issued under a licence can constitute a breach of licence, which may result in enforcement action and potentially revocation of the licence.

Ofcom has lots of experience in handling sensitive information from regulated firms. When we ask for information that is business sensitive or financially confidential, we ask for it in a formal request. You will need to identify any commercially sensitive data and explain clearly why you consider it to be confidential.

As a public authority, Ofcom will need to retain information as part of the evidence base underlying any decision it reaches. We will keep information in line with our records and information management policy.

We will not disclose data to a third party unless there is a legal reason for doing so. Please see our general privacy statement for more information.

Section 393 of the Communications Act (or equivalent section in other legislation) also restricts us from disclosing information relating to a business that has been provided to us. In summary, Ofcom is prevented from disclosing such information without the consent of the business unless one of the statutory exceptions on disclosure applies. If Ofcom proposes to disclose information, we would expect to first explain our intention to disclose the information and seek your consent and/or any objections you may have on our justification for disclosing the information.

We recognise that some information will be considered highly sensitive business confidential information and we will carefully consider the need to disclose against any concerns you may have. We will generally try and resolve the issue through constructive dialogue, but if we remain of the view that we need to disclose the information and you continue to object, we will give you advance warning.

Informal or voluntary requests

We gather information in a variety of ways, and it’s not always appropriate to use our statutory or licensing powers. We often benefit from information provided on an informal or voluntary basis and from constructive dialogue on a range of topics.

But if you have already, voluntarily provided information that could be relevant to our decision-making, we usually then send you a formal information request to confirm the completeness and accuracy of that information. This makes sure our decisions are made on the basis of robust and complete evidence. So, don’t be confused if it seems we are requesting information you’ve already provided to us.

Where we have been told informally that certain information is not available, we may also use our statutory or licensing powers to obtain formal confirmation of this.

Using information for a different purpose

As noted above, every request will clearly explain why we need the information.

Where we have obtained information for a specific purpose and wish to use that information for a different purpose, we will generally either:

• explain why we need to use the information for a different purpose and ask for your consent to do so; or
• send you another formal information request requiring the same information to be provided for the new purpose. We may also do this where we have informally asked for your consent to use the information for a different purpose and you have not given consent.