How should teams decide whether UK Online Safety Act applies?
Teams should treat Regulated Service Scope under the UK Online Safety Act as a source-linked operating decision: first decide whether the service is in scope or exempt, then confirm which duties are triggered, assign the team that can change the process, and keep evidence showing the decision and review trigger.
In practice, the first check is simple: the Act applies to search services and services that allow users to post content online or interact with each other, including services such as social media services, consumer file cloud storage and sharing sites, video-sharing platforms, online forums, dating services, and online instant messaging services. Some services are exempt, including email services, SMS and MMS services, one-to-one live aural communications, certain limited functionality services, some combination services, public-body services, and certain education or childcare services.
- Write the Regulated Service Scope decision in one sentence before drafting controls.
- Attach the external source URL and a short source quote to the evidence record.
- Route unclear cases to legal, privacy, security, or compliance review before launch.
Explains the Act's service-scope purpose and supports the first regulated-service scoping decision.
Primary legislation for regulated services, exemptions, and scope.
Primary legislation for exempt services in Schedule 1.