UK Online Safety Act Senior Manager Liability

Ofcom may include a requirement in an information notice for an entity to name one individual who meets the section 103 senior-manager test and can reasonably be expected to ensure compliance. The notice must also require the entity to inform the individual and explain the consequences of non-compliance. Naming happens in the entity's response; assigning an executive internally before a notice arrives is useful preparation but is not the statutory trigger.

Section 110 covers failure to prevent specified entity offences under section 109. These include failing to comply with the notice; knowingly or recklessly providing information that is false in a material particular; intentionally supplying encrypted information in a form that prevents Ofcom from understanding it; intentionally suppressing, destroying, or altering required information or documents; and intentional deletion or alteration of information that a data-preservation notice requires the entity to retain for an official investigation into a child's death. The precise intent and other elements in section 109 must be proved for the relevant route.

The entity must commit the underlying offence and the named individual must have failed to take all reasonable steps to prevent it. Section 110 therefore addresses information governance and evidence handling. A failure to meet an unrelated safety duty does not by itself establish the offence.

Section 110 contains specific defences. For the failure-to-comply route, it is a defence that the person held the relevant senior-manager role for such a short time after the notice was given that they could not reasonably have been expected to prevent the entity's offence. For the false-information, encryption, destruction, alteration, and data-preservation routes, it is a defence that the person was not a section 103 senior manager when the relevant act occurred. For every section 110 route, lack of knowledge that the person had been named is a defence.

Section 201 addresses the burden once sufficient evidence raises one of these statutory defences: the court must assume the defence is satisfied unless the prosecution proves otherwise beyond reasonable doubt. Whether a defence succeeds depends on the evidence and should be assessed by qualified counsel.

Section 202 is separate. If an entity commits an offence and it was committed with a corporate officer's consent or connivance, or was attributable to the officer's neglect, the officer also commits the offence. This route does not depend on an Ofcom requirement to name a senior manager.

Treat the information notice as a controlled legal and evidence process. Maintain a live requirements matrix, give the named individual authority to direct business and technical teams, and escalate immediately when a requirement cannot be met as written or on time.

The response record should cover information held by vendors and overseas teams, data lineage, calculation methods, samples, source preservation, and whether Ofcom can understand any encrypted material. For a data-preservation notice, document how the hold prevents both deliberate alteration and routine irreversible deletion for the required period.

Evidence should show what the manager did, when, with what information, and how the team addressed problems. It cannot determine by itself whether all reasonable steps were taken; that conclusion depends on the full facts.

The answers below separate the statutory trigger from useful governance. They explain the general law, not whether an offence or defence is proved in a particular case.