Section 110 can make an individual named in an Ofcom information-notice response personally liable when the entity commits a specified information offence and the individual failed to take all reasonable steps to prevent it.
Section 110 does not impose automatic liability for every breach of an online-safety duty. Section 202 separately covers corporate officers where an entity offence was committed with their consent or connivance or was attributable to their neglect.
Structured answer sets in this page tree.
Cited legal and guidance references.
Personal liability under the Online Safety Act is tied to specific offences and facts. Under section 110, a can commit an offence only if the entity commits one of the listed information offences and the individual failed to take to prevent it. Under section 202, a can commit the entity's offence where consent, connivance, or neglect is proved. These routes do not make every executive personally criminally liable whenever a service breaches a safety duty.
Ofcom may require an entity receiving an to name one individual who is a senior manager and can reasonably be expected to ensure compliance. The notice must require the entity to inform that individual and explain the consequences of non-compliance. Naming happens in the entity's response; an internal allocation made before the notice is useful governance but is not the statutory trigger.
Section 110 then covers failure to prevent specified entity offences: failure to comply with the ; knowingly or recklessly providing materially false information; providing encrypted information in a form that prevents Ofcom from understanding it with the required intent; suppressing, destroying, or altering required information or documents with the required intent; and the later offence concerning intentional deletion or alteration of information required by a data-preservation notice for an investigation into a child's death.
For each route, the entity must commit the underlying offence and the named individual must have failed to take to prevent it. The legislation does not require the entity to be prosecuted first merely to establish the section 110 offence, but the underlying entity offence must be proved.
For a failure-to-comply charge under section 110(2), it is a defence that the person held the relevant senior-manager role for such a short time after the notice was given that they could not reasonably have been expected to prevent the offence. For the false-information, encryption, destruction, and data-preservation routes, it is a defence that the person was not a section 103 senior manager when the relevant act occurred. For every section 110 charge, lack of knowledge that the person had been named is a defence.
Section 201 governs the burden once sufficient evidence raises a statutory defence: the court must assume the defence is satisfied unless the prosecution proves otherwise beyond reasonable doubt. These defences are fact-specific and should not be treated as substitutes for notice controls.
Section 202 is different. If a relevant entity commits an offence and the offence was committed with an officer's consent or connivance, or was attributable to the officer's neglect, the officer also commits the offence. It does not require the section 103 naming process.
Treat an Ofcom notice as a controlled legal and evidence process. The named individual needs a live requirements matrix, clear authority to direct business and technical teams, access to legal and technical reviewers, and immediate escalation when a requirement cannot be met as written.
The response process should cover information held by vendors and overseas teams, explain data lineage, validate calculations and samples, preserve source material, and confirm that encrypted information is intelligible to Ofcom. If a data-preservation notice applies, the hold must prevent both intentional deletion and routine irreversible deletion for the required period.
The record should show what the manager did, when, with what information, and how problems were addressed. It should not claim that governance paperwork proves ; that conclusion depends on the full facts.
Maintain an information-governance map for each regulated service: provider entity, accountable executives, data owners, vendors, retention schedules, technical contacts, legal reviewers, and access to source systems. Run a notice-response exercise against a realistic deadline and include overseas data, encryption, backups, and routine deletion.
Do not pre-name someone as a substitute for Ofcom's statutory request. Instead, identify people who could meet the section 103 test, confirm succession and absence cover, and give them authority to obtain evidence and escalate non-cooperation.
No. Section 110 is limited to an individual named under an Ofcom , a specified underlying entity information offence, and the individual's failure to take to prevent it. Section 202 is a separate route for an officer where an entity offence involved the officer's consent or connivance or was attributable to the officer's neglect. Other statutes may create different personal-liability regimes.
No. Ofcom may require the provider entity to name an individual in its response to an . The entity selects a person who meets the statutory senior-manager test and can reasonably be expected to ensure compliance. The notice must require the entity to inform the individual and explain the consequences.
No. A policy can support the evidence, but section 110 asks what the individual actually did in the circumstances. Relevant records can include timely instructions, preservation holds, ownership and authority, verification, escalation, correction, and action on known gaps. Whether the legal test is met depends on the full evidence.
No. Chapter 1 of Part 2 of the Crime and Policing Act 2026 establishes a separate content-removal notice and civil-penalty regime for unlawful weapons content, including a provider's content manager, but those provisions are not yet in force. It should not be described as the Online Safety Act section 110 information-offence route. Providers potentially covered by both need separate legal and operational mappings.
Assign every notice requirement, source system, preservation step, verification, escalation, approval, and deadline before responding to Ofcom.
Turn the entity, service, data, retention, and verification requirements into owned evidence and review tasks.
Check information-notice, offence, defence, or corporate-officer questions against cited source material.
Work through authority, preservation, collection, validation, escalation, evidence, and next actions.