UK to tighten datacenter security and resilience measures

Datacenters operating in the UK will have to follow stricter security and resilience measures to protect themselves against potentially dangerous situations, such as cyberattacks and extreme weather events. The measures will be imposed by new plans drawn up by the British government.

A public consultation is being held until 22 February 2024 on the measures to be proposed, soliciting input from various interested groups, including datacenter operators, cloud service providers and experts in the field.

The new set of laws will require datacenter operators to take appropriate measures to mitigate the risks of significant incidents that interrupt or compromise access to data on the premises. A new regulatory function is also to be created to which incidents must be reported and which will work with the sector to guarantee and test risk mitigation measures.

According to the government, the aim of the new legislation is to encourage greater transparency of information and co-operation so that potential risks affecting the UK can be properly identified and addressed. It is also hoped that the new rules will help boost economic growth, making the UK a more attractive location for investment as it strengthens the resilience of datacenters. The government is also considering designating parts of the datacenter sector as critical national infrastructure.

“Data is an increasingly important driver of our economic growth and plays a key role in our public services. So ensuring that the companies that store it have the right protections in place to limit the risks of threats such as cyberattacks and extreme weather conditions will help us reap the benefits and give businesses peace of mind,” explains John Whittingdale, UK Minister for Data and Digital Infrastructure.

According to government statistics, around 28% of UK companies use services hosted in datacenters. Large companies, specifically those with at least 250 employees, account for 62%. In 2021, datacenter operators generated £4.6 billion in revenue.

In 2022, data played a significant role in the UK economy, contributing 6.9 percent of Gross Domestic Product (GDP), and 76 percent of all UK service exports depended on data. More broadly, 85 percent of the companies surveyed said they deal with digital data, and almost all of them with 10 or more employees do too.

Cases from Germany and the EU

Outside of British soil, looking at the European Union, Germany is the largest country in the region in terms of population and GDP. It is also one of Europe’s main datacenter hubs, strongly linked to the financialcenter of Frankfurt.

Perhaps that’s why the Frankfurt authorities decided to regulate the development of datacenters as early as 2021. The city had little land available, and the high demand for energy could make the city’s decarbonization plans unfeasible. They suggested that the waste heat should be reused in a district heating system.

The European Union published an Energy Efficiency Directive in September 2023, part of the movement to decarbonize the continent. To help in this endeavour, the expectation is that datacenters, alongside other sectors, will become more efficient. And the first step is the mandatory submission of a report on the energy use and emissions of datacenters operating in the region and with a capacity greater than 500 kW. Other efficiency measures have yet to be defined.

ll member states will have to implement the directive in their national legislation, but before the final version of the text was published, the German federal government had already passed a national energy efficiency law that will also have a direct impact on datacenters.

The regulations for datacenters address four main points: (i) prevention and use of waste heat, (ii) efficient use of energy, (iii) use of renewable sources, and (iv) introduction of an energy and environmental management system. For German legislation, “datacenters” are facilities with a non-redundant nominal capacity of 300 kW or more.