The Online Safety Act update: Does it apply to you?

The Online Safety Act (Act), passed in October 2023, introduced key provisions that are now in effect, requiring affected businesses to comply with upcoming deadlines.  

Ofcom, the regulator responsible for enforcing the Online Safety Act, unveiled its first draft Code of Practice under the Act on 16 December 2024. This draft focuses on tackling illegal harms and represents a long-awaited milestone. It provides businesses with a clear compliance roadmap and signals the official countdown to enforcement. 

So, what do affected businesses need to do now? Here are some key dates to remember:  

• By 16 March 2025, all businesses within the Act’s scope need to complete an illegal content risk assessment to identify the risks of harm to users resulting from illegal content.  

• From 17 March 2025 (subject to approval from parliament), businesses will need to implement safety measures to tackle the risks of these harms.  

• More consultations and updates from Ofcom are expected this year, so watch this space and see what comes next.  

• Ofcom has recently published various guidance relating to the protection of children and ‘highly effective’ age assurance.  

David Sant, Senior Commercial Technology & Data Protection Solicitor, shares his insights: 

The stakes for non-compliance are high. Ofcom’s enforcement powers include fines of up to £18 million or 10% of global turnover—whichever is greater. Senior managers may also face potential criminal liability in certain circumstances, alongside other stringent enforcement measures that can significantly impact businesses. Compliance is therefore not optional; it’s critical.

To avoid these penalties, businesses within the scope of the Act must act swiftly. Key next steps include: 

• Determine whether the Act applies to your business (if you haven’t already). 

• Review Ofcom’s guidance to understand your obligations. 

• Complete required risk assessments and implement compliance measures by the relevant deadlines. 

With the March 2025 deadline fast approaching, time is of the essence. If you’re unsure about your responsibilities under the Act or need help preparing, our data protection team is ready to assist.