Ofcom probes Zayo and Tata Communications over UK security data failures

The investigation signals Ofcom’s transition to active enforcement of the Telecommunications Security Act, which grants the regulator broader oversight of critical infrastructure providers. For streaming and CDN professionals, this probe highlights the escalating compliance burden for the physical layer of video delivery, as regulators now demand granular data on resilience and security measures. Failure to maintain accurate reporting pipelines could lead to operational oversight or fines of up to 10% of relevant turnover. The outcome, expected by late 2026 or 2027, will likely set a precedent for how strictly the UK enforces data transparency within the fiber optic and digital communications sectors. Watch for whether Ofcom issues formal notifications of contravention as these investigations progress.

The investigations into Zayo and Tata Communications occur as Ofcom intensifies its oversight under the Telecommunications Security Act 2021. This legislative framework shifted the UK from an operator-led security model to a prescriptive regime, requiring public electronic communications providers to meet specific standards for network architecture and supply chain risk management. Per a May 2026 Ofcom consultation, the regulator is currently proposing updates to its resilience guidance to reflect emerging threats from agentic AI and geopolitical instability. These updates aim to standardize incident reporting thresholds, such as requiring mobile operators to report security compromises affecting at least 100,000 customers.

Historical enforcement suggests Ofcom views accurate data submission as a critical regulatory pillar. In July 2024, per Stephenson Harwood, the regulator fined TikTok £1.875 million for failing to provide accurate information regarding its parental control features, marking one of the first major penalties under similar information-gathering powers. Smaller fines have also been common; for instance, Ofcom fined O2 £150,000 in December 2021 for providing incomplete responses during a billing investigation. These precedents indicate that while initial fines for administrative failures may be modest, repeat offenses or evidence of systemic negligence can lead to significantly higher penalties.

The regulatory pressure is mounting as the UK government prepares the Cyber Security and Resilience Bill, as noted in the May 2026 King’s Speech. This bill is expected to expand Ofcom’s remit further, potentially including data centers and other digital infrastructure under its security mandate. For infrastructure giants like Zayo, which recently announced a $4.25 billion acquisition of Crown Castle’s fiber business in March 2025, maintaining strict compliance with UK-specific security regulations is becoming a central operational requirement for cross-border communications providers.