The UK government says data centres are critical infrastructure, giving them extra protection

Data centres across the UK are set to see a major security upgrade after the Department of Science, Innovation and Technology (DSIT) reclassified them as Critical National Infrastructure (CNI).

Data centres are the backbone of most organisations and therefore the backbone of the UK economy, so DSIT wants to offer them the same level of protection as our energy and water systems. The UK has the largest number of data centres in Western Europe.

Due to their importance to the economy and the sensitive data they store, data centers are a prime target for both state-sponsored and financially motivated attacks.

Protection against cybercrime and blackouts

The designation comes with new protection measures designed to mitigate the effects of cyberattacks, power outages and adverse weather conditions that could disrupt data center operations.

A dedicated CNI team will be set up to monitor UK data centres for potential threats that could disrupt services that rely on their data, such as banking and the NHS, as well as providing access to security services such as the National Cyber Security Centre. The CNI team will also be responsible for coordinating access for emergency services in the event of an incident.

DSIT hopes the new designation will increase businesses’ confidence in data centres, as well as deter potential cyberattacks as the government provides additional mitigation and security measures to ensure services remain online and not disrupted, protecting sensitive data such as NHS patient records from cybercriminals while allowing healthcare facilities to continue to operate.

Alongside the CNI designation, DSIT revealed a proposed £3.75bn private investment in Europe’s largest data centre, to be built in Hertfordshire by data company DC01UK. The data centre is expected to directly support 700 jobs, as well as supporting 13,740 jobs in the UK.

“Data centers are the engine of modern life, powering the digital economy, and protecting our most personal information. Including data centers in the national critical infrastructure regime will enable greater coordination and collaboration with the government to combat cybercriminals and unexpected events,” said Technology Secretary Peter Kyle.

“The massive £3.75 billion private investment announced today in Hertfordshire is a testament to the confidence in these plans and a clear example of my determination to ensure that technological advances help grow our economy and create wealth across the country,” Kyle concluded.

In early 2024, DSIT announced the Cybersecurity and Resilience Bill, which will require suppliers of critical infrastructure to ensure their supply chains are resilient and well-secured against cyberattacks.