Trigger situation

A provider receives notice of an Ofcom investigation. A provider receives an information request under section 135 of the Communications Act 2003. A provider is subject to a complaint from a consumer or competitor that has been escalated to Ofcom. A provider receives a provisional notification of a contravention under section 96A. A provider faces the prospect of Ofcom enforcement action including financial penalties.

Most enforcement cases arise from alleged breaches of the General Conditions of Entitlement. Understanding the underlying obligations is essential to mounting an effective defence.

Why it matters now

Ofcom’s enforcement powers have expanded materially since 2003 and have become notably more active. The Telecommunications Security Act 2021 added security enforcement powers covering a new category of conduct (breaches of the Telecommunications Security Requirements Regulations 2023). The Online Safety Act 2023 brought video-sharing platforms under Ofcom’s remit and extended enforcement to new categories of content. Ofcom has also signalled that it is moving toward more proactive enforcement and higher financial penalties. In parallel, Ofcom’s budget has been squeezed, which affects both the speed and the intensity of Ofcom’s investigation and enforcement activity. The combination of wider powers, a more enforcement-focused culture, and resource constraints creates an unpredictable environment. An investigation that should run for 18 months may take three years if Ofcom lacks investigative resources. An enforcement action that Ofcom might not prioritise in one year may suddenly become a priority in the next, depending on Ofcom’s strategic focus. Providers that understand Ofcom’s enforcement approach, and that engage constructively with the investigation process, achieve materially better outcomes than those that treat investigations as purely adversarial.

Where clients get it wrong

The most dangerous error is treating an Ofcom information request as routine correspondence. Under section 135 of the Communications Act 2003, Ofcom can issue an information notice requiring a person to provide specified information or documents within a specified period. Failure to comply is a criminal offence. Many providers respond to section 135 requests without legal advice, providing more information than required or making admissions that are later used against them in enforcement proceedings. Once information has been provided to Ofcom, it is difficult to walk back or qualify. Providers that engage with a section 135 request as routine administrative correspondence often discover, years later, that a comment they made in passing has been used as evidence in an Ofcom enforcement decision.

The second widespread error is underestimating the investigation timeline and resourcing requirements. Ofcom investigations can run for years. The investigation may include several rounds of information requests, interviews with key personnel, and detailed analysis of technical or commercial data. Some investigations remain open for five or more years before a final decision is reached. Providers that do not set aside adequate management time and legal budget at the outset find themselves under-resourced at critical stages. This is particularly problematic when key personnel leave the organisation. The business loses continuity of the narrative, and the investigation becomes more adversarial.

The third mistake is failing to engage constructively with Ofcom during the investigation. Some providers take an adversarial approach, resisting information requests or limiting engagement with investigators. This approach is counterproductive. Ofcom’s enforcement decision will ultimately rest on whatever evidence Ofcom can gather, whether or not the provider cooperates. A provider that cooperates with the investigation, that explains its conduct in good faith, and that demonstrates a commitment to compliance, is more likely to receive a compliance-focused outcome than a punitive one. Ofcom publishes very detailed enforcement decisions, and these decisions show a clear distinction between cases where the provider cooperated and those where it did not. Cooperation affects both the likelihood of enforcement and the level of penalty if enforcement is decided.

The fourth error is failing to understand the procedural safeguards available under the Communications Act 2003. Before Ofcom can impose a financial penalty, Ofcom must issue a provisional notification of a contravention under section 96A. This notification must set out the facts and legal analysis on which Ofcom relies, and must invite the provider to make representations. The provider then has a right to respond in writing and (sometimes) to make oral representations to Ofcom. The final enforcement decision must take the provider’s representations into account. Providers that do not engage substantively with this procedure, or that treat the provisional notification as a formality, miss an opportunity to influence Ofcom’s final decision.

The fifth mistake is failing to understand what a “contravention” is for Ofcom enforcement purposes. Ofcom can only enforce “contraventions” of the Communications Act 2003, the General Conditions, the SMP conditions, or certain other specified enactments. Not every breach of a regulatory obligation is enforceable by Ofcom. Some breaches are enforced by other regulators or by private law remedies. Providers that treat every potential breach as equally serious create noise in their own response to Ofcom. Ofcom responds better to providers that focus on the actual contraventions alleged and that calibrate their response accordingly.

What good looks like

Bratby Law’s approach to Ofcom investigations is to engage constructively with the regulator while protecting the client’s legal position and the confidentiality of legally privileged advice.

First, we advise on the nature and scope of an Ofcom information request or investigation. We identify what Ofcom is actually investigating and what evidence Ofcom is seeking to establish. We review the information request against the statutory test: is the request proportionate and is it properly specified? We advise on whether the information requested is legally privileged and if so, how to claim privilege. We advise on whether information requested is confidential or commercially sensitive, and how to mark it appropriately so that Ofcom handles it in confidence.

Second, we work with the client to understand its own conduct and the factual record. This involves reviewing the client’s own documents and communications to understand what happened, when it happened, and what the client’s understanding of the applicable regulations was at the time. This exercise is essential. Ofcom will gather the same information, and the client’s account needs to be consistent with the documentary evidence. Inconsistencies between what the client tells Ofcom and what the documents show will be interpreted against the client. We help clients understand what they should be telling Ofcom, and we help them gather the evidence that supports their account.

Third, we draft responses to information requests that are compliant with the legal requirements but that are also carefully calibrated to what Ofcom is actually asking for. An information request under section 135 requires information to be provided on what Ofcom specifies. A well-drafted response answers Ofcom’s actual question, provides the information requested, and does not volunteer information beyond the scope of the request. We help clients understand that a short, focused response that directly answers Ofcom’s question is better than a lengthy narrative that elaborates on peripheral issues.

Fourth, we advise on how to structure internal escalation and decision-making during an investigation. Ofcom investigations often require the client to make business decisions (for example, decisions about remediation or changes to business processes) that depend on understanding the legal implications. We help the client understand when to escalate to the board or senior management, and we advise on what information senior management needs to understand the implications of the investigation.

Fifth, we advise on the section 96A provisional notification process. When Ofcom issues a provisional notification of a contravention, this is a formal legal document setting out Ofcom’s provisional findings. We carefully review the provisional notification to identify what factual assertions Ofcom has made, what legal conclusions Ofcom has drawn, and where gaps exist in Ofcom’s evidence or reasoning. We then advise on whether and how to respond. Sometimes the best response is a written submission addressing gaps in Ofcom’s analysis. Sometimes the response involves providing additional evidence that shows Ofcom’s factual assertions are incorrect. Sometimes the best approach is to concede the contravention and focus the response on demonstrating compliance-focused remediation and low penalty risk.

Sixth, we advise on penalty mitigation. If Ofcom decides to impose a penalty, the level of penalty depends on several factors: the nature and gravity of the breach, the duration of the breach, the market impact, and the compliance history. Ofcom publishes penalty guidelines setting out how these factors are assessed. We help clients understand what mitigation is available. Genuine remediation, cooperation with the investigation, previous compliance record, and systemic changes to prevent recurrence all factor into penalty assessment. We help clients articulate what mitigation arguments are factually supported and what arguments are likely to cut through to Ofcom.

Finally, we advise on escalation to Ofcom’s senior leadership if the case warrants it. Not every investigation should be escalated, and escalation at the wrong stage can be counterproductive. But some investigations involve novel legal questions or substantial policy implications on which senior Ofcom leadership should make the ultimate decision. We advise on whether escalation is appropriate and on the framing of an escalation request.

When to instruct

You should instruct Bratby Law as soon as you receive an Ofcom information request, investigation notice, or provisional notification of a contravention. You should instruct if you are aware that Ofcom may be considering an investigation into your conduct. You should not wait until the investigation is well advanced. Early engagement with legal counsel allows you to structure your engagement with Ofcom in a way that protects your position. You should instruct if you receive a consumer or competitor complaint and are concerned it may escalate to Ofcom. You should instruct before responding to an Ofcom information request without legal advice. You should not instruct for routine regulatory reporting unless the reporting involves information that may be relevant to a suspected investigation.

How Bratby Law helps

We advise on the scope and implications of an Ofcom information request or investigation. We help you gather and organise the factual record. We draft responses to Ofcom information requests that are legally compliant and strategically sound. We claim legal privilege where appropriate and advise on how to handle confidential information. We advise on the section 96A provisional notification process and help you respond to provisional notifications. We identify what contraventions are actually alleged and help you focus your response on the material issues. We advise on penalty mitigation and help you articulate mitigation arguments that are factually supported. We advise on whether and when to escalate to Ofcom’s senior leadership. We represent you in interviews with Ofcom investigators and help prepare witnesses.

Frequently asked questions

What is an Ofcom information request and what is the consequence of not responding?

An Ofcom information request (or information notice) is issued under section 135 of the Communications Act 2003. It requires a person to provide specified information or documents within a specified period (usually 20 business days but sometimes longer). The information notice must be in writing and must specify the purpose for which the information is required. Failure to comply with an information notice without reasonable excuse is a criminal offence. This means that non-compliance is not a civil breach; it is a criminal matter. Non-compliance can result in prosecution and criminal penalties including fines and, in some cases, imprisonment.

Can a provider refuse to provide information on the grounds that it is confidential?

An information notice under section 135 does not have an exception for confidential information. If information is requested and is not legally privileged, Ofcom can require it to be provided. However, a provider can mark information as confidential and can ask Ofcom to treat it as commercially sensitive. Ofcom has obligations to keep commercially sensitive information in confidence and not to disclose it in published decisions. But Ofcom can use the information in its investigation and in its internal decision-making. Marking information as confidential does not prevent Ofcom from using it in enforcement proceedings.

What is the difference between an investigation and a section 135 information request?

Section 135 allows Ofcom to issue an information notice without necessarily launching a formal investigation. However, in practice, an information request is often a precursor to an investigation, or it is issued during an investigation. Ofcom does not always formally announce that it is investigating; the first notification may be the information request itself. Ofcom publishes information about investigations it has opened, but this is not mandatory.

What is a provisional notification of a contravention and what is the consequence?

A provisional notification of a contravention (issued under section 96A of the Communications Act 2003) is Ofcom’s preliminary finding that the provider has breached a regulatory obligation. The provisional notification must set out the facts and legal analysis that support Ofcom’s conclusion. The provider then has a right to make representations in writing and (in some cases) in an oral hearing. Ofcom must consider the provider’s representations before issuing a final enforcement decision. The provisional notification is not a final decision, but it is a strong signal that Ofcom intends to take enforcement action.

What is the maximum financial penalty Ofcom can impose?

The maximum financial penalty under section 97 of the Communications Act 2003 is 10 percent of relevant turnover (calculated on the preceding business year). For breaches of security requirements under the Telecommunications Security Act 2021, the cap is lower (3 percent of relevant turnover). Ofcom publishes penalty guidelines setting out how it assesses the level of penalty, taking into account factors such as the nature of the breach, its duration, market impact, and compliance history.

Can Ofcom negotiate the outcome of an investigation?

Ofcom does not formally negotiate investigation outcomes in the way a competition authority might. However, Ofcom is more likely to take a compliance-focused approach if the provider demonstrates genuine commitment to remediation and prevention of recurrence. In some cases, a provider that recognises a breach and commits to remediation may avoid enforcement action or face a lower penalty. But this depends on Ofcom’s own assessment of the seriousness of the breach and the likelihood of recurrence.

Representative experience

Recent and representative matters include:

• Defended a telecoms provider against an Ofcom investigation into alleged breaches of the General Conditions, managing the section 96A notification and representations process to achieve a favourable outcome.
• Advised on responses to Ofcom information requests under section 135, including the scope of the duty to provide information and the consequences of non-compliance.
• Supported a provider in an Ofcom dispute resolution proceeding concerning wholesale access terms, including preparation of evidence and submissions under sections 185 to 191.
• Advised on a provider’s complaint handling and ADR obligations under the General Conditions, including the establishment of a compliant internal complaints process and Ofcom reporting.
• Prepared a regulatory risk assessment for an operator facing potential enforcement action, advising on mitigation strategies, voluntary undertakings, and the penalty calculation methodology.

Related telecoms regulation pages

See also our other telecoms regulation pages:

• Interconnection regulation
• Ofcom General conditions of entitlement
• Numbering
• Spectrum
• Lawful intercept and the Investigatory Powers Act 2016
• Ofcom Licence Fees
• Code Powers and access to land
• Am I regulated?
• SMP regulation and market reviews
• Telecoms Security
• Ofcom
• Connected Vehicles and IoT Regulation

See more

• Why Bratby Law? UK Telecoms Lawyers and AI Lawyers for Regulated Markets
• Services
• Transactions
• Co-counsel
• Fractional General Counsel

Frequently asked questions

What triggers an Ofcom investigation?

Investigations may be triggered by complaints, intelligence, market monitoring or suspected breaches of the General Conditions or other regulatory obligations.

What powers does Ofcom have to gather information?

Ofcom can issue statutory information notices under sections 135 and 136 of the Communications Act requiring specified information, documents and explanations.

Can Ofcom impose financial penalties?

Yes. Ofcom may impose penalties of up to 10 per cent of relevant turnover for breaches of the Communications Act or General Conditions, and up to 10 per cent of global turnover for competition law infringements.

Can Ofcom’s decisions be appealed?

Decisions may be appealed to the Competition Appeal Tribunal, which considers both procedural and substantive issues, although many decisions may only be appealed on a judicial review basis.

What should providers do when they receive an information notice?

Providers should respond accurately and promptly, seek legal advice, preserve privilege and ensure internal consistency.

Independent directory rankings

Our specialist expertise is recognised in major independent legal directories:

• Chambers & Partners: Rob Bratby is ranked as a band 2 lawyer in the UK Guide 2026 in the “Telecommunications” category: Chambers
• The Legal 500: Rob Bratby is listed as a “Leading Partner – Telecoms” in London (TMT – IT & Telecoms): The Legal 500
• Lexology: Rob Bratby is featured on Lexology’s expert profiles as a Global Elite Thought Leader for data: Lexology