Trigger situation

A provider receives notice of an Ofcom investigation. A provider receives an information request under section 135 of the Communications Act 2003. A provider is subject to a complaint from a consumer or competitor that has been escalated to Ofcom. A provider receives a provisional notification of a contravention under section 96A. A provider faces the prospect of Ofcom enforcement action including financial penalties.

Most enforcement cases arise from alleged breaches of the General Conditions of Entitlement. Understanding the underlying obligations is essential to mounting an effective defence.

Why it matters now

Ofcom’s enforcement powers have expanded materially since 2003 and have become notably more active. The Telecommunications (Security) Act 2021 added security enforcement powers covering a new category of conduct (breaches of the Electronic Communications (Security Measures) Regulations 2022 (SI 2022/933)). The Online Safety Act 2023 extended Ofcom’s remit to user-to-user services and search services. Video-sharing platforms had already come under Ofcom’s remit on 1 November 2020, under Part 4B of the Communications Act 2003 inserted by the Audiovisual Media Services Regulations 2020 (SI 2020/1062). Ofcom sets its enforcement priorities in its annual plan and reports open cases in its enforcement bulletin, and both change from year to year. A provider cannot plan on a fixed investigation timetable.

Common Ofcom investigation failures

An Ofcom information request is not routine correspondence. Under section 135 of the Communications Act 2003, Ofcom can issue an information notice requiring a person to provide specified information or documents within a specified period. Ofcom enforces non-compliance by a notification under section 138, a confirmation decision under section 139A and a penalty under section 139 of up to £2,000,000. Failure to provide the information is also an offence under section 144(1), punishable by a fine, but section 144(5) allows a prosecution only where that route has been followed and no section 139 penalty has been imposed. Information given in response to a section 135 notice can be used in evidence in later enforcement proceedings. Once information has been provided to Ofcom, it is difficult to walk back or qualify.

Investigation timelines and resourcing requirements need realistic planning from the outset. The investigation may include several rounds of information requests, interviews with key personnel, and detailed analysis of technical or commercial data. A provider must plan management time and legal budget across the whole life of an investigation, and must record the factual narrative while the people who hold it are still in the business.

Constructive engagement with Ofcom throughout the investigation affects the outcome. Some providers take an adversarial approach, resisting information requests or limiting engagement with investigators. This approach is counterproductive. Ofcom’s enforcement decision will rest on whatever evidence Ofcom can gather, whether or not the provider cooperates. A provider that cooperates with the investigation, that explains its conduct in good faith, and that demonstrates a commitment to compliance, is more likely to receive a compliance-focused outcome than a punitive one. Ofcom publishes its enforcement decisions, and records in them the extent of the provider’s cooperation. Cooperation affects both the likelihood of enforcement and the level of penalty if enforcement is decided.

The procedural safeguards available under the Communications Act 2003 form part of the investigation process. Before Ofcom can impose a financial penalty, Ofcom must issue a provisional notification of a contravention under section 96A. This notification must set out the facts and legal analysis on which Ofcom relies, and must invite the provider to make representations. The provider then has a right to respond in writing and (sometimes) to make oral representations to Ofcom. The final enforcement decision must take the provider’s representations into account. Substantive engagement with the provisional notification, rather than treating it as a formality, preserves the opportunity to influence Ofcom’s final decision.

What constitutes a “contravention” for Ofcom enforcement purposes is a defined and limited category. Ofcom can only enforce “contraventions” of the Communications Act 2003, the General Conditions, the SMP conditions, or certain other specified enactments. Not every breach of a regulatory obligation is enforceable by Ofcom. Some breaches are enforced by other regulators or by private law remedies. A response is calibrated to the contraventions actually alleged.

Handling an Ofcom investigation in practice

A provider under investigation has to engage with Ofcom while protecting its own legal position and the confidentiality of privileged advice.

The first question is the scope of the request: what Ofcom is investigating, and what it is seeking to establish. The information notice is then measured against the statutory test, which is whether the request is proportionate and whether it is properly specified. A provider decides which of the information requested is legally privileged and how to claim privilege over it, and which is confidential or commercially sensitive and so has to be marked for Ofcom to handle it in confidence.

The provider’s own conduct and factual record come next. A review of its documents and communications establishes what happened, when it happened, and what it understood the applicable rules to require at the time. Ofcom will gather the same material, and an account that is inconsistent with the documents will be read against the provider.

A response has to be both compliant and calibrated to what Ofcom has asked. Section 135 requires the information Ofcom specifies and no more. A short response that answers the question is better than a long narrative that elaborates on peripheral issues and volunteers material outside the scope of the notice.

Internal escalation needs a structure. An investigation usually forces business decisions on remediation or process change that turn on the legal position, and the board or senior management needs enough information to take them.

A section 96A provisional notification is a formal document setting out Ofcom’s provisional findings, and it repays close reading: which factual assertions Ofcom has made, which legal conclusions it has drawn, and where its evidence or reasoning is thin. The response may address the gaps in Ofcom’s analysis, put in evidence that its factual assertions are wrong, or concede the contravention and concentrate on remediation and penalty.

The level of a penalty depends on the nature and gravity of the breach, its duration, the market impact and the compliance history, assessed under Ofcom’s published penalty guidelines. Genuine remediation, cooperation with the investigation, a previous compliance record and systemic changes to prevent recurrence are the mitigation available, and each has to be factually supported.

Escalation to Ofcom’s senior leadership is worth considering only where the case turns on a novel legal question or carries substantial policy implications. Escalation at the wrong stage is counterproductive, and the framing of the request matters as much as the decision to make it.

When to instruct

You should instruct Bratby Law as soon as you receive an Ofcom information request, investigation notice, or provisional notification of a contravention. You should instruct if you are aware that Ofcom may be considering an investigation into your conduct. You should not wait until the investigation is well advanced. Early legal advice allows you to structure your engagement with Ofcom in a way that protects your position. You should instruct if you receive a consumer or competitor complaint and are concerned it may escalate to Ofcom. You should instruct before responding to an Ofcom information request without legal advice. You should not instruct for routine regulatory reporting unless the reporting involves information that may be relevant to a suspected investigation.

How Bratby Law helps

The work runs from the scope of the information request, through the factual record and the drafted response, to privilege and confidentiality, the section 96A representations and, where a penalty follows, mitigation. It includes representation in interviews with Ofcom investigators and the preparation of witnesses.

Frequently asked questions

What is an Ofcom information request and what is the consequence of not responding?

An Ofcom information request (or information notice) is issued under section 135 of the Communications Act 2003. It requires a person to provide specified information or documents within such reasonable period as Ofcom specifies under section 135(4). The information notice must be in writing and must specify the purpose for which the information is required. Ofcom’s first route is civil: a notification under section 138, a confirmation decision under section 139A and a penalty under section 139(5) of up to £2,000,000, with a further £500 per day under section 139(4B) for a continuing contravention. Failure to provide the information is also an offence under section 144(1), but section 144(5) allows a prosecution only where Ofcom has given a section 138 notification, the period allowed by a section 139A confirmation decision has expired without compliance, and no penalty has been imposed under section 139. Section 144(2) gives a defence where compliance within the period was not reasonably practicable and all reasonable steps were taken afterwards. The section 144(1) offence carries a fine only. Imprisonment, of up to two years on conviction on indictment, is available only for the separate offence in section 144(3) of providing information that is false in a material particular, knowing it to be false or being reckless as to whether it is false.

Can a provider refuse to provide information on the grounds that it is confidential?

An information notice under section 135 does not have an exception for confidential information. If information is requested and is not legally privileged, Ofcom can require it to be provided. However, a provider can mark information as confidential and can ask Ofcom to treat it as commercially sensitive. Ofcom has obligations to keep commercially sensitive information in confidence and not to disclose it in published decisions. But Ofcom can use the information in its investigation and in its internal decision-making. Marking information as confidential does not prevent Ofcom from using it in enforcement proceedings.

What is the difference between an investigation and a section 135 information request?

Section 135 allows Ofcom to issue an information notice without necessarily launching a formal investigation. However, in practice, an information request is often a precursor to an investigation, or it is issued during an investigation. Ofcom does not always formally announce that it is investigating; the first notification may be the information request itself. Ofcom publishes information about investigations it has opened, but this is not mandatory.

What is a provisional notification of a contravention and what is the consequence?

A provisional notification of a contravention (issued under section 96A of the Communications Act 2003) is Ofcom’s preliminary finding that the provider has breached a regulatory obligation. The provisional notification must set out the facts and legal analysis that support Ofcom’s conclusion. The provider then has a right to make representations in writing and (in some cases) in an oral hearing. Ofcom must consider the provider’s representations before issuing a final enforcement decision. The provisional notification is not a final decision, but it is a strong signal that Ofcom intends to take enforcement action.

What is the maximum financial penalty Ofcom can impose?

Ofcom imposes a penalty for contravention of a condition under sections 96A to 96C of the Communications Act 2003, and section 97 fixes the amount at up to ten per cent of the turnover of the person’s relevant business for the relevant period, which section 97(5) defines as the year ending with the 31 March before notification of the contravention was given. For contravention of a security duty, section 105S applies the same machinery and the same ten per cent cap, but section 105T substitutes a maximum of £10 million for contravention of the duty in section 105I and caps daily penalties at £100,000, or £50,000 for a section 105I duty. A penalty for contravention of an information requirement is capped separately at £2,000,000 by section 139(5). Ofcom publishes penalty guidelines setting out how it assesses the level of penalty, taking into account factors such as the nature of the breach, its duration, market impact, and compliance history.

Can Ofcom negotiate the outcome of an investigation?

Ofcom does not formally negotiate investigation outcomes in the way a competition authority might. However, Ofcom is more likely to take a compliance-focused approach if the provider demonstrates genuine commitment to remediation and prevention of recurrence. In some cases, a provider that recognises a breach and commits to remediation may avoid enforcement action or face a lower penalty. But this depends on Ofcom’s own assessment of the seriousness of the breach and the likelihood of recurrence.

Representative experience

Recent and representative matters include:

• Defended a telecoms provider against an Ofcom investigation into alleged breaches of the General Conditions, managing the section 96A notification and representations process to achieve a favourable outcome.
• Advised on responses to Ofcom information requests under section 135, including the scope of the duty to provide information and the consequences of non-compliance.
• Supported a provider in an Ofcom dispute resolution proceeding concerning wholesale access terms, including preparation of evidence and submissions under sections 185 to 191.
• Advised on a provider’s complaint handling and ADR obligations under the General Conditions, including the establishment of a compliant internal complaints process and Ofcom reporting.
• Prepared a regulatory risk assessment for an operator facing potential enforcement action, advising on mitigation strategies, voluntary undertakings, and the penalty calculation methodology.

Related telecoms regulation pages

See also our other telecoms regulation pages:

Am I regulated?
Ofcom General conditions of entitlement
SMP regulation and market reviews
Numbering
Code Powers and access to land
Spectrum
Lawful intercept and the Investigatory Powers Act 2016
Telecoms Security
Ofcom Licence Fees
Ofcom: Advice for Operators, Investors and Platforms
Interconnection regulation
Connected Vehicles and IoT Regulation
EU Digital Networks Act

See more

• Why Bratby Law? Specialist telecoms, data protection, payments, transactions and digital regulation lawyers
• Services
• Transactions
• Co-counsel
• Fractional General Counsel

Frequently asked questions

What triggers an Ofcom investigation?

Investigations may be triggered by complaints, intelligence, market monitoring or suspected breaches of the General Conditions or other regulatory obligations.

What powers does Ofcom have to gather information?

Ofcom can require information under section 135 of the Communications Act 2003, including for the purpose of ascertaining whether a condition or other requirement has been contravened. Section 136 is narrower: it covers only comparative overviews under section 134D and statistical purposes. Both powers are subject to the limitations in section 137.

Can Ofcom impose financial penalties?

Yes. Ofcom may impose penalties of up to 10 per cent of relevant turnover for breaches of the Communications Act or General Conditions, and, in exercise of its concurrent competition powers, up to ten per cent of the turnover of the undertaking under section 36(8) of the Competition Act 1998, determined in accordance with the order made by the Secretary of State under that subsection.

Can Ofcom’s decisions be appealed?

A person affected by a decision within section 192 of the Communications Act 2003 may appeal to the Competition Appeal Tribunal. Since 31 July 2017 section 194A(2) has required the Tribunal to decide the appeal by applying the same principles as a court on an application for judicial review, and section 194A(2A) requires it to do so without taking any special account of the merits where the appeal is against a relevant security decision. A penalty imposed under the Competition Act 1998 in exercise of Ofcom’s concurrent competition powers is a different route, appealable to the Tribunal on the merits under section 46 of that Act. Where an appeal proceeds, the litigation team can be supported by specialist regulatory input as disputes co-counsel.

What should providers do when they receive an information notice?

Providers should respond accurately and promptly, seek legal advice, preserve privilege and ensure internal consistency.

Independent directory rankings

Our specialist expertise is recognised in major independent legal directories:

• Chambers & Partners: Rob Bratby is ranked as a Band 2 lawyer in the UK Guide 2026 in the “Telecommunications” category: Chambers
• The Legal 500: Rob Bratby is listed as a Leading Partner for Telecoms in London (TMT: IT and Telecoms). The Legal 500
• Lexology: Rob Bratby is recognised in the Lexology Index as a Global Elite Thought Leader for telecoms and media, and as a Thought Leader for data privacy and protection: Lexology