UK Telecom Compliance: Regulatory Guides & Frameworks

1. UK Telecom Regulatory Overview

The UK telecommunications sector operates under multiple overlapping regulatory frameworks. As a telecom reseller or channel partner, you're not exempt from these requirements simply because you're not a network operator.

Key Regulatory Bodies

Ofcom (Office of Communications) is the primary regulator for UK telecommunications. They enforce the General Conditions of Entitlement, investigate complaints, and issue enforcement actions including fines.

ICO (Information Commissioner's Office) enforces data protection under UK GDPR and marketing rules under PECR. They handle complaints about nuisance calls and unsolicited marketing.

Your Upstream Provider operates under a contractual compliance framework. Most wholesale agreements require resellers to maintain Ofcom compliance as a condition of service.

Who Must Comply?

You fall under Ofcom regulation if you provide Electronic Communications Services (ECS) or Electronic Communications Networks (ECN) in the UK. This includes:

• VoIP providers and SIP trunk sellers
• Mobile virtual network operators (MVNOs)
• Broadband resellers and ISPs
• Business telephony system providers
• Unified communications platform sellers
• Hosted PBX and cloud phone system providers

2. Ofcom General Conditions

The General Conditions of Entitlement are mandatory requirements for all UK communication providers. There are 27 conditions grouped into categories, but not all apply to every provider type.

Conditions That Apply to All Providers

Condition	Requirement	Key Obligations
GC A1	Network functioning & interconnection	Reasonable network access requests
GC A2	Number portability	Port numbers within 1 working day
GC B1	Publication of information	Transparent pricing, terms, quality
GC B2	Contracts	Written contracts, 30-day termination notice
GC C1	Fraud & misuse	Prevent network abuse, block fraudulent traffic
GC C5	Emergency calls	Free 999/112 access where applicable

For the complete breakdown of all 27 General Conditions and which apply to your business type, see our Ofcom General Conditions Guide.

3. PECR (Marketing Compliance)

The Privacy and Electronic Communications Regulations 2003 (PECR) govern electronic marketing in the UK. Telecom resellers must comply as both a service provider and as a business conducting marketing.

PECR Requirements for Telecom Businesses

• Obtain consent before marketing calls to consumers (TPS checking required)
• Display CLI (Caller Line Identification) on outbound calls
• Honour opt-out requests within 28 days
• Maintain suppression lists for 6 years minimum
• Ensure customers using your services also comply with PECR

For detailed PECR compliance steps including data retention requirements and consent management, see our PECR Telecom Compliance Guide.

4. UK GDPR for Telecoms

The UK General Data Protection Regulation applies to all personal data processing. Telecom providers handle substantial personal data: customer details, call records, location data, and billing information.

Key GDPR Obligations

Obligation	What It Means	Telecom-Specific Example
Lawful Basis	Document why you process data	Contract performance for call records
Data Minimisation	Only collect what's needed	Don't retain full call recordings indefinitely
Storage Limitation	Delete when no longer needed	CDR retention policies (typically 12-24 months)
Security	Appropriate technical measures	Encrypted SIP, secure customer portals
Data Subject Rights	Respond to access requests	Provide call history within 30 days

Article 22: Automated Decision-Making

If you use AI systems to make decisions affecting customers (fraud detection, credit scoring, service restrictions), UK GDPR Article 22 requires human oversight for significant decisions. This is where "Human-in-the-Loop" triggers become essential.

For telecommunications-specific GDPR guidance including data processor agreements and international transfers, see our UK GDPR for Telecom Providers Guide.

5. AIT Fraud Prevention

Artificial Inflation of Traffic (AIT) is the deliberate generation of fraudulent traffic, typically to premium rate numbers. Under GC C1, you must actively prevent AIT on your network.

Common AIT Attack Vectors

• International Revenue Share Fraud (IRSF) - calls to high-cost destinations
• Wangiri fraud - missed call callbacks to premium numbers
• PBX hacking - compromised customer systems making fraudulent calls
• SIM box fraud - illegal call termination bypassing interconnect
• CLI spoofing - falsified caller ID for scam calls

Required Controls

Ofcom expects communication providers to implement reasonable measures:

• Real-time traffic monitoring and anomaly detection
• Destination blacklists for known fraud hotspots
• Credit limits and velocity checks
• Customer verification before enabling premium rate access
• Incident response procedures for detected fraud

For implementation details and Ofcom-compliant AIT detection procedures, see our GC C1 Fraud Prevention Guide.

6. Audit Requirements

Telecom resellers face audits from multiple sources: Ofcom spot checks, upstream provider compliance reviews, and customer due diligence requests.

What Auditors Look For

Area	Evidence Required	Common Failures
Customer Contracts	Signed agreements, T&Cs	Missing or outdated contracts
Acceptable Use Policy	Published AUP, acknowledgments	No customer sign-off
Fraud Controls	Monitoring logs, incident reports	Reactive only, no proactive detection
Data Protection	DPA, privacy notices, DPIA	Generic policies not telecom-specific
Complaint Handling	Procedures, response times, ADR	No escalation path or ADR membership

7. Penalties & Enforcement

Non-compliance carries significant financial and operational risks:

Ofcom Penalties

• Fines up to 10% of relevant annual turnover
• Enforcement notifications requiring remedial action
• Suspension or revocation of numbering allocations
• Publication of enforcement decisions (reputational damage)

ICO Penalties (PECR/GDPR)

• Up to £17.5 million or 4% of global turnover (GDPR)
• Up to £500,000 for serious PECR violations
• Criminal prosecution for deliberate breaches
• Director disqualification in severe cases

Upstream Provider Actions

• Immediate service suspension for fraud incidents
• Contract termination after repeated compliance failures
• Liability for fraud losses passed to reseller
• Industry blacklisting affecting future wholesale agreements

Compliance Resource Library

Explore detailed guides organized by regulatory area:

Consumer Protection & Ofcom

Data & Security Acts

Fraud & Risk Management

Industry Reference