Ofcom updates Online Safety information-powers guidance, adding new data-preservation rules for cases involving deceased children

The Office of Communications (Ofcom) has published updated Online Safety Information Powers Guidance, outlining how it will exercise its information-gathering authorities under the Online Safety Act 2023. The revision reflects new responsibilities introduced through the Data Preservation Notices under the Data (Use and Access) Act, granting Ofcom the power to require regulated services to preserve a deceased child’s information so that no relevant data is altered or deleted during an inquiry.

The guidance applies broadly to providers of regulated services, ancillary services, access facilities, and any other entities capable of supplying information relevant to Ofcom’s investigations or compliance assessments. It clarifies when and how Ofcom may issue information notices, request skilled-person reports, conduct interviews, and carry out entry, inspection, and audit activities.

Ofcom also sets detailed expectations for handling confidential information and personal data, establishing rules on disclosure, record retention, and information security. The regulator states that it will use these powers proportionately, seeking robust evidence while avoiding unnecessary burdens on service providers.

The document reiterates that failure to comply with Ofcom’s information-gathering requirements may lead to enforcement action or, in some cases, criminal liability. The addition of data-preservation powers marks a notable extension of Ofcom’s role in safeguarding evidence, particularly in sensitive cases involving harm to children online, while embedding the Online Safety Act’s wider framework of transparency and accountability.