The Rulebook
The regulatory hierarchy that controls every byte of energy data: 5 Acts, 7 industry codes, the RIIO framework, and a governance chain from Parliament to your meter.
- Trace the five-level regulatory hierarchy from Parliament through primary legislation, Ofgem regulation, industry codes, and company obligations
- Identify the five Acts that underpin GB energy data governance and explain the role of each
- Describe how the RIIO price control framework drives data obligations through licence conditions and digitalisation investment
- Distinguish between the seven major industry codes (BSC, REC, SEC, Grid Code, DCUSA, CUSC, UNC) and their respective domains
- Explain how BSC modifications work and why code governance can be both thorough and slow
- Assess data governance maturity across different organisation types from advanced DNOs to early-stage IDNOs
Energy data does not exist in a regulatory vacuum. Every piece of data — from your smart meter reading to a transmission operator's asset condition report — is created, managed, and shared because a specific law, licence condition, or industry code requires it.
1. Parliament
Primary legislation creates the legal foundation for energy licensing, system operation, privacy, and smart data.
2. Five energy acts
The Electricity Act, Gas Act, Energy Act, Data Protection Act, and DUA Act set the statutory powers that Ofgem and industry rely on.
3. Ofgem regulation
RIIO controls, directions, and licence conditions turn the Acts into enforceable energy-data obligations.
4. Industry codes
BSC, REC, SEC, Grid Code, DCUSA, CUSC, and UNC define the operational exchange rules used day to day.
5. Company obligations
Licensees publish data, submit plans and reports, and maintain the operational artefacts required by both regulation and code.
Privacy and cyber overlays
UK GDPR, the DPA, the DUA Act, NIS regulations, CAF, and the coming cyber bill sit alongside the main hierarchy and modify what companies can do with data.
Parliament — Primary Legislation
Primary legislation sets the legal framework. The Electricity Act 1989 and Gas Act 1986 established the regulated energy market. The Energy Act 2023 created NESO as an independent system operator. The Data (Use and Access) Act 2025 (Royal Assent 19 June 2025) creates the Smart Data framework enabling consumer-permissioned data access. The UK Data Protection Act 2018 implements UK GDPR.
The 5 Energy Acts
Five primary Acts create the licensing framework for energy. The Electricity Act 1989 and Gas Act 1986 established generation, transmission, distribution, and supply licences — each creating data obligations. The Energy Act 2023 established NESO and expanded digitalisation scope. The DUA Act 2025 introduces Smart Data for energy. The DPA 2018 governs all personal energy data.
Ofgem Regulation
Ofgem regulates through RIIO price controls (5-year cycles), Data Best Practice Guidance (v3.5, June 2025), licence conditions, and formal directions. RIIO-ED2 runs 2023-2028. RIIO-3 starts April 2026 with £876.7M digitalisation baseline. Licence Condition SpC 9.5 requires DSAP submissions.
7 Industry Codes
Seven major industry codes govern specific aspects: BSC (electricity settlement, Elexon), REC (retail market, RECCo), SEC (smart meters, SECAS), Grid Code (transmission, NESO), DCUSA (distribution connections, ElectraLink), CUSC (transmission use, NESO), UNC (gas, Joint Office). Code modifications take 12-18 months on average.
Company Obligations
Licensees must comply with licence conditions, submit DSAPs every 6 months, publish open data catalogues, maintain CIM models for LTDS, and meet RIIO regulatory reporting (RIGs) requirements. Non-compliance risks financial penalties from Ofgem.
Data Protection Track
UK GDPR (retained EU law) establishes data subject rights and lawful bases for processing personal energy data. The DPA 2018 implements UK GDPR domestically. The Data (Use and Access) Act 2025 introduces “recognised legitimate interests” as a new legal basis and creates the Smart Data framework — enabling regulated, consumer-permissioned data sharing schemes for energy.
Cybersecurity Track
The NIS Regulations 2018 designate energy operators as Operators of Essential Services (OES) with mandatory incident reporting. The NCSC Cyber Assessment Framework (CAF) v4.0 provides the audit standard. The forthcoming Cyber Security and Resilience Bill will extend scope to managed service providers and tighten enforcement powers.
The Regulatory Hierarchy
Level 1: Parliament — Primary Legislation
Acts of Parliament create the legal foundation. They establish licensing frameworks, define what a system operator is, and set the boundaries of data protection.
Level 2: Ofgem Regulation — Licence Conditions
Ofgem translates Acts into enforceable requirements through licence conditions, RIIO price controls, and formal directions.
Level 3: Industry Codes — The Detailed Rules
Seven major codes specify exactly how data must be formatted, exchanged, and processed. Each has its own administrator and modification process.
Level 4: Guidance Documents
DBP Guidance v3.5, DSAP Guidance, and Regulatory Instructions and Guidance (RIGs) provide the practical detail for compliance.
Level 5: Company Obligations
Data catalogues, open data portals, DSAPs published every 6 months, and annual RIGs submissions to Ofgem.
The Five Acts
| Act | Year | Key Data Provisions |
|---|---|---|
| Electricity Act 1989 | 1989 | Establishes licensing for generation, transmission, distribution, supply, and smart meter communications. Each licence creates data obligations. |
| Gas Act 1986 | 1986 | Licensing for gas transportation, shipping, and supply. GDNs, shippers, and suppliers all produce data under these licences. |
| Energy Act 2023 | 2023 | Created the legal basis for NESO as Independent System Operator. Established CCUS, Heat Networks, and Smart Secure Electricity Systems licensing. Expanded scope of DBP compliance. |
| Data (Use and Access) Act 2025 | Royal Assent 19 June 2025 | Introduces "recognised legitimate interests" legal basis under UK GDPR. Creates the Smart Data framework enabling regulated data sharing schemes for energy. |
| UK Data Protection Act 2018 | 2018 | Implements UK GDPR. All personal energy data (smart meter readings, customer accounts) is subject to its provisions. |
The RIIO Framework: The Engine of Data Obligations
RIIO (Revenue = Incentives + Innovation + Outputs) is Ofgem's price control framework. It determines how much money network companies can earn — and in return, what they must deliver, including data obligations.
The Digitalisation Licence Condition (SpC 9.5)
Under Special Licence Condition 9.5, every network licensee must:
- Produce and maintain a Digitalisation Strategy and Action Plan (updated every 6 months)
- Comply with Data Best Practice Guidance (v3.5, published 30 June 2025)
- Comply with DSAP Guidance
In January 2026, Ofgem expanded DBP as a code obligation to the DCC, with broader expansion planned via Code Managers under the Energy Act 2023.
| Price Control | Period | Key Data Implications |
|---|---|---|
| RIIO-ED2 (Distribution) | 2023–2028 | 14 DNO licence areas. Introduced SpC 9.5. All DNOs publish CIM models under LTDS. |
| RIIO-T2/GD2/GT2 | 2021–March 2026 | Transmission, Gas Distribution, Gas Transmission. Same digitalisation condition. Ending March 2026. |
| RIIO-3 (ET, GD, GT) | April 2026–March 2031 | £28.1 billion initial investment. New digitalisation licence condition. Re-opener mechanism for adjusting funding. |
The Seven Industry Codes
Below the licence conditions sit the industry codes — detailed, legally binding documents specifying how data must be formatted, exchanged, and processed.
| Code | Administrator | Governs | Key Data Provisions |
|---|---|---|---|
| BSC | Elexon | Electricity balancing and settlement | Settlement data flows; meter data requirements; MHHS implementation; P-modifications |
| REC | RECCo | Retail energy market processes | MPAN/MPRN registration; supplier switching (CSS); consumer consent |
| SEC | SECAS | Smart meter communications | DUIS service requests; meter data formats; PKI-E security; privacy controls |
| Grid Code | NESO | Transmission technical rules | Generator data; GC0139 CIM data exchange (effective 1 Jan 2026); balancing codes |
| DCUSA | ElectraLink | Distribution connections and use of system | Data Transfer Catalogue (DTC) defining D-flow formats; DUoS charging; loss factors |
| CUSC | NESO | Transmission connections and use of system | Connection application data; TNUoS charging; transmission access rights |
| UNC | Joint Office of Gas Transporters | Gas transportation and balancing | Shipper nominations (Gemini); gas quality/CV; linepack; unidentified gas |
The BSC: A Closer Look
The Balancing and Settlement Code is the most data-intensive of the seven codes. It governs how electricity is bought, sold, and settled across GB. Key sections with data implications:
Section 6Data Governance Maturity Across the Sector
| Organisation Type | Maturity Level | Evidence |
|---|---|---|
| Large DNOs (UKPN, NGED) | Advanced | 134 open datasets (UKPN); pioneered data triage (NGED); CIM publications complete |
| Smaller DNOs (ENWL) | Developing | Fewer open datasets; website-hosted rather than portal; same obligations but fewer resources |
| IDNOs | Early | Same regulatory obligations as DNOs but less open data published; recognised maturity gap |
| Code Bodies (Elexon, RECCo) | Advanced | Cloud-native platforms; APIs; public portals; DIP processed 1 billion+ messages |
| GDNs | Developing | Gas data governance through UNC is less advanced than electricity; batch processing via Xoserve |
Opinion: Ofgem's July 2025 Strategic Direction Statement signals further code consolidation — potentially merging some of the 7 codes. The MRA and SPAA were already consolidated into the REC in September 2021, proving it is possible but disruptive. The overlapping and sometimes inconsistent data obligations across 7 codes, each with different administrators and modification processes, remain one of the biggest governance inefficiencies in GB energy.
- Every piece of energy data exists because a specific law, licence condition, or industry code requires it: the regulatory hierarchy flows from Parliament through five Acts, Ofgem regulation, seven codes, and down to company obligations
- RIIO price controls are the engine of data obligations: digitalisation allowances, licence conditions like SpC 9.5, and Data Best Practice Guidance create the commercial incentive and regulatory requirement for data publication
- Seven industry codes (BSC, REC, SEC, Grid Code, DCUSA, CUSC, UNC) govern the operational exchange rules, each with a different administrator and modification process
- Data governance maturity varies significantly: large DNOs and code bodies like Elexon are advanced, whilst IDNOs and GDNs are still developing their open data capabilities
- Code consolidation is on the horizon: the MRA and SPAA were already merged into the REC in 2021, and Ofgem's 2025 Strategic Direction signals further convergence
Sources and references
Last reviewed: April 2026
- Elexon, Balancing and Settlement Code (BSC) — the principal industry code governing electricity settlement, imbalance pricing, metering, and credit cover arrangements
- NESO, Grid Code — technical and operational requirements for connection to and use of the GB transmission system, including data submission obligations
- ElectraLink, Distribution Connection and Use of System Agreement (DCUSA) — governs the relationship between DNOs, IDNOs, and suppliers for distribution-level connections
- SECAS, Smart Energy Code (SEC) — governs the DCC, smart meter communications, data access, and security obligations for the smart metering ecosystem
- RECCo, Retail Energy Code (REC) — consolidated retail market code (replacing MRA and SPAA from September 2021) covering switching, metering, and consumer consent
- Ofgem, RIIO-ED2 Final Determinations, 2022 — five-year price control framework (2023-2028) including digitalisation strategy requirements and data publication obligations
- Ofgem, Data Best Practice Guidance v3.5, June 2025 — expectations for how licensees manage, publish, and share energy data under licence conditions
- Ofgem, Strategic Direction Statement, July 2025 — signals code consolidation direction and future governance reform for the energy data landscape