Introduction
Search "ISP licence UK" and you'll find a maze of conflicting advice. Here's the reality: there is no single "ISP licence" that Ofcom hands out.
Instead, providing internet access in the UK means working through a patchwork of authorisations, notifications and ongoing obligations that shift depending on what you're building.
This matters because getting it wrong isn't just a paperwork problem. Misjudging your regulatory position can delay launch, expose you to enforcement action, or leave customers without proper protections.
This guide is for entrepreneurs, WISPs, community broadband operators, and foreign investors planning UK internet services.
We'll cover what actually applies to your business model, how to work through Ofcom's requirements, spectrum permissions, planning consent, and the consumer, privacy and security rules that follow once you're operating.
Key Takeaways
- No universal ISP licence exists — obligations depend on your service, technology and customer base
- You may need Ofcom engagement, spectrum permissions, planning consent, or wayleave rights, sometimes all four
- Resale-only ISPs face a lighter compliance load than network owners, WISPs or voice providers
- Always confirm current requirements directly with Ofcom, the ICO and GOV.UK before you launch
What Is an ISP Licence in the UK?
An ISP is any business supplying internet access or related electronic communications services, whether through owned infrastructure or by reselling wholesale capacity. Simple enough. What trips people up is assuming this activity requires formal licensing in the way, say, a taxi operator or an alcohol retailer needs one.
It doesn't. Ofcom has confirmed it does not operate a general telecoms licensing regime and keeps no register of every UK ISP. Ofcom's own response to a Freedom of Information request makes this explicit.
Providers instead operate under Ofcom's General Conditions of Entitlement, a framework of standing rules that apply automatically once you're offering the relevant services.
There's one exception worth flagging. Section 33 of the Communications Act 2003 requires advance notification before providing a network, service or facility that Ofcom has specifically designated for that purpose, along with notice of significant changes to an already-notified activity.
The current text of section 33 does not create a blanket notification duty for every new ISP. Whether it applies to you depends on the specific designation in force at the time.
The Permissions That Actually Matter
Rather than one licence, expect to work through several separate regulatory tracks:
- Ofcom General Conditions — apply to anyone providing public electronic communications networks or services
- Wireless spectrum permissions — a licence or a qualifying exemption, relevant for WISPs and fixed wireless links
- Planning consent, street works and wayleaves — needed for physical infrastructure, poles, cabinets or ducting
- Additional authorisations — for public voice services, number allocation, or premium-rate offerings
Comparing Operating Models
| Model | Typical obligations |
|---|---|
| Facilities-based ISP (owns network) | Full General Conditions, possible spectrum and infrastructure permissions |
| Wholesale reseller | Lighter infrastructure duties, still bound by consumer and data rules |
| Community network | Depends on scale and whether services are offered publicly |
| WISP | Spectrum compliance plus General Conditions |
Before committing to a model, check whether your specific setup triggers a section 33 notification or simply falls under the standing General Conditions. This distinction genuinely changes your pre-launch workload.
How to Apply and Set Up an ISP in the UK
There's no single "application form" here. Setting up is really a sequence of decisions and confirmations, each affecting the next.
Step 1: Define Your Service Model
Nail down the specifics before anything else:
- Residential, business, or community customers
- Fixed or mobile, wired or wireless delivery
- Wholesale/resale versus owned infrastructure
- Public voice service bundled with internet access
- Geographic coverage and expected scale
Step 2: Establish the Business Foundations
Standard commercial groundwork applies: company formation, VAT assessment, funding and insurance. But don't skip the telecoms-specific pieces, including supplier contracts, acceptable-use terms, customer contracts, and a realistic budget that accounts for both network build and ongoing regulatory administration.
Specialist firms such as VJM Global handle company formation, VAT registration, and financial planning across multiple markets, which can simplify this groundwork stage while you focus on network design.
Step 3: Confirm Your Ofcom Position
Check whether your proposed activity is subject to a section 33 notification requirement, and identify which General Conditions apply to your service type.
Ofcom's 2026/27 tariff applies Networks and Services administrative charges to providers with £5 million or more in relevant turnover from the specified prior year. This is separate from any spectrum-licence fee, so confirm the current tariff before budgeting.
Step 4: Secure Network, Land and Spectrum Permissions
This step covers a lot of ground:
- Backhaul and transit — arrange wholesale connectivity or IP transit agreements
- Site access — negotiate leases, landlord consent, and wayleaves
- Planning and street works — check England's wireless-network code of practice or the equivalent for your nation, plus any section 50 street works licence needs
- Spectrum clearance — confirm whether your equipment operates under a licence-exempt band or needs an Ofcom radio licence
Spectrum permissions vary enormously by band, power and location. Fixed wireless access operators using the 5.8 GHz band, for instance, can now operate licence-exempt if they meet the technical conditions, including a 4W maximum mean e.i.r.p. limit and dynamic frequency selection, per Ofcom's 2026 guidance on licence-exempt operation.
Other equipment classes, including 60 GHz fixed links, carry different limits entirely. Never assume one exemption applies across the board.
Step 5: Build Compliance Documentation Before Onboarding Customers
Have these ready before you take a single customer:
- Terms and conditions, pricing and contract summaries
- Complaints handling and outage/service-level procedures
- Privacy notices and data retention policy
- Acceptable-use policy and security controls
- An escalation process for unresolved issues
Step 6: Test and Launch in Stages
Run coverage and capacity testing, resilience checks, and customer-premises equipment validation before going commercial. Test billing systems, support workflows, and incident response separately — then do a final documented review against every regulatory condition identified in steps 3 and 4.
Requirements and Ongoing Compliance
Launch is only the start. Ongoing obligations fall into distinct categories, and treating them as one blended "compliance task" is where most operators go wrong.
Consumer and Regulatory Rules
Ofcom's General Conditions set clear pre-contract and service rules. Providers must:
- Give transparent contract information, a free contract summary, and clear pricing before a customer is bound
- Support switching, including the One Touch Switch process for fixed services
- Maintain a compliant complaints procedure with access to an approved ADR scheme
One change worth noting: the deadline for referring an unresolved complaint to ADR dropped from eight weeks to six weeks, effective 8 April 2026. If your complaints workflow still assumes eight weeks, it's out of date.
Data Protection and Privacy
UK GDPR and the Data Protection Act 2018 govern how you handle customer data generally. ISPs also face a narrower PECR duty on traffic data.
Under PECR, traffic data can only be processed for defined purposes such as billing, fraud prevention, or traffic management. It must be erased or anonymised once no longer needed (subject to defined exceptions). Marketing use needs separate consent.
Breach reporting for ISPs runs through PECR rather than standard UK GDPR channels. Notify the ICO within 72 hours of becoming aware of a qualifying breach, and maintain a breach log regardless of whether individuals were notified.
Network Security and Resilience
Public telecoms providers operate under the Telecommunications (Security) Act 2021 and its associated Code of Practice. The obligations scale with size:
- Tier 1 (£1 billion+ turnover): full detailed measures
- Tier 2 (£50 million to £1 billion): substantial measures
- Tier 3 (under £50 million): proportionate, appropriate steps rather than the full code
Even smaller providers aren't exempt from security duties altogether, only from the most detailed prescriptive measures.
Technical, Physical and Governance Essentials
Keep a working checklist covering:
- IP addressing, routing, DNS and IPv6 planning
- Capacity management and outage communications
- Radio equipment conformity (CE or UKCA marking, depending on market)
- Records of contracts, approvals, incidents, complaints and supplier due diligence
If your service touches public voice, numbering, critical infrastructure, or cross-border data flows, get specialist advice rather than relying on generic checklists.
Where the Requirements Change and Common Mistakes
Not every ISP model carries the same weight of obligation, and assuming otherwise leads to either over-engineering compliance or under-preparing for it.
How obligations shift by model:
- Reselling wholesale broadband typically means lighter infrastructure duties, but customer-facing consumer and data rules still apply in full
- Community networks may face fewer obligations at small scale, though this depends heavily on whether services are offered publicly
- WISPs carry the added layer of spectrum compliance on top of standard General Conditions
- Fibre owners face the fullest set of infrastructure, planning and wayleave requirements
- Business-grade connectivity providers often deal with more complex service-level and contract obligations
Misconceptions Worth Correcting
A few beliefs cause real problems:
- Company incorporation alone does not authorise telecoms activity
- An Ofcom contact or notification is not automatically a formal licence
- Licence-exempt spectrum still carries operating conditions: power limits, interference rules, equipment standards
- Using a wholesale provider does not remove your customer-facing compliance duties
Full ISP-style setup may not apply in every case. Connectivity limited to a private internal network, or a pure managed service role with no direct sale of communications services, can fall outside the regime. Confirm this against current official guidance rather than assuming.
Common launch risks:
- Insufficient backhaul capacity discovered post-launch
- Coverage claims that don't match real-world testing
- Missing wayleaves or unresolved landlord consent
- Spectrum unsuited to the actual site conditions
- No documented complaints procedure
- Undefined data retention practices
- Underbudgeted ongoing regulatory administration
Conclusion
Getting an "ISP licence" in the UK means identifying the correct regulatory category for your model, then assembling the Ofcom, spectrum, infrastructure, consumer, privacy and security pieces that apply. There's no shortcut checklist that works for every operator.
The right route depends on your network model, technology, services and customer base. Generic licence guides and outdated third-party claims won't cut it — validate your project directly with Ofcom, the ICO, GOV.UK and a qualified UK telecoms adviser before you commit resources.
Once the UK operation is established, some ISPs look at further markets. If India is on that roadmap, VJM Global supports UK businesses with India-focused entity setup, accounting and compliance, including FDI policy guidance, entity selection and tax structuring for cross-border operations. That work sits outside UK telecoms regulation, but it is useful groundwork for the next stage.
Frequently Asked Questions
Do I need an ISP licence in the UK?
No single universal licence exists. You'll need to meet Ofcom's General Conditions and may require additional spectrum, planning, infrastructure or service-specific permissions depending on your model.
How do I apply for an ISP licence in the UK?
Start by defining your operating model, then confirm the current Ofcom position and any other permissions that apply. There's no generic form — the requirements follow from what you're actually building.
What regulator oversees ISPs in the UK?
Ofcom is the main communications regulator. The ICO, local planning authorities, and other bodies also have relevant oversight depending on your services and infrastructure.
Do WISPs need a licence for wireless broadband?
It depends on the spectrum band and equipment. Some bands, like 5.8 GHz for fixed wireless access, are licence-exempt under specific technical conditions; others require an Ofcom radio licence.
What documents are needed to start an ISP in the UK?
Expect to need company and ownership details, network plans, supplier and site agreements, customer terms, complaints procedures, privacy documentation, and evidence of any applicable permissions.
What are the ongoing compliance obligations for a UK ISP?
Ongoing duties cover consumer communications, complaints handling, data protection, cyber-security, network maintenance, incident management, and record-keeping, plus any continuing Ofcom or spectrum-related requirements specific to your service.
