In this insight, we explore the UK’s proposed ransomware legislation and what it could mean for organisations. We look at three key proposals: a potential ban on ransom payments, a regime to prevent payments under certain conditions, and mandatory incident reporting. The article also considers how these changes could affect cyber response planning, legal risk, and business continuity.

The UK moved a step closer to introducing new ransomware payment law following the Home Office's consultation response published in July. The proposals are part of a wider approach to address cyber threats to the economy and national security, which include a pipeline of guidance from the National Cyber Security Centre (NCSC) and the Department for Science, Innovation and Technology (DSIT) (see our insight on the NCSC's Cyber Governance Code of Practice).

https://gowlingwlg.com/en-gb/insights-resources/articles/2025/cybersecurity-are-you-prepared-to-report-ransom-payments