UK OSA Sections 23 and 34 - Record-keeping and review duties (user-to-user: s 23
Make and keep written records of all risk assessments and compliance steps, review compliance regularly, and be able to provide records to Ofcom on request
Where this comes from
Provision: Sections 23 and 34 - Record-keeping and review duties (user-to-user: s 23; search: s 34)
Instrument: UK Online Safety Act 2023
Citation: Online Safety Act 2023, c. 50, s 23 (regulated user-to-user services) and s 34 (regulated search services); s 23(10) / s 34(9) (duty to supply OFCOM with a copy); s 23(7) / s 34(7) (OFCOM exemption power)
Text version: Online Safety Act 2023 c. 50, revised text as displayed on legislation.gov.uk on 2026-09-21 ('up to date with all changes known to be in force on or before 21 September 2026'), including the amendments made by the Crime and Policing Act 2026 in force from 29 June 2026 (S.I. 2026/689) and s 66 in force from 7 April 2026 (S.I. 2026/262). The as-enacted text is superseded.
Who it applies to
It applies when all of these are true:
- Service allows user-generated content
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Each recordable event is written at the time it occurs, on the request path, not batched later
- A record identifies what happened, when (ISO 8601), which system/version produced it, and who or what acted
- Records are append-only and tamper-evident (chained or write-once); an edit or deletion is detectable
- A retention floor and ceiling are set per record type and enforced by a scheduled job
- Records carry hashes or references instead of copies of the underlying personal data
Questions people ask
- Does UK OSA Sections 23 and 34 - Record-keeping and review duties (user-to-user: s 23 apply to my service?
- It applies when Service allows user-generated content.
- From when does this apply?
- UK OSA Sections 23 and 34 - Record-keeping and review duties (user-to-user: s 23 applies from 10 January 2024. Its current status is: in force.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.