TRW & Co · Energy, Infrastructure & Transport
Data Centre and Digital Infrastructure Lawyers in London
Data centre lawyers London developers, operators and investors instruct handle the land, power, planning, construction, customer contracts and regulation behind digital infrastructure. With data centres now Critical National Infrastructure, able to opt into the national planning regime and heading for cyber resilience regulation, grid access and legal structure decide project value.
Key pointA data centre's value now depends on a credible grid connection date more than on land or planning, so make site acquisition conditional on power and align every customer and construction contract with the connection timetable.
At a glance
Critical National Infrastructure
The government designated UK data centres as Critical National Infrastructure on 12 September 2024, the first new designation since space and defence in 2015.
NSIP opt-in since 2026
Regulations made in January 2026 let data centre projects request a section 35 direction into the development consent order regime; no automatic size threshold applies.
Cyber resilience regulation
The Cyber Security and Resilience Bill, introduced in November 2025, would make data centres above rated IT load thresholds an essential service.
Grid access is critical
Connection reform prioritises ready projects, and in 2026 Ofgem consulted on a commitment fee for large demand connections such as data centres.
Investment screening applies
Data infrastructure is a sensitive area under the National Security and Investment Act 2021, so acquisitions of operators may need clearance before completion.
Swipe or scroll →
What data centre lawyers London clients need: the scope of data centre and digital infrastructure law
Data centre lawyers London developers, operators, investors, lenders and customers instruct handle the legal work behind the buildings, power and contracts that host the digital economy: site acquisition, planning, grid connections, construction, financing, colocation and hyperscale leases, cloud and service contracts, cyber resilience regulation and acquisitions of platforms.
Demand from cloud and artificial intelligence workloads has turned data centres into a strategic infrastructure class. The UK government designated data centres as Critical National Infrastructure in September 2024, created a route for the largest schemes into the national infrastructure planning regime in January 2026, and is legislating to regulate their cyber resilience. Power, rather than land, is now the binding constraint.
TRW & Co advises developers and operators, infrastructure and real estate investors, lenders, enterprise and public sector customers, and international groups, including from Bangladesh, the Gulf and Asia, entering the UK market. We work alongside our technology, energy and commercial property teams.
The legal and regulatory framework in 2026
No single statute governs data centres. Instead, data centre lawyers London projects depend on combine planning, energy, property, construction, data protection, cyber security and investment screening law. The main developments are set out below.
Critical National Infrastructure designation
On 12 September 2024 the government announced that UK data centres would be classed as Critical National Infrastructure, the first new designation since 2015. The designation is not itself a licensing regime, but it brings closer engagement with government and security agencies during incidents and signals the policy weight behind the sector.
Planning: the NSIP opt-in
Data centres have traditionally needed planning permission from the local planning authority under the Town and Country Planning Act 1990. The Infrastructure Planning (Business or Commercial Projects) (Amendment) Regulations 2026 added data centres to the business or commercial projects that can be directed into the nationally significant infrastructure regime under section 35 of the Planning Act 2008. If the Secretary of State gives a direction, the project needs a development consent order instead of planning permission.
The regulations set no automatic size or capacity threshold. The Secretary of State must be satisfied that a project is nationally significant, and a national policy statement for data centres is being prepared to set the policy framework. Until it is in place, applicants weighing the route should expect case-by-case judgements.
Cyber security and resilience regulation
The Cyber Security and Resilience (Network and Information Systems) Bill, introduced in November 2025, would amend the Network and Information Systems Regulations 2018 to treat data infrastructure as a regulated sector and data centres as an essential service. Operators above capacity thresholds based on rated IT load would need to notify their regulator, put proportionate security and resilience measures in place and report significant incidents. Check the Bill's current status and the thresholds in force before relying on a particular position.
Data protection
Operators that only provide space and power usually do not process customer data. Managed hosting and cloud providers often do, acting as processors under the UK GDPR and the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025. Processor terms, security obligations, breach notification and international transfer mechanisms then become part of the customer contract. Our data protection team advises on these terms.
Investment screening
Data infrastructure is one of the sensitive areas under the National Security and Investment Act 2021. Acquiring control of a qualifying data infrastructure entity may require mandatory notification and approval before completion, and the government can call in other deals that raise national security concerns.
| Body | Role | When it matters |
|---|---|---|
| Local planning authority / Secretary of State | Planning permission, or development consent after a section 35 direction | Site selection and consenting |
| Department for Science, Innovation and Technology | Data centre policy, AI Growth Zones and the cyber resilience Bill | Strategic sites, NSIP requests, policy engagement |
| NESO, Ofgem and network operators | Grid connection process, connection charges and reform | Securing and keeping a connection date |
| Environment Agency | Permits for back-up generation and water abstraction | Diesel or gas generators, cooling water |
| Information Commissioner's Office | Data protection regulator | Managed and cloud services handling personal data |
| Investment Security Unit | NSIA notifications | Acquisitions of operators and platforms |
Power: the binding constraint
A large data centre is only as valuable as its grid connection. Connection queues grew far beyond what the network could deliver, and reforms led by NESO and Ofgem now prioritise projects that are ready and strategically aligned. In 2026 Ofgem consulted on a commitment fee for large demand connections such as data centres, intended to discourage speculative applications that hold capacity. Our guide to grid connection reform explains the process.
The government's AI Growth Zones programme aims to unlock AI-enabled data centres by improving access to power and providing planning support. Its November 2025 delivery package proposed measures including help with electricity costs for data centres in certain zones; details remain subject to consultation, so investors should check the current terms.
Power strategies compared
| Strategy | How it works | Legal issues |
|---|---|---|
| Direct grid connection | Connection agreement with the transmission or distribution network | Queue position, securities and liabilities, milestones, connection charges |
| Co-location with generation or storage | Data centre sited with a solar, wind or battery project | Licence exemptions, private wire, shared connection rights |
| On-site generation | Gas engines, fuel cells or other behind-the-meter supply | Environmental permits, emissions rules, planning |
| Corporate power purchase agreement | Long-term contract for renewable power, physical or virtual | Price, shape and volume risk, credit support, certificates |
Data centre lawyers London operators engage should test a private wire or co-location model against the Electricity Act 1989 licensing regime. Supplying electricity without a licence or exemption is an offence, and arrangements that work for one customer may not work when the campus adds tenants. See our guide to corporate PPAs for offtake terms.
Water, cooling and waste heat
Cooling is the second resource question after power. Evaporative cooling can require significant water, and in water-stressed areas planning authorities and water companies increasingly scrutinise demand. Abstraction from rivers or groundwater generally needs an Environment Agency licence, while mains supply depends on the water company's capacity. Waste heat is an opportunity as well as a burden: the Energy Act 2023 introduced a framework for heat network regulation and zoning in England, and data centres are natural heat sources for nearby networks. Agreements to export heat need clear terms on availability, pricing and liability if the data centre reduces load.
In today's market, a credible grid date is the asset; the land and the building follow it.
Developing a data centre step by step
- Site and power diligence. Assess land title, planning designations, flood risk, fibre routes, water supply and, above all, the realistic grid connection date and cost.
- Land control. Secure an option or conditional purchase, with rights for cables, substations and access, and deal with any restrictive covenants.
- Grid application. Apply under the reformed connections process, evidence readiness, and manage securities and milestone obligations in the connection offer.
- Consent route. Choose between local planning permission and a request for a section 35 direction, then run environmental assessment, biodiversity net gain and community engagement.
- Customer and capital. Sign a pre-let with a hyperscale tenant or anchor customer and raise development equity and construction finance.
- Construction. Procure design and build or multiple packages for shell, mechanical and electrical fit-out and grid works, with long-lead equipment secured early.
- Commissioning and service. Test and commission, then deliver services under colocation or lease terms with service levels for power, cooling and uptime.
- Operation, refinancing and exit. Refinance on stabilised income, sell stakes to infrastructure investors, and manage expansions and regulatory compliance.
Customer contracts: lease, colocation or cloud
The legal form of the customer relationship drives value, financing and regulation. Data centre lawyers London customers and operators instruct should choose the structure deliberately.
- Hyperscale or powered shell lease. A long lease of a whole building or hall, often with the tenant fitting out. Security of tenure under Part II of the Landlord and Tenant Act 1954 should be addressed, usually by contracting out.
- Wholesale or retail colocation. A licence or services agreement for space, power and cooling, with service levels, service credits and termination rights. Whether it is a lease or a licence affects tenure and remedies.
- Managed hosting and cloud. Service contracts in which the provider runs infrastructure and may process data, triggering data protection and, for some financial services customers, outsourcing rules.
- Interconnection and fibre. Cross-connect and network agreements that need to be aligned with the main service terms.
Align power commitments across the grid connection, the customer contracts and the construction programme. If the connection date slips, customer delivery dates and service level regimes must flex too, or the operator ends up liable for delays it cannot control. Write that link into each contract.
Financing and investing in data centres
Data centres are capital intensive and are increasingly financed like infrastructure. Development equity usually comes from sponsors, infrastructure funds or joint ventures with landowners. Construction finance follows once a site has power, consent and, ideally, a pre-let or anchor customer. Stabilised campuses can be refinanced with longer-dated bank, private placement or private credit debt.
Lenders focus on a few questions. Is the grid connection secure and assignable to a lender on enforcement? Do customer contracts produce predictable cash flow, and what happens to them if the operator defaults? Are construction risks passed to creditworthy contractors? Can the security package capture the lease or licence income, the connection agreement and the equipment?
Data centre lawyers London lenders and sponsors instruct should check early whether key contracts allow security to be granted and whether counterparties will sign direct agreements. Grid connection agreements, customer contracts and equipment leases often restrict assignment or change of control. A financing that ignores those restrictions can fail at the conditions precedent stage. Our private credit team advises on alternative lenders active in the sector.
Documents and evidence to assemble
Whether you are buying a platform, raising finance or signing an anchor customer, the same documents drive the timetable. A clean data room shortens diligence and reduces price chips.
- Land: title, options and leases, rights for cables and substations, searches and any restrictive covenants.
- Power: connection offers and agreements, queue evidence, securities posted, milestones and correspondence with network operators.
- Consents: planning permission or development consent, section 106 obligations, environmental permits for back-up generation, and water abstraction licences.
- Customer contracts: leases, colocation and service agreements, service level regimes, data processing terms and change-of-control provisions.
- Construction: design and build and fit-out contracts, equipment supply agreements, warranties and bonds.
- Corporate and regulatory: shareholder agreements, NSIA analysis, cyber security policies and incident records.
Risks and common mistakes
Buying land before testing power
A site with planning potential but no realistic connection date is a stranded asset. Connection reform has changed queue positions, and new commitment fees and milestone rules can make holding capacity expensive. Make land acquisition conditional on a satisfactory connection offer, or price the risk explicitly. Buyers of development platforms should diligence connection offers, securities posted, milestones and correspondence with network operators as closely as title and planning.
Assuming the NSIP route is always faster
The section 35 opt-in offers a single consent and decision by the Secretary of State, but it involves a structured pre-application and examination process and depends on a direction being granted. Without a finalised national policy statement, the policy test for national significance is less predictable. For many schemes, a well-prepared local application remains the better route. Weigh timetable, local politics, the need for compulsory acquisition powers and associated development such as substations before deciding.
Under-preparing for cyber resilience regulation
Operators above the proposed thresholds will need to notify their regulator, implement security and resilience measures and report significant incidents. Customers will increasingly demand evidence of compliance, and lenders will diligence it. Start now with a gap analysis against established standards, incident response plans and supply-chain security clauses, and track the thresholds as they are finalised. Our cyber security team advises on readiness.
Unclear lease or licence structure
Colocation agreements that grant exclusive possession of defined space may be leases, with security of tenure and different remedies, whatever they are called. That can frustrate an operator's ability to recover space or upgrade facilities. Decide deliberately whether the arrangement is a lease or a licence, document it accordingly, and contract out of the 1954 Act where a lease is intended to end on expiry.
Missing NSIA on platform deals
Acquisitions of data centre operators can fall within the data infrastructure area of the National Security and Investment Act 2021. A notifiable acquisition completed without approval is void, and the government can impose conditions on deals involving sensitive customers or foreign investors. Build NSIA analysis into the timetable and sale agreement conditions. Our NSIA team runs these assessments.
Cross-border angle: Bangladesh, the Gulf and Asia
Gulf sovereign and strategic investors, Asian operators and global hyperscalers are active in UK data centres. Data centre lawyers London investors rely on should consider how foreign law affects the deal as well as UK rules.
- Data transfers. Customer data hosted in the UK but accessed from abroad, or replicated to overseas facilities, raises international transfer rules under the UK GDPR. See our guide to international data transfers.
- Bangladesh. Bangladeshi technology and outsourcing groups use UK hosting and cloud services to serve European clients. Bangladesh has been developing its own data protection framework, so groups should check local rules on where data may be stored. TRW & Co's Dhaka office advises on Bangladeshi law alongside the London team.
- The Gulf and Singapore. Sovereign and family capital from the Gulf and Singapore often invests through fund or joint venture structures. Governance rights, NSIA and tax treaty access need to be designed together.
- China. Investors or suppliers linked to China may face closer national security scrutiny, both on acquisitions and in critical equipment supply chains.
How TRW & Co helps
We act as data centre lawyers London clients can deploy from site selection to exit. We do not promise outcomes, and where advocacy in the higher courts is required, we instruct specialist counsel.
Site, planning and power
Land options, planning strategy including section 35 requests, grid connection offers and power supply structures, working with our planning and energy teams.
Construction and supply
Design and build and fit-out contracts, long-lead equipment supply, delay and performance regimes, and construction disputes.
Customer contracts
Hyperscale leases, colocation and managed service agreements, service levels and credits, and data processing terms.
Finance
Development, construction and portfolio financing, security over leases and connection rights, and refinancing of stabilised assets with our project finance lawyers.
M&A and joint ventures
Acquisitions and disposals of platforms and stakes, joint ventures with landowners and capital partners, NSIA and merger control analysis.
Regulation and resilience
Cyber resilience readiness, data protection compliance, incident response planning and engagement with government on critical infrastructure.
To discuss a project, contact our London office at Holborn Gate, 330 High Holborn, London WC1V 7QH, email info@trw.co, or browse all our practices. Our guide to data centre planning and power goes deeper on consenting and grid.
Checklist for decision-makers
- Is there a realistic grid connection date, and what securities and milestones attach to it?
- Is local planning permission or a section 35 direction the better consent route?
- Does the power strategy rely on a licence exemption, and will it survive more tenants?
- Will the facility fall within the proposed cyber resilience thresholds?
- Is each customer arrangement deliberately structured as a lease or a licence?
- Do customer delivery dates and service levels flex with grid and construction delays?
- Does the transaction need NSIA clearance before completion?
- Are data protection and international transfer terms in place for managed services?
- Have you taken advice from data centre lawyers London investors trust on foreign law and tax?
Frequently asked questions
01Can a data centre be a nationally significant infrastructure project?
Yes, by opting in. The Infrastructure Planning (Business or Commercial Projects) (Amendment) Regulations 2026 added data centres to the projects that the Secretary of State can direct into the development consent order regime under section 35 of the Planning Act 2008. There is no automatic size threshold; the developer must request a direction and show the project is nationally significant. A national policy statement for data centres is being prepared. Otherwise, data centres continue to need planning permission from the local planning authority.
02What does Critical National Infrastructure status mean for operators?
The September 2024 designation means government treats data centres alongside sectors such as energy and water when anticipating and responding to critical incidents. It brings closer engagement with government, including a dedicated data infrastructure team and access to security agencies such as the National Cyber Security Centre. It is not itself a licensing regime. Binding cyber security and resilience duties are proposed separately through the Cyber Security and Resilience Bill.
03Will data centres be regulated for cyber security?
That is the government's plan. The Cyber Security and Resilience (Network and Information Systems) Bill, introduced in November 2025, would bring data infrastructure within the Network and Information Systems Regulations 2018 and treat data centres above thresholds based on rated IT load as essential services. In-scope operators would need to notify their regulator, apply proportionate security and resilience measures and report significant incidents. Operators should check the Bill's progress and the final thresholds.
04Should a colocation agreement be a lease or a licence?
It depends on what the parties want. A lease grants exclusive possession of defined space and can carry security of tenure under Part II of the Landlord and Tenant Act 1954 unless the parties contract out. A licence gives a personal right to use space and services and is easier to end or vary. Calling a document a licence does not settle the issue if it in fact grants exclusive possession. Hyperscale deals are usually leases; retail colocation is usually structured as services.
05How can a data centre secure power faster?
Options include applying early under the reformed connection process with strong evidence of readiness, co-locating with generation or storage, using on-site generation for part of the load, and locating in an AI Growth Zone where government is offering support with power and planning. Each option has legal consequences, including licence exemptions under the Electricity Act 1989, environmental permits and connection securities. A corporate power purchase agreement can address price and carbon but does not by itself solve connection constraints.
06Do I need NSIA approval to buy a data centre business?
Possibly. Data infrastructure is one of the sensitive areas of the economy under the National Security and Investment Act 2021. If the target is a qualifying entity within that area and the acquisition crosses the relevant control thresholds, mandatory notification and approval are required before completion; otherwise the deal is void. The government can also call in other deals. Merger control and customer change-of-control clauses may also apply.
07Can TRW & Co act for international data centre investors?
Yes. Our London office is authorised and regulated by the Solicitors Regulation Authority and advises on English law across planning, power, property, construction, finance and regulation. Our international offices, including in Dhaka, Singapore and Dubai, help investors from Bangladesh, the Gulf and Asia structure UK investments and coordinate foreign law advice. Where higher court advocacy is needed in England, we instruct specialist counsel.
Sources and official materials
- Infrastructure Planning (Business or Commercial Projects) (Amendment) Regulations 2026 — Adds data centres to the section 35 opt-in
- Planning Act 2008, section 35 — Directions into the NSIP regime
- Data centres designated as Critical National Infrastructure — September 2024 announcement
- Cyber Security and Resilience Bill — Proposed regulation of data centres
- AI Growth Zones — Power and planning support for AI data centres
- National Security and Investment Act 2021 — Screening of acquisitions in sensitive sectors
- NESO connections — Grid connection reform and process
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.