Rules and ethics
How the Online Safety Act changes moderation duties for UK community teams
Community management software now has to evidence Online Safety Act duties: Ofcom risk assessments, moderation records and ICO UK GDPR overlap, explained.
What to take away
- Ofcom's illegal harms codes took effect on 17 March 2025. Moderation in user-to-user communities is now regulated activity.
- You need a written, dated risk assessment naming each risk, its control, a named control owner and the review trigger.
- Keep four record setsmoderation decisions, risk assessments, complaints and training, each with the rule, policy version, reason and moderator.
- Moderation logs are personal data. UK GDPR still applies, and a serious incident can mean telling the ICO within 72 hours.
- Choose software that exports an audit trail. Discourse keeps a staff action log; Circle offers a moderation queue and exports.
What the Act requires of a UK community team
The Online Safety Act 2023 places duties on providers of user-to-user services. If members can post content that others see, share or reply to, the service is likely in scope.
Forums, chat channels, comment threads, member groups and marketplace listings all count.
The duties are to assess risk, take proportionate steps against illegal content and protect children from harmful content. Ofcom's illegal harms codes arrived in December 2024, live from 17 March 2025. Children's codes followed in April 2025.
The guide to UK legal regimes reaching an online community maps where consumer, advertising and data protection rules overlap with these duties.
The risk assessment Ofcom expects, and how to keep it current
Ofcom expects a written assessment of harm risks, reviewed as the service changes. Build it in six steps.
The risk assessment Ofcom expects
- Write a service factsheetwhat the service is, who uses it, which features allow interaction.
- Separate adult and child risks. Illegal content covers terrorist material, child sexual abuse material, harassment, fraud and illegal goods.
- Rate likelihood and severity, then attach a control to each risk and name its owner.
- Record how you will test that the control works.
- Note the evidence behind each rating.
- Set a review date and triggersa new feature, a new region, a rise in reported harm.
Keep superseded versions. If you reject a recommended control, record why.
Building a risk assessment
- Start with the service factsheet
- Name illegal content risks
- Name children's risks
- Record likelihood, severity and controls
- Assign an owner to each control
- Review when the service changes
Records to keep, and an example retention schedule
Records must answer three questions: what was the risk, what did you do, how do you know it worked.
Records to keep
- Moderation decisionstimestamp, item, rule, policy version, reason, moderator.
- Risk assessmentsevery version, the evidence, the review date, the sign-off.
- Complaintsthe complaint, the response, time taken, outcome.
- Trainingwho was trained, on what, when.
Example retention schedule
| Record set | Example retention | Purpose |
|---|---|---|
| Moderation log entries | 12 months | Appeals and subject access requests |
| Risk assessments | 3 years plus current year | Shows how controls changed |
| Complaints | 24 months | Evidence the safety process works |
| Training records | 3 years | Proves the moderator was trained first |
These periods are an example, not a statutory limit. The Act sets no single universal retention period, so document your own and review it yearly. The guide to moderation and records duties UK community teams must document sets out what each entry needs.
Example: one moderation log entry and one risk-assessment row
One moderation log entry
- Date and time
- 14:32, 3 March
- Item
- Post 88213, member 4417
- Rule applied
- 4.2 Harassment
- Policy version
- 3.1
- Decision
- Post removed, warning issued
- Reason
- Three replies targeting one member
- Made by
- MOD-04, human review
Risk row: harassment of a named member, likelihood medium, severity high. Control: report button plus two-moderator review for repeat offenders. Owner: community lead. Measure: median time to first action under four hours.
Evidencing decisions in community management software
Ofcom wants evidence produced quickly, not a particular product. Test each platform on four points.
Evidencing decisions in software
- Filter moderators' actions by date, moderator and rule.
- Store the policy version in force when the decision was made.
- Export a moderation log as CSV without contacting support.
- Separate automated decisions from human ones in the audit trail.
Discourse keeps a staff action log that admins filter and export. Circle provides a moderation queue and member and post exports.
Software features that evidence decisions
- Automatic audit trail with timestamp and actor
- Immutable logs, or amendments themselves recorded
- Policy versioning tied to each decision
- Reports by date, rule, moderator and outcome
- Exportable evidence for regulators and boards
- Role-based access, retention rules and redaction
UK GDPR, the ICO and the 72-hour breach clock
Moderation logs are full of personal data: usernames, messages, IP addresses, ban reasons.
The ICO's online safety and data protection guidance explains how safety duties and data protection fit together.
You need a lawful basis, usually legitimate interests or legal obligation, and a privacy notice describing moderation. Minimise too: keep the decision, not everything the member posted.
Subject access requests reach moderation logs, so have a process to find, review, redact and disclose them.
If an incident is a personal data breach, you may need to notify the ICO within 72 hours of becoming aware, through the ICO's report a breach route.
If children can reach the service in practice, Ofcom judges the reality rather than your terms.
Users should know what you log and when a person reviewed an automated call, which is why a community disclosure policy moderators can enforce belongs beside the log.
Common questions
Does the Act apply to a small community?
Yes, if it is a user-to-user service. Size changes how proportionate your measures must be, not whether the duties apply.
How long should we keep moderation records?
The Act sets no single figure. Set retention by purpose, document it and review it yearly.
Must every member complete age verification?
No. Match the method to the risk, and use a lawful basis for any data it collects.
Can moderation be automated?
Yes. Tell users when a decision was automated, and give bans a human review route.
