Cybersecurity and Sustainability

CYBERSECURITY AND SUSTAINABILITY

Three things we hold that are not ours, and one thing we do not hold at all

Written 15 September 2026 – Northampton

There is a moment on almost every driveway job that nobody outside the trades knows exists.

You have finished. The surface is clean, the machine is still ticking as it cools, and there is a quantity of water on the ground that has to go somewhere. In front of you are two drain covers. They are usually within a few feet of each other. They are frequently identical. One of them runs to a treatment works. The other runs, untreated, to a watercourse. And in this county almost every watercourse ends up in the same place, because almost the whole of Northamptonshire drains through the River Nene, which rises near Daventry, gathers its upper arms at Northampton, and runs a hundred and sixty nine kilometres to the Wash.

The customer is at the kitchen window making tea. You have got about ninety seconds before the water makes the decision for you.

Nobody teaches you this. There is no exam, no card you carry, no inspector who comes round to check you understood. You either learned it from somebody who knew, or you worked it out, or you never thought about it at all. And the difference between the first two and the third is the difference between doing your job and committing a criminal offence under the Water Industry Act 1991.

And it is not our ninety seconds. It belongs to every mobile trade in the country.

A plumber standing over a drain with a system flush in a bucket. A landscaper rinsing a knapsack sprayer at the end of a hedge job. A mechanic with a spill on a workshop floor that is going to find a gully whatever anybody intends. A mobile valeter. A rendering crew washing out a mixer. Every one of them, at some point in every working week, makes an unguided decision in under two minutes about where somebody else's water goes, using knowledge that nobody was ever obliged to give them.

That is the first of three things this article is about.

The second is in your pocket. The third is on a server, and we put it there ourselves.

WHAT A TRADE ACTUALLY CARRIES

This is the idea the rest of the article hangs on, so it is worth stating plainly before anything else.

Custody is the word, and it is the right one. Not ownership. Not responsibility in the vague sense people use when they mean being careful. Custody. Holding something that belongs to someone else, under obligation, with consequences if you hold it badly.

Cybersecurity and sustainability look like two unrelated compliance headaches sold to small businesses by two different sets of people. They are not. They are the same problem wearing different clothes, and the problem is custody.

THE SECOND THING. WHAT ACCUMULATES BY ITSELF

Most businesses that hold sensitive data went looking for it. A retailer builds a customer profile on purpose, because profiles are worth money. A marketing company collects because collecting is the product.

A trade absorbs it passively, simply by turning up.

Nobody on a round ever decided to find out that the house on the corner is empty every Thursday, or that the couple at number fourteen have both been off work since March, or that the man with the workshop keeps something in there worth more than his car. You learn it because you are there, week after week, at eye level with the back of the property, when most people are not home.

By the end of an ordinary working day the phone in a tradesman's pocket holds a run of geotagged photographs of the backs and sides of houses, taken from angles the owners have never seen. It holds gate codes and key safe combinations. It holds a note of who is elderly, who works nights, whose dog bites, and which side gate is the one that does not lock properly. It holds a payment history which, read by anybody with a reason to, maps out with some precision who has been struggling.

We are not going to put invented numbers on that, because we have not counted and neither has anybody else. But anybody who has run a round knows the shape of it.

Look at that list again from a burglar's point of view rather than a bookkeeper's. It is not a customer database. It is a security map of somebody's estate. Approach routes, access codes, occupancy patterns, and a photographic survey of every boundary and outbuilding. For a client with land, a gated approach, or anything worth taking, the most sensitive document in existence about their property may well be sitting on a tradesman's phone in a van outside a Greggs.

The bit nobody mentions about photographs

Here is a specific and under discussed danger, and it is the kind of thing that ought to be taught and never is.

A photograph taken on a modern phone carries E X I F metadata. An invisible block of information embedded in the file. Camera, settings, time, date, and on most default settings, the exact satellite coordinates of where it was taken.

Which means that an exterior cleaning business posting a before and after to social media, with no thought beyond showing off a good result, can publish the precise location of a client's property, the state of their boundary, and the time of day the photograph was taken. Not in the caption. In the file, where nobody looks, and where anybody who wants to can look.

We strip metadata from images before anything is published, and most social media platforms will also strip this metadata when uploading files. We also avoid identifying landmarks in the frame where a property is not already publicly identifiable. We are describing what we do rather than offering a warranty about it, and we would encourage anybody in this trade to go and look at what their own phone is currently attaching to every picture they take. Most people have never checked. Most service providers are surprised, most customers are aware and request absolute privacy when granting permission to photograph or video a service.

THE THIRD THING. THE ONE WE BUILT ON PURPOSE

The first two arrive whether you want them or not. The third we chose.

Shining Windows runs a platform. Customers create an account. They buy services. They book appointments. In doing so they hand over a name, an address, an email, a phone number, a payment route and a calendar of when they will and will not be at home.

That is no longer passive accumulation. That is a database, with a signup form, that we built.

And it changes our legal position rather than merely our workload. Under the Data Protection, Charges and Information, Regulations 2018, organisations that use personal information, and the Information Commissioner's Office is explicit that this includes sole traders, must pay an annual data protection fee unless they are exempt. There are exemptions. There is a self assessment tool on the Commissioner's website to work out whether you fall inside one.

And there is a sentence in that guidance which, when we found it, stopped us for a moment, because it is this entire article in seven words.

It is your responsibility to find out.

That is the Commissioner on the data protection fee. It could just as easily be the water company on which drain is which. The obligation is absolute. The information is not delivered. Finding out is on you.

Why we did not build our own

There is a decision behind the platform that is worth explaining, because we think other small businesses are getting it wrong in both directions.

We host with Wix. Not because it is fashionable, and not because anybody paid us to say so. Because a two person exterior cleaning business in Northamptonshire has absolutely no business running its own security infrastructure.

The temptation for a technically minded sole trader is to build it yourself and keep control. The temptation for everybody else is to pay a local developer and never think about it again. Both of those leave the security of somebody else's personal data in the hands of a business that does not have, and will never have, a person whose job is security.

Buying infrastructure from an organisation that employs security engineers is not an admission of inadequacy. It is an accurate assessment of what a micro business actually is. We would rather be honest about our limits and buy the thing we cannot build, than pretend to a competence we do not have and find out we were wrong when it is somebody else's address that leaks.

And on the government side there is one practical scheme most sole traders have never had explained to them. Cyber Essentials is backed by the National Cyber Security Centre. Five controls, self assessed, with a version called Plus that adds a technical audit. The part that never makes it into the conversation is that United Kingdom organisations with under twenty million pounds of turnover which certify are eligible for cyber liability cover of up to twenty five thousand pounds, subject to the scheme's conditions.

Nobody markets that to a window cleaner, because there is very little money in selling a cheap government scheme to a man with a van. The people who do market to us have a product, and that brings us to the numbers.

THE PART EVERYBODY GETS WRONG ABOUT BEING ATTACKED

If you run a small business in this country, somebody has tried to sell you cyber security using a figure. A percentage of small firms that go under within six months of a breach. An average cost running to five or six figures. Delivered in a tone of quiet urgency by a person with something to sell.

We went looking for the source of those numbers, because that is what this website does. We could not find one. Every trail led back to a company selling security software. None led to a survey anybody could read.

What does exist, free, annual, published by government with its methodology attached, is the Cyber Security Breaches Survey. The 2025 edition found that forty three per cent of all United Kingdom businesses identified a breach or attack in the preceding twelve months. Among micro businesses, forty two per cent. Among small businesses, forty six.

So the first half of the sales pitch is true.

Here is the second half, which appears on nobody's leaflet.

The median cost of a breach was nothing. Zero pounds.

The mean was sixteen hundred. Strip out the breaches that cost nothing and the mean climbs to three and a half thousand. At the ninety fifth percentile for micro and small businesses, the figure is around four thousand pounds.

Those four numbers have to be read together or they mislead in opposite directions.

The median is what creates the complacency. Most of what happens to a small business is a phishing email somebody spotted, an attempt that failed, a nuisance absorbed in an afternoon. It costs nothing, and so the entire subject gets filed under things that happen to other people. Which is exactly how a trade ends up with client addresses and gate codes on an unlocked phone.

The tail is what actually closes businesses. The mean sitting well above the median tells you the damage is concentrated, not spread. And for a two person operation, four thousand pounds is not a line on a spreadsheet. It is the emergency reserve, gone. It is a van repair you then cannot fund, or a quarter's tax you have to find twice, in a trade where, as we set out in the article on financial resilience, a substantial share of businesses are already borrowing to cover the gap between doing work and being paid for it.

The honest position is therefore neither that you will be ruined, nor that this does not matter. Roughly half of us will see something. Most of it will be nothing. The minority who are hurt will be hurt properly. Which half you prepare for is a judgement rather than a fact, and anybody who tells you otherwise is selling.

We prepare for the tail. Not because we are frightened of it, but because what would be lost is not ours to lose.

THE MAN WHO DECIDED TO PUBLISH

There is a figure in British cyber security worth knowing about, and the reason has nothing to do with firewalls.

Ciaran Martin was the founding Chief Executive of the National Cyber Security Centre, from its launch in 2016 until the middle of 2020. He is now Professor of Practice in the Management of Public Organisations at the Blavatnik School of Government at Oxford. He also advises private sector organisations and is associated with Paladin Capital Group, a cyber focused investor, which we mention because he ought not to be quoted on market questions without it being known.

When he joined G C H Q's board in 2013, the International Telecommunications Union ranked the United Kingdom joint eighth in the world for cyber security. When he stepped down in 2020, it ranked first.

What moved that was not principally clever engineering. The Centre answered incidents quickly, gave the public plain advice in plain English, and, this is the part that matters to a window cleaner, took information that had previously been classified and put it into the hands of ordinary companies so they could defend themselves.

The insight underneath that decision is the one to carry away. Secrecy protects nobody below a certain size. A business with a security department can act on a private warning. A business with no security department, which is to say almost every business in this country, cannot act on intelligence it never sees. The choice was between keeping the knowledge safe and making the businesses safe, and the agency chose the businesses.

A national security agency and a window cleaning round are not the same kind of problem, and we are not going to pretend otherwise. But the principle transfers exactly.

If the information that would let somebody do the job properly is not published, the failure is not theirs.

Hold onto that. It comes back.

BACK TO THE DRIVEWAY

Which returns us to the water, and to the ninety seconds.

Trade effluent must not go into a surface water drain. Not a guideline, not a code of practice, not an industry expectation. A surface water drain takes what you put in it and delivers it, generally untreated, to a watercourse. A foul drain takes it to treatment. Discharging trade effluent without consent is a criminal offence under the Water Industry Act 1991.

There is no allowance for being small. No exemption for one man with a van. The offence is the same whether you are a chemical plant or somebody rinsing a patio.

And before we say anything else about it, we should say why the law is there.

It is there because operators do it. Not through confusion. Deliberately, and routinely. Raw sodium hypochlorite straight down the nearest gully because it is four steps closer than the foul drain. Detergent, degreaser, hydrocarbons lifted off a driveway and everything suspended in them, sent into a brook because the alternative was inconvenient. Anybody who has worked in this trade for any length of time has arrived at a job and been able to read, from the state of the paving and the staining round the gully, exactly what the last firm did.

The regulation is not an overreaction. It is a proportionate response to a real and continuing practice, and a trade that argued otherwise would deserve everything it got. We support it without reservation and we comply with it because it is right, not because anybody is watching.

Now stand on the driveway again and look at what is actually available to make the decision with. Two covers a few feet apart, frequently identical, sometimes with the lettering worn flat by thirty years of cars. No plan of the property. No obligation on anybody to tell you which is which. A customer who does not know either and has never had cause to wonder. And the water is already moving.

We look before we start. It takes a couple of minutes at the beginning of a job to find the covers, work out which is which, and plan where the water is going before the machine is running rather than after. We are describing what we do rather than selling it as a service. It is not a line on an invoice and it is not a badge. It is just the part of the job that happens before the part people can see.

The obligation is absolute and the information is absent, and those two things do not sit comfortably together. A tradesman can be prosecuted for a decision he had ninety seconds to make, using knowledge nobody was ever required to give him. West Northamptonshire Council publishes surface water drainage guidance, but it is written for developers designing drainage systems. Not for a man standing on a driveway in Hartwell with a lance in his hand.

And the chemistry has its own rules

The same pattern runs through the chemical side, and the detail is more specific than most of this trade realises.

Sodium hypochlorite is the workhorse of soft washing. The thing that kills the black algae and the green film and the lichen on a north facing render. Its regulatory position turns on something counter intuitive. It is caught by the Great Britain Biocidal Products Regulation only where it is marketed or used with a biological control claim. The regime engages not because of what is in the container, but because of what you say it does. Claim it cleans the surface and you are in one place. Claim it kills the growth and you are in another.

Once you are in the second place, professional use packs are typically capped at twenty five litres or twenty five kilograms, labelling is separated by user group, and professional users must have appropriate information, instruction and training.

Most people in this trade have never been told that the claim is the trigger. They have been told which drum to buy.

We are not going to hand anybody a stick to beat other contractors with, because the distinction is subtle enough that a customer applying it as a test would get it wrong and accuse honest traders of things they have not done. But it is worth understanding, and it is worth knowing that a firm advertising that it kills moss and algae has stepped into a regulatory regime with training and labelling obligations attached, whether it knows it or not.

We publish what we use and at what dilution, on every job, in the case log. That is not a flourish and it is not a legal shield. Nothing is unassailable and we would not claim it. It is the only mechanism by which any of this is checkable by anybody, including by us, three years later, when somebody asks what went onto their render in 2023.

And the thing this trade almost never says

There is one more part of sustainability out here, and it is the part that costs money to believe in.

Cleaning a building is not always the right thing to do.

Historic England operates a presumption against removing biological growth from historic fabric, and the reasoning is sound. On some substrates the growth is doing less harm than its removal would. The chemistry can be wrong for the stone. The pressure can open the surface. A wall that looks better in the photograph can be measurably worse off in the fabric, and the damage does not present for years.

So there are properties we have walked away from, and jobs where the honest answer to, can you clean this, is, yes, and you should not let me.

A business that has never once said that to a customer is not an environmentally responsible business. It is a business with a sales target. That distinction is the whole of what the word sustainability means in this trade, and it has nothing whatever to do with what colour the van is.

AND NOW THE ASYMMETRY

Here is where the three things come together, and where this article turns.

We hold our customers' data under a regime with criminal sanctions attached. We hold their water under another one. Both are registered, licensed, inspectable and enforceable. The Commissioner can find us. The water undertaker can find us. Our name and telephone number are painted on the side of a vehicle that sits on a public road for six hours a day.

And there is a fourth thing in this relationship that nobody holds under any obligation at all. Our name.

This business has been written about, in public and permanently, by people who have never bought a service from us, never met us, never stood on a driveway with us, and in all likelihood never will. Not customers with a complaint. We have had those, and a customer with a complaint is owed an answer. Strangers. Posting into local groups, about a business they have had no dealings with, sometimes repeating something they half heard, occasionally using the word criminal.

We are not going to name anybody, and we are not going to reproduce any of it, because doing so would be doing to them exactly what we are describing. We are also not going to dress it up as a tragedy. It is not. It is an ordinary feature of running a visible small business in 2026 and most people in the trades have some version of the same story.

What is worth noticing is the structure, because the structure is genuinely odd.

A tradesman who mishandles a customer's postcode is answerable to a statutory regulator. A tradesman who puts water down the wrong drain has committed a criminal offence. And a person with no connection to the business whatsoever can publish an accusation of criminality about it, to an audience of thousands of its neighbours, permanently, under no obligation of accuracy, with no register, no licence, no inspection and no consequence.

That is not a complaint about free speech. People are entitled to talk about businesses, and a trade that wanted that stopped would be a trade with something to hide. We publish a case log precisely so that people have something factual to talk about.

It is an observation about where obligation has been placed. Every custody duty in this relationship runs in one direction. The small business holds the customer's water, the customer's data, the customer's building and the customer's money under enforceable rules. Nothing holds the reputation of the small business under anything at all.

We deal with the review question properly in the third article of this series, and with disputed payments in the fourth. Including the friendly fraud that arrives through the very platform described at the top of this article, where the same signup form that makes us a data controller also makes us reachable by anybody who wants their money back without a conversation.

For here, one point only. When somebody argues that regulation is a burden on small business, the burden is real and we carry it willingly. But it is worth knowing how unevenly it has been distributed. Because the same imbalance is about to appear in an entirely different form.

WHAT NOBODY IS COUNTING

We came across the next thing while researching the article in this series about artificial intelligence. When we understood what we were looking at, we brought it back here, because it belongs in this one.

Data centres are the physical buildings that artificial intelligence runs inside. They are large, they are multiplying, and they consume two things. Electricity and water. The water is for cooling.

United Kingdom data centres currently take around two and a half per cent of the country's electricity, and that is expected to grow four fold by 2030, to around six per cent of national use.

Then we went looking for the water figure, and there is not one.

There are no official figures for how much water United Kingdom data centres collectively consume, because they are not required to report it.

For scale. A single hundred megawatt hyperscale facility can use in the region of two and a half billion litres a year. And the water resource management plans finalised by the water companies in 2025, the documents that decide how much water this country plans to have, do not adequately account for demand from artificial intelligence data centres.

Now put that next to the driveway.

A single data centre can consume two and a half billion litres a year with no obligation to tell anybody, while a man with a tank on a van commits a criminal offence if he puts the wrong water down the wrong drain.

We have thought carefully about how to write that sentence, because it is the kind of observation that curdles into self pity if it is handled badly, and self pity is the fastest way we know to lose a reader's respect.

So, plainly. This is not an argument that either regime is wrong. It is an audit of where regulatory attention has been placed, and the finding is this.

Regulatory attention is not distributed in proportion to environmental impact. It is distributed in proportion to how easy the target is to regulate.

Look at a one van business from a regulator's desk. Metered supply. Fixed address. Waste carrier licence. Insurer. Name and phone number on the side of a vehicle parked on a public road. There has never been an easier thing to inspect in the history of enforcement.

Now look at a hyperscale data centre. Planned over years by organisations with counsel. Negotiated with utilities and planning authorities. And the specific reporting obligation that would reveal its water consumption to the public does not exist, so there is nothing to inspect against.

That is not malice and we are not alleging any. It is the path of least resistance running through an entire regulatory system, arriving at an outcome nobody designed and nobody would defend out loud if it were put to them in a single sentence.

One forward looking note, and we will mark it as speculation rather than fact. Water stress in this country is increasing, not decreasing. If demand rises four fold while the plans that allocate supply do not account for it, the pressure has to appear somewhere. We do not know where or when, and anybody who tells you they do is guessing. What we can say is that a business already metering, recording and accounting for its water is not the business that will struggle when that conversation arrives.

WHY THESE TWO SUBJECTS ARE IN ONE ARTICLE

Somebody reading this far is entitled to ask what a phishing email has to do with a drain cover.

The lazy answer, the one written when somebody needs two topics to share a page, is that a cyber breach wastes resources and is therefore environmental. That is not true enough to be worth saying.

The real answer is the one we started with. All of it is custody.

The water is somebody else's, before we put it on their property and after it leaves. The data is somebody else's, permanently, whoever's phone it sits on. The building is somebody else's, and will outlive everybody in this article. In each case a two person business has been handed something with real consequences attached. And in each case the information needed to hold it properly is either unpublished, or buried where no working tradesman will find it, or preceded by the sentence, it is your responsibility to find out.

And in one of those three, this country has already proved the problem is solvable.

That is the whole significance of Ciaran Martin's Centre. Faced with a population of businesses that could not act on information they were not given, the answer was not to make the businesses cleverer, or to write them a firmer letter, or to raise the penalty. The answer was to publish. And the country's international ranking moved from eighth to first.

Nothing equivalent has happened on the environmental side of this trade. There is no plain English national guidance on which drain is which. There is no published standard for what to do when you cannot tell. The biocide claim trigger is not explained anywhere a sole trader will meet it before he needs it. The knowledge exists in every case. It has never been put where the people who need it are standing.

That gap is what this article is actually about, and it is why our case log looks the way it does.

Every job records what was used, at what dilution, where the water went, onto what substrate, in what conditions, with photographs and a date. Not because a regulator asked. Nobody has ever asked. We do it because somebody in this trade ought to be publishing the working, and as far as we can find, nobody was.

It is a very small answer to a fairly large problem. It is also the only one available to two people in Northamptonshire with a van.

WHAT WE LEFT OUT, AND WHY

An earlier draft of this article quoted a well known sustainability figure. An Order of the British Empire, decades of experience, a serious career across retail, mining and steel.

He is also Group Director of Sustainability at Drax, a biomass generator whose own environmental position is the subject of sustained public and regulatory argument. He is, in other words, an interested party on the precise question we would have been quoting him about. So he is not in this article.

That is not a criticism of the man and it is not a judgement on Drax. It is the rule we apply everywhere. Where somebody's commercial position sits inside the question being asked, either the interest is stated in the same breath as the quotation, or the source does not appear. We took the second option, because the argument did not need him and a reader is better served by government statistics they can check themselves.

The cyber statistics we discarded went the same way. Every alarming figure about small business closures after breaches traced back to a company selling security products. The government's survey is free, annual, methodologically documented, and says the median cost is nothing. We would rather publish the unflattering number that has a parent than the frightening one that does not.

THREE QUESTIONS WORTH ASKING

Not a test, and not a stick. These are simply the three things we would want to know if we were hiring somebody to work on a property we cared about, and none of them is difficult to ask.

Where does the water go? Not whether they are careful. Where, specifically, on this property, does the runoff end up. Anybody who has looked will be able to answer in one sentence. Anybody who has not will change the subject.

Does the advertising match the regime? A firm whose marketing says it kills growth has entered the biocidal regime, with its training and labelling obligations. That is not a trap, and most firms in that position are entirely legitimate. It is simply a question worth understanding the answer to.

What happens to the photographs, and to the access codes? Where are they kept, who else can see them, and does anything get stripped before a picture of the back of your house goes onto the internet.

We would rather these questions were asked of everybody, including us. A trade that improves because customers got better at asking is a better outcome than a trade that improves because somebody got prosecuted.

WHERE THIS LEAVES US

Roughly half of businesses our size will identify a breach or attack this year. Most of it will cost nothing, which is precisely what makes it dangerous, and the minority who are hurt will be hurt properly.

A tradesman is not a data protection officer. He is not a hydrologist. He is not a materials scientist. He is one person, frequently the only person, expected to hold all three standards simultaneously while standing in freezing rain with a lance in his hand and a customer watching from a window. And to have found out, by himself, what those standards are.

Trade effluent in a surface water drain is a criminal offence, and on most driveways in this country the two drains look the same.

Sometimes the right answer is to leave the building alone, and a firm that has never said so is selling rather than advising.

The rules that require all of this are not the problem. They are the thing that separates a trained trade from an operator with a drum of bleach and a pressure washer, and we would not remove one of them.

And the industry powering the technology everybody is excited about is not required to say how much water it uses, so nobody knows.

None of that is secret. Almost all of it is published by government, for free, today. And virtually none of it reaches the people it applies to.

That is the failure. Not the rules, and not the people trying to follow them.

We have been doing this since 2001. First with a shopping trolley, now with a van. And the thing that has changed least in twenty five years is how much of what you need to know you are simply expected to have picked up somewhere.

A trade is not measured only by what it removes from a building. It is measured by how it holds what it was trusted with. The water, the data, and the fabric that will still be standing long after everyone in this article has stopped working.

Publishing the working is not a marketing strategy. It is the only sensible response to a quarter of a century of finding out the hard way.

SOURCES

Government and Parliament. Cyber Security Breaches Survey 2025, Department for Science, Innovation and Technology. Cyber Essentials, National Cyber Security Centre. The Information Commissioner's Office pages on the data protection fee, registration and self assessment. The Government report on water use in data centres and artificial intelligence. House of Commons Library briefing C B P one zero three one five, Data centres, planning policy, sustainability, and resilience, dated 27 May 2026, by Adam Clark. West Northamptonshire Council surface water drainage guidance. And the Environment Agency Nene Management Catchment, on the Catchment Data Explorer.

Statute and regulation. Water Industry Act 1991. Great Britain Biocidal Products Regulation. The Data Protection, Charges and Information, Regulations 2018.

Heritage. Historic England guidance on biological growth on historic fabric.

Named individual. Ciaran Martin. Founding Chief Executive of the National Cyber Security Centre from 2016 to the middle of 2020. Professor of Practice in the Management of Public Organisations, Blavatnik School of Government, University of Oxford, from September 2020. Declared. He also advises private sector organisations and is associated with Paladin Capital Group, a cyber focused investor.

Sources and licensing. Contains public sector information licensed under the Open Government Licence version three point zero. Parliamentary Library material, where quoted, is licensed under the Open Parliament Licence. Quotations from copyright works are used under the quotation exception, section thirty, Copyright, Designs and Patents Act 1988, and each is attributed in the text. Figures are reported as published by the named body.

Nothing in this article is legal advice. Anybody uncertain about their obligations under the Water Industry Act 1991, the Great Britain Biocidal Products Regulation or data protection law should speak to their water undertaker, the Health and Safety Executive or the Information Commissioner's Office directly. And should do it before the water is already moving.

Matthew Kenneth McDaid, trading as Shining Windows