Legal responsibilities for a UK reseller hosting business

A reseller hosting business supplies customer services using capacity obtained from an upstream provider. Its legal position depends on the permitted service, contractual relationships and actual conduct. Buying a plan does not authorise every possible resale activity or remove obligations to customers.

For a UK operation, organise the review around the real service: account provision, domains, email, application care, payments and personal data. This guide was reviewed on 30 October 2026. A business adding a materially different regulated activity needs a separate assessment of that activity.

Start with permission to provide the service

Read the upstream agreement and acceptable-use policy. Confirm that the selected plan permits client accounts and the intended resale model. Ordinary shared hosting should not be assumed to grant unrestricted resale rights simply because it can hold more than one website.

Check branding, migrations, account limits and customer access. Keep the agreement and relevant versions. If a provider changes the service or you move plans, review the customer promises affected rather than continuing to sell an unsupported feature.

Choose the correct business structure and registrations

A sole trader and a limited company have different registration, liability and administration arrangements. UK guidance does not require every small business to incorporate. Follow the applicable HMRC process or Companies House requirements for the structure chosen.

Use accurate identity and contact details in contracts, invoices and website disclosures. Protect business accounts and meet relevant filing responsibilities. Company administration, tax registration and a domain registration are separate tasks.

Check actual licensing questions

A broad article cannot determine every licence or authorisation needed by every business. Use the current GOV.UK licence resources and relevant regulator where the activities require it. Reselling website hosting should not be confused automatically with running a telecommunications network or offering a regulated financial service.

If the business also provides communications, credit, payment services or another regulated activity, check that framework directly. Accepting payment for your own hosting service differs from holding or moving funds for other parties. Avoid unsupported claims that one generic “hosting licence” either covers everything or is universally required.

Keep taxes and records connected to transactions

Record customer charges, refunds, fees and upstream costs. Tax requirements depend on structure and activity, with VAT following its own registration tests. Monitor current thresholds and relevant digital-record requirements rather than treating every bank receipt as profit.

Plan renewals, tax timing and refunds in cash flow. An annual client payment has to support the full service term. Keep evidence and reconciliation so the business can explain a charge or correction later.

Define data-protection roles

You may determine the purposes for billing and support records while acting under different arrangements for information hosted on a client’s website. Identify the real controller, processor and sub-processor relationships using current ICO guidance.

Use appropriate contractual terms and instructions, security measures and incident contacts. Review supplier locations and international transfers where relevant. White labelling does not remove the need for accurate privacy information or a documented processing chain.

Check whether an ICO fee is due or an exemption applies. Paying a fee is not a complete compliance certification. Rights requests, access control, retention and incident assessment remain practical responsibilities.

Write a service contract the business can perform

State the allocation, supported applications, responsibility for updates, support scope, backup arrangement, billing and renewal. Explain suspension, cancellation, export and termination processes appropriately. Distinguish optional development work from the recurring hosting service.

Consumer and business customers can have different rights. Review cancellation and pre-contract information for the actual supply. A generic “no refunds” clause or a checkbox should not be assumed to remove statutory protections.

Respect software and content rights

Use genuine licences and check what may be provided to clients. A control-panel licence, billing application and premium theme can have different terms. An upstream feature listing does not automatically give you permission to redistribute every paid plugin.

Maintain evidence for photographs, branding and commissioned work. Do not copy competitors’ content or claim facilities you do not own. A private nameserver and white-label interface concern presentation; they do not establish infrastructure ownership.

Operate an acceptable-use and abuse process

Give customers clear permitted-use conditions aligned with the upstream service. Prepare a route for suspected compromise, spam, infringement or unlawful activity. Record the report, relevant evidence and action without exposing private information unnecessarily.

Do not make arbitrary destructive changes based on an unverified allegation. Follow the agreement, applicable obligations and appropriate escalation process. Where urgent containment is needed, preserve evidence and communicate through a suitable channel.

Protect accounts and recovery

Use individual access, strong authentication, supported software and appropriately separate backups. Limit temporary supplier access and remove it when work is complete. Keep important account recovery available to the business if one person is absent.

Test restoration and document the decision process. A shop’s recent orders may be newer than the backup. Reverting a database without reconciliation can create customer and payment disputes even if the homepage returns.

Choose the upstream partner using specific questions

Ask who patches infrastructure, handles account compromise, performs restoration and supports migrations. Confirm which features and resources are actually included. Do not infer a guarantee, response time or UK server location from the supplier’s domain or billing currency.

telaHosting’s current reseller specifications can be reviewed against those needs. A suitable partner supports a clearly defined service; it does not make the reseller’s independent legal or customer responsibilities disappear.

Keep a review file and handover process

Store agreements, policies, permissions, account owners and incident contacts securely. Revisit them when adding customer types, territories or integrations. Test a controlled onboarding and exit to check that the published contract matches what staff can do.

Legal readiness is a continuing operating discipline. Accurate terms, permitted resale, reliable records and responsible data handling give the business a defensible foundation. A low initial hosting bill is useful when those obligations can also be met.

Handle a disputed report without improvised disclosure

A reseller may receive an allegation about content hosted in a client account. Preserve the report and relevant identifiers, verify the route through which it arrived and use the agreed upstream escalation process. Keep the investigation limited to people with a legitimate need to participate.

Do not assume an allegation automatically authorises sharing the client’s full database or account credentials. Equally, do not ignore a credible urgent issue because the customer is normally responsible for content. The appropriate action depends on the evidence, contract, applicable law and any relevant formal request.

Record containment and communication decisions factually. If a website is compromised, distinguish preserving evidence, restoring service and addressing the original vulnerability. Reinstating the same vulnerable copy without remediation can recreate the incident.

Use this type of scenario when reviewing terms and staff training. A good agreement should help operators identify the decision-maker, escalation channel and expected records. It should not depend on vague promises to comply with everything while leaving the practical response undefined. Rehearse access removal, data export and a client handover in a controlled account so the service can demonstrate the procedures described to customers.

Review these responsibilities when a supplier, customer type or territory changes. Keep the evidence and effective date of the decision. A new integration can alter data flows or contract scope even when the public package name stays the same.