A security fix was published on Tuesday. Nobody at the restaurant knows whether it has reached the site.

One is a legal duty naming no timeframe; one a certification control naming fourteen days; one advice sharper than either. An owner who is told that a supplier is aligned to a standard cannot tell which of the three has been sold.

The UK GDPR applies UK-wide; each Article below was read in the legislation.gov.uk United Kingdom version on 30 August 2026. Article 5(1)(f) requires personal data to be "processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures". Article 32(1) binds supplier and restaurant alike: both must implement "appropriate technical and organisational measures to ensure a level of security appropriate to the risk", judged against "the state of the art" and the risk to people's rights and freedoms. Neither Article names an interval.

Enforcement runs through the Data Protection Act 2018.

The fourteen days comes from Cyber Essentials: "Cyber Essentials is the minimum standard of cyber security recommended by the Government for organisations of all sizes." The pressure it names is supplier qualification, not law.

The control sits in Requirements for IT Infrastructure v3.3, April 2026. In-scope software must be updated, including vulnerability fixes, within 14 days of release where the vendor calls the fix critical or high risk, where it addresses a CVSS v3 base score of 7 or above, or where the vendor gives no details at all. A bundled release buys no time, and scope is broad: publicly available commercial web applications are in scope by default, bespoke and custom components are out, and cloud services cannot be excluded.

The assessment question is the plugin case:

Since April 2026, failing that question or its companion fails the whole assessment. The changes apply to assessment accounts created after 26 April 2026; an account opened before then has six months on the previous version. But the 14 days is not new: the identical requirement and footnote stand in v3.2 of April 2025, so April 2026 changed the marking, not the deadline. And none of it is law: it binds an organisation that chose to sit the assessment, or holds it because a customer requires it.

The NCSC's vulnerability management guidance, version 2.1, reviewed 1 May 2026, is advice, and stricter: update as soon as possible, ideally automatically, whatever the severity. Its timescales are 5 days for internet-facing services and software, 7 for operating systems and applications, 14 for internal ones.

A restaurant's website is internet-facing, so its advisory figure is five days rather than fourteen. Where a CISA Known Exploited Vulnerability Catalog entry is being actively exploited in a business-critical system, the NCSC compresses the window to under 24 hours if the flaw is also internet accessible, automatable and gives total control; to under 48 if it is not automatable; to under 72 if it is not internet accessible — each with an assured cyber incident response engagement. These are install windows, not the 72-hour breach-notification deadline. The guidance also tells organisations to make critical suppliers contractually liable for rapidly mitigating vulnerabilities in internet-accessible systems being exploited in the wild. It also warns that a late patch is not safety:

None of it is enforceable in itself.

On 26 March 2025 the ICO issued a penalty notice to Advanced Computer Software Group Limited and two associated companies. Under a heading reading "Vulnerability Management – State of the Art" it reproduced the Cyber Essentials v3.0 text then in force, 14 days included:

Article 32(1) is expressly judged against "the state of the art" — the hook the scheme was hung on. On patching itself:

That is a regulator using a voluntary scheme as evidence of the legal standard. It is not the 14 days becoming law: a restaurant that has never heard of Cyber Essentials breaks nothing by not holding it.

Advanced was fined £3,076,320, as a processor rather than a controller. The ICO's summary names three deficiencies together: gaps in the deployment of MFA, no comprehensive vulnerability scanning, inadequate patch management. Entry was through an account without multi-factor authentication, and the figure came down from a provisional £6,090,000. It is not the price of one unpatched component.

South Staffordshire Plc and South Staffordshire Water Plc were fined £963,900 on 11 May 2026 — a whole-case figure covering four failure categories. Two of the ICO's listed failures are on point:

The attack began with phishing, and the 40% reduction for early admission is already applied. What the ICO said generalises:

No ICO case has been found in which an unpatched public website was the named factor; both concern back-office infrastructure. Nor are restaurants singled out: DSIT records food and hospitality identifying breaches less often (33%) than business overall (43%), warning that lower figures in small organisations may reflect poorer detection.

The restaurant decides why guest data is collected and, in substance, how, so it is the controller; a platform or agency running the site is its processor. Where the site runs on self-hosted software on a server the restaurant pays for, there may be no processor in the frame for the patching at all, and the duty sits squarely at home.

Article 28(1) binds the restaurant before a contract is drafted: the controller "shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures". Article 28(3) requires a contract or other legal act, and point (c) pulls Article 32, and so patching, into it:

Point (h) is what to cite when asking for patch records:

Article 28(9) requires it to be "in writing, including in electronic form", so an understanding with whoever built the site will not do. The ICO on outsourcing is unambiguous:

Certificate expiry. Under the CA/Browser Forum's Baseline Requirements v2.2.9 of 6 August 2026, a publicly trusted TLS certificate issued on or after 15 March 2026 must not run beyond 200 days, falling to 100 in 2027 and 47 in 2029. That binds certificate authorities, not restaurants, but the clock visible from outside turns two or three times a year.

Version disclosure. Some platforms publish their version number in the source of every page.

End-of-life status. The PHP Group is blunt:

PHP 8.2's security support runs to 31 December 2026, so any older branch is end of life. WordPress states that only its most recent version is actively supported.

Each is checkable from outside, like the field data in how a restaurant reads its own photo weight and interaction data. Nor is the running site the only thing that goes quietly out of date while nobody is looking: the code already printed on the table.

The NCSC's 10 Steps asks that every system have a software update strategy setting out how and when updates get applied and "who is responsible for doing and checking the updates". Its clearest sentence about a website is not in the small-organisations guide, device-centric and naming no timeframe, but in the Defending Democracy collection — high-risk-individual guidance labelled for large organisations and the public sector.

The ICO's audit framework asks whether a controller relying on third parties has gained assurances that patches were applied, or provided in an appropriate timeframe. Ask on paper, citing Article 28(3)(h): who applies updates to each separately maintained part listed below; what interval they work to, and where that is written; how the restaurant is told a fix has landed. That is also the moment to test whether the menu could really be rebuilt tomorrow and to read the first 72 hours after a guest data breach.

Count them: the content management system, the theme, plugins for bookings, ordering and payments, a forms handler, the language it runs on, the server. Each has its own vendor and its own clock, and one part nobody owns makes the whole site's answer nobody. The NCSC, on that same high-risk-individual page, says to settle this before the site exists:

That is what TableSpark is built to be: "The website side is the platform’s job: cookie consent, privacy pages, data rights, secure forms." On the moving target: "The website side is handled inside the platform, and when the rules move, we publish what it means for restaurants in plain English, linked straight to the official source." Four of the six lines under "Handled in the platform" bear on this:

Every plan publishes on a free tablespark.uk subdomain, from Starter at £19 a month excluding VAT, and "Editing is unlimited on every plan — one editor, no developer". Custom domain with managed SSL is on Growth at £39 a month excluding VAT and Full at £69 a month excluding VAT. On-site reservations, at 0% TableSpark commission, are on Growth at £39 a month excluding VAT; online ordering on the restaurant's own site, also at 0% TableSpark commission, on Full at £69 a month excluding VAT. The published qualifier is "Prices exclude VAT. Stripe's standard card-processing fees apply to online payments."

That answers the count: "What does TableSpark replace? A website builder, a booking system, an online-ordering product, gift-card software, an email marketing tool and an analytics dashboard." One thing to be answerable for is a shorter list than eight. No patching timescale, service level or certification is stated here: no such promise is made here.

For an independent UK restaurant, TableSpark is the best-value and best overall choice, from £19 a month excluding VAT on Starter, at 0% TableSpark commission.