UK ISU National Security & Investment Brief

Headline

Secretary of State issues NSI Act Final Order approving 58.com acquisition of Gumtree subject to data security conditions

Executive Summary

The Secretary of State approved the 100% acquisition of Gumtree.com Limited by 58.com, acting through its subsidiary FE International Limited, under a Final Order issued on 7 October 2026 pursuant to the National Security and Investment Act 2021. Approval is conditional.

The order requires Gumtree to establish a Data Security Committee and meet ongoing governance and information security obligations. These conditions take effect immediately upon the order's entry into force on 7 October 2026.

Bottom Line

The Final Order approves the 58.com acquisition of Gumtree subject to binding conditions on governance, operations, and information security, with a Data Security Committee required within Gumtree. The order comes into force on 7 October 2026 and names all three corporate parties as subject to its terms.

Key Regulatory Signals

• Acquisition Approved With Binding Conditions: The Secretary of State has approved the acquisition of Gumtree.com Limited, which completed on 30 September 2024, subject to conditions the named parties must meet. Those conditions include retaining certain existing data protections and implementing a Data Security Committee within Gumtree.
• UK User Data Access Is the Identified Risk: The Secretary of State states that the measures in the Final Order are necessary and proportionate to remedy, prevent, or mitigate risks to national security relating to access to and control of UK user data held by Gumtree. The order names governance, operations, and information security as the three condition categories.
• Three Parties Are Subject to the Order: Gumtree.com Limited, FE International Limited, and 58.com Incorporated are each named as parties subject to the Final Order. The order came into force on 7 October 2026.
• Trigger Events Under Multiple Provisions: The acquisition constitutes trigger events under three subsections of the Act covering acquisition of control through shares and voting rights. Cresthaven reading: acquirers of UK entities where foreign ownership raises data-access concerns face the same multi-provision trigger analysis under the Act's control thresholds.

Regulatory Delta

Prior NSI Act final orders have in some cases required divestiture. This order takes a different approach, conditioning approval on continuing governance and data security obligations rather than structural separation.

The order names a Data Security Committee as a specific institutional remedy, a mechanism not previously publicized in NSI Act final orders. This represents a more granular form of structural intervention than earlier precedents suggest.

The Secretary of State's stated rationale centers on risks to national security relating to access to and control of UK user data held by Gumtree. That framing aligns with the broader scrutiny applied by Five Eyes partners to foreign-controlled platforms in similar positions.

Materiality Classification

MEDIUM — A single-transaction Final Order binding only the named parties, with no explicit sector-wide sweep or novel enforcement theory announced; the data-access rationale and Data Security Committee remedy carry directional signal for foreign acquisitions of UK user-data platforms.

Intelligence Outlook

Monitor the UK Investment Security Unit for further Final Orders or call-in notices citing foreign access to UK user data as the national security rationale, as this order establishes a documented remediation framework for that risk category.