Compliance answers, traced to the source

What does DPDP Act compliance require for a business in India?

The DPDP Act 2023 requires businesses in India to comply with several provisions, including:

- Registration of Consent Managers, which will be required starting 13 November 2026 under Rule 4 of the Digital Personal Data Protection Rules, 2025 [1]. Consent Managers must meet specific eligibility criteria set out in Part A of the First Schedule, including being incorporated in India, having a minimum net worth of INR 2 crore, and demonstrating sound financial and operational capacity [3].

- Adherence to data protection principles and practices as outlined in the DPDP Rules 2025, which were notified on 13 November 2025 [2].

- Compliance with penalties for non-compliance, with the maximum penalty for the highest tier of offenses (such as failure to take reasonable security safeguards to prevent a personal data breach) capped at ₹250 crore per instance, effective May 2027 [5].

The exact details of these requirements and their implementation dates should be verified against the official documents and notifications.

What are the DPDP Act penalties for a data breach?

The DPDP Act 2023 caps monetary penalties at up to ₹250 crore per instance for the highest tier (failure to take reasonable security safeguards to prevent a personal data breach), with lower tiers at ₹200 crore, ₹150 crore and below; the Data Protection Board determines penalties on the facts.

Reference: [1]

When do the DPDP Rules take effect and what are the key deadlines?

The DPDP Rules 2025 were notified on 13 November 2025 [1]. Key provisions, including those constituting and empowering the Data Protection Board, became effective on the same day [2]. The breach notification timeline under Rule 7 is effective from May 2027 [3], while the Consent Manager registration framework under Rule 4 will come into force on 13 November 2026 [5].

Who is a Consent Manager under the DPDP Act and what are the requirements?

A Consent Manager is registered with the Data Protection Board of India and acts as a single point of contact through which a Data Principal can give, manage, review and withdraw consent via an accessible, transparent and interoperable platform. The requirements for a Consent Manager include:

- Being incorporated in India.

- Having a minimum net worth of INR 2 crore (adjusted for inflation).

- Maintaining a sound financial condition and general character of management.

- Demonstrating sufficient technical, operational and financial capacity to discharge the role.

- Ensuring that directors, key managerial personnel, and senior management are persons of general reputation and have a record of fairness and integrity. [3]

Additionally, a Consent Manager must not act as a Data Fiduciary or Data Processor for the same Data Principal whose consent it manages, must route personal data in a form it cannot itself read, and must treat all Data Fiduciaries neutrally without preferential access. Consent records must be retained for at least seven years. [2]

What are the rights of a Data Principal under the DPDP Act?

The DPDP Act 2023 outlines several rights for Data Principals, though the specific details are not provided in the given context. To determine the exact rights, refer to section 6(4) of the DPDP Act 2023, which pertains to the manner of exercising rights under this section. Additionally, section 13 covers grievance redressal mechanisms. The notice accompanying or preceding a consent request must inform the Data Principal of these rights [1].

What is the personal data breach notification requirement under the DPDP Rules?

A data fiduciary must intimate the Data Protection Board of a personal data breach without delay on becoming aware, follow with a detailed report within 72 hours (extendable by the Board), and notify affected data principals of the breach in plain language. This is under Rule 7 of the DPDP Rules 2025 [1]. The rule is effective as of May 2027 [1].

What are the data-principal consent requirements under the DPDP Act?

Under the DPDP Act 2023, data principals must receive a notice when giving consent, which must inform them of:

(i) The personal data and the purpose of processing;

(ii) The manner of exercising rights under section 6(4) (withdrawal) and section 13 (grievance redressal);

(iii) The manner of making a complaint to the Data Protection Board.

These notices must be available in English or any Eighth Schedule language. The requirements for these notices will take effect in May 2027. [3]

Additionally, consent requests must be accompanied or preceded by such a notice. For consents given before the commencement of these requirements, the notice must follow as soon as reasonably practicable. [3]

Consent Managers, who act as fiduciaries for data principals, must ensure that personal data is routed in a form they cannot themselves read and must treat all data fiduciaries neutrally without preferential access. They must also retain consent records for at least seven years. [2]

Furthermore, organizations wishing to register as Consent Managers must meet certain eligibility criteria, including being incorporated in India, having a minimum net worth of INR 2 crore (adjusted for inflation), and demonstrating sound financial and operational capacity. [4]

The effective date for these consent requirements is 13 November 2026, when Rule 4 comes into force, establishing the registration and oversight framework for Consent Managers. [1]

What is the penalty structure under the DPDP Act across its tiers?

The penalty structure under the DPDP Act 2023 across its tiers is as follows:

- The highest tier, for failure to take reasonable security safeguards to prevent a personal data breach, has a penalty ceiling of up to ₹250 crore per instance.

- Lower tiers have penalties capped at ₹200 crore, ₹150 crore, and below, respectively; the exact amounts for these tiers are not specified in the context.

- The Data Protection Board determines the specific penalties based on the facts of each case.

- These penalties will come into effect on May 2027.

- The information was last verified on 2026-08-01.

[Cited facts: [1]]

Who is a Significant Data Fiduciary under the DPDP Act?

A Significant Data Fiduciary (SDF) is notified by the Central Government under Section 10 of the DPDP Act 2023 based on factors including the volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential effect on the sovereignty and integrity of India, risk to electoral democracy, and security of the State and public order. [1]

What is the age of consent for processing children data under the DPDP Act?

The age of consent for processing children's data under the DPDP Act 2023 is a person who has not completed 18 years of age. This is specified in Section 9 of the DPDP Act 2023 [1].

What are the consent requirements under the DPDP Act?

Under the DPDP Act 2023, consent to process personal data must be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action, and limited to the personal data necessary for the specified purpose. A Data Principal may withdraw consent at any time, and withdrawing it must be as easy as giving it. Every request for consent must be accompanied or preceded by a notice, in clear and plain language, that gives an itemised description of the personal data and the purpose of processing, the manner in which the Data Principal may exercise their rights and withdraw consent, and the manner of making a complaint to the Data Protection Board. [1]

What is the personal data breach notification timeline under the DPDP Rules?

Under the DPDP Rules 2025, Rule 7, a data fiduciary must intimate the Data Protection Board of India without delay upon becoming aware of a personal data breach. A detailed report must be submitted within 72 hours (this timeline is extendable by the Board). [1][2]

What are the RBI cyber security requirements for banks?

RBI's cyber security requirements for banks include:

1. Reporting cyber incidents to RBI within 2 to 6 hours of detection, along with a board-approved cyber security policy, SOC capability, and cyber crisis management plans. This requirement is detailed in the RBI (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, which on 31 July 2026 repealed and replaced the 2016 Cyber Security Framework in Banks and the 2023 IT Governance Master Direction, effective immediately [1].

2. The 2026 Directions add board oversight via an IT Strategy Committee, an independent CISO, a mandatory 24x7 Cyber Security Operations Centre, VA at least six-monthly and PT at least annually for critical systems, and six-hour incident reporting to RBI on the DAKSH platform [5].

What is a System Audit Report (SAR) for payment aggregators?

A System Audit Report (SAR) for payment aggregators requires an authorisation and a System Audit Report conducted by a CERT-In empanelled auditor, as mandated by the RBI Payment Aggregator (PA-PG) Guidelines [2].

What are the RBI data localisation (storage of payment data) requirements?

RBI requires payment system providers to store the entire data relating to their payment systems only in India, with compliance by October 2018. This includes end-to-end transaction data. [1]

What are the RBI minimum security standards for digital payment channels?

The RBI minimum security standards for digital payment channels, including internet banking, mobile payments, and card payments, are detailed in the Digital Payment Security Controls Master Direction issued on 18 February 2021 [1]. These standards are binding on scheduled commercial banks, small finance banks, payments banks, and card-issuing non-banking financial companies (NBFCs).

What is the RBI IT governance and outsourcing requirement for regulated entities?

Regulated entities must adhere to the following RBI IT governance and outsourcing requirements:

1. **IT Governance**: An IT governance framework, information/cyber security policies, and periodic IT risk assurance are required. As of 31 July 2026 these are set by the RBI (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, which repealed and replaced the November 2023 Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (RBI/DoS/2023-24/107), effective immediately with no transition window [1].

2. **IT Outsourcing**: Material IT outsourcing by regulated entities must be governed, including vendor risk, audit rights, and concentration risk. This became effective on 1 October 2023, as per the Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102) [2].

What is the SAR (System Audit Report) submission requirement for payment aggregators?

The SAR (System Audit Report) submission requirement for payment aggregators is that they must obtain a System Audit Report by a CERT-In empanelled auditor as mandated by the RBI Payment Aggregator (PA-PG) Guidelines [4]. However, the specific submission deadline is not detailed in the provided context. For precise submission timing, refer to the relevant RBI guidelines directly.

What is the RBI data localisation requirement for payment system data?

The RBI data localisation requirement for payment system data mandates that all system providers ensure the entire data relating to the payment systems they operate is stored in a system only in India. This includes full end-to-end transaction details and any information collected, carried, or processed as part of the payment message or instruction. Compliance was required within six months of the circular's issuance, which was on 6 April 2018, with submission of a System Audit Report conducted by a CERT-In empanelled auditor. This applies to all Payment System Providers authorised under the Payment and Settlement Systems Act, 2007.

Sources: [1], [2]

What are the RBI Payment Aggregator Directions 2025 net-worth requirements?

A non-bank entity carrying on payment-aggregator business must obtain RBI authorisation and must have a minimum net worth of INR 15 crore at the time of application, rising to a minimum net worth of INR 25 crore by the end of the third financial year after authorisation, maintained thereafter. [1]

What is the RBI Master Direction on Digital Payment Security Controls?

The RBI Master Direction on Digital Payment Security Controls (RBI/2020-21/74, DoS.CO.CSITE.SEC.No.1852/31.01.015/2020-21), dated 18 February 2021, sets out a robust governance structure and common minimum standards of security controls for digital payment products and services. It covers areas such as internet banking, mobile banking, and card payments, along with customer protection and grievance redressal. It applies to Scheduled Commercial Banks (excluding Regional Rural Banks), Small Finance Banks, Payments Banks, and credit-card-issuing NBFCs, and took effect within six months of being placed on the RBI website. [1]

What is the Sarbanes-Oxley Act (SOX)?

The Sarbanes-Oxley Act of 2002 (SOX) is a U.S. federal law enacted on 30 July 2002, which reformed corporate financial reporting and auditing. It created the Public Company Accounting Oversight Board (PCAOB) and is enforced primarily by the U.S. Securities and Exchange Commission. The act applies to U.S. public companies and their auditors. Key provisions include:

- Section 302 requires senior executives to personally certify the accuracy of financial statements.

- Section 404 requires management, and the external auditor, to assess and report on the effectiveness of internal control over financial reporting.

Reference: [1]

What is the RBI Cyber Security Framework for banks?

The RBI Cyber Security Framework for banks, issued on 2 June 2016, requires scheduled commercial banks to put in place a board-approved cyber-security policy distinct from their IT or IS-security policy, to implement a baseline cyber-security and resilience framework, and to arrange continuous surveillance (for example through a Security Operations Centre). It also mandates the maintenance of a Cyber Crisis Management Plan and the reporting of all cyber-security incidents, whether successful or attempted, to the RBI. The framework requires banks to report cyber incidents to the RBI within 2 to 6 hours of detection. [1][2][5]

What is the RBI IT Governance Risk Controls and Assurance Master Direction 2023?

The RBI IT Governance, Risk, Controls and Assurance Master Direction 2023 (effective 1 April 2024) was a consolidated direction, but it is no longer in force: on 31 July 2026 it was repealed, together with the 2016 Cyber Security Framework, and replaced by the entity-specific RBI (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026. It applies to regulated entities including scheduled commercial banks (excluding RRBs), small finance banks, payments banks, NBFCs in the specified layers, credit information companies, and all-India financial institutions (NABARD, EXIM Bank, NHB, SIDBI, NaBFID). The direction mandates a board-level IT governance framework covering strategic alignment, risk management, resource and performance management, and business continuity and disaster recovery, alongside an IT and information-security risk management framework and periodic information systems audits.

Source: [1], [2]

What is the RBI Account Aggregator framework?

The RBI Account Aggregator framework, governed by the Master Direction - Non-Banking Financial Company - Account Aggregator (Reserve Bank) Directions, 2016 ([1]), allows NBFC-Account Aggregators to retrieve and consolidate a customer's financial information from multiple financial information providers and share it with financial information users only with the customer's explicit consent. These Aggregators must be registered with the RBI and hold a net owned fund of at least two crore rupees. The framework ensures that no financial information can be retrieved, shared, or transferred without explicit, standardised consent, and the Account Aggregators act solely as data intermediaries without storing, using, or transacting on the data. This framework was issued and enforced by the RBI on 2 September 2016.

What is SEBI CSCRF and who must comply with it?

SEBI CSCRF stands for the Cybersecurity and Cyber Resilience Framework issued by the Securities and Exchange Board of India (SEBI). It mandates various cybersecurity practices and compliance requirements for regulated entities under SEBI's purview. Specifically, all entities regulated by SEBI, except Market Infrastructure Institutions (MIIs), KYC Registration Agencies (KRAs), and Qualified Registrars to an Issue and Share Transfer Agents (QRTAs), must comply with this framework. The compliance timeline was initially set to be fully in force by 31 August 2025, but due to extensions, it is now fully effective as of 31 August 2025. [2]

Which entities must comply with the SEBI CSCRF and what are the categories?

All regulated entities under SEBI must comply with the Cybersecurity and Cyber Resilience Framework (CSCRF) as per [1] and [2]. These entities are categorized into five groups:

1. Market Infrastructure Institutions (MIIs)

2. Qualified Registered Entities (Qualified REs)

3. Mid-size Registered Entities (Mid-size REs)

4. Small-size Registered Entities (Small-size REs)

5. Self-certification Registered Entities (Self-certification REs)

Portfolio Managers and Merchant Bankers were re-categorized by circular 2025/119 of 28 August 2025 ([2]).

What is the audit and reporting requirement under the SEBI CSCRF?

Audits must be conducted by a CERT-In empanelled organisation, as stated in the SEBI CSCRF framework. The VAPT report must be submitted within one month of completing the VAPT activity, after approval from the RE's IT Committee. Findings must be closed within three months of report submission, following a graded approach based on the criticality of the observations. Revalidation of the VAPT must be completed within five months of its completion. These requirements are effective from 20 August 2024. [1][4]

What is the effective date of the SEBI CSCRF for different entity categories?

The effective date of the SEBI CSCRF is 20 August 2024, with compliance timelines extended to 31 August 2025 due to circulars [1]. The framework applies proportionately by category starting from this date, as detailed in circular [2].

What are AUA and KUA under the Aadhaar ecosystem?

AUA and KUA refer to Authentication User Agencies and KYC User Agencies under the Aadhaar ecosystem. These agencies must have their operations audited annually (and on need) by a certified information systems auditor as per the Aadhaar (Authentication and Offline Verification) Regulations, 2021, together with the Aadhaar (Data Security) Regulations, 2016, and the UIDAI Information Security Policy. [1][5]

What is a UIDAI AUA/KUA security audit and who must undergo it?

A UIDAI AUA/KUA security audit is an annual (and on need) audit of the operations of Authentication User Agencies (AUAs) and eKYC User Agencies (KUAs) by a certified information systems auditor. The audit ensures compliance with the Aadhaar (Authentication and Offline Verification) Regulations, 2021, the Aadhaar (Data Security) Regulations, 2016, and the UIDAI Information Security Policy. AUAs and KUAs must have the results of these audits shared with UIDAI upon request.

This requirement applies to AUAs and KUAs in the Aadhaar ecosystem [1, 3].

What is CKYC and what does CKYC compliance require?

CKYC stands for Central Know Your Customer (KYC) framework, which is operated by CERSAI (Central Registry of Securitisation Asset Reconstruction and Security Interest of India) under the guidelines set by the Reserve Bank of India (RBI). CKYC compliance requires regulated entities to upload KYC records of their customers into the Central KYC Records Registry (CKYCR) within 10 days of establishing an account-based relationship with the customer [3]. The KYC records must be submitted using CERSAI templates, which can change over time [4]. Additionally, customers can provide consent to have their KYC records retrieved from the CKYCR using a KYC Identifier [5]. The applicability of CKYC was phased between 2016 and 2021, with different timelines for Scheduled Commercial Banks and other regulated entities [1].

How often must a UIDAI AUA/KUA security audit be performed?

A UIDAI AUA/KUA security audit must be performed annually and on demand. [1]

What is CKYC and what is the CERSAI/CKYC registry requirement?

CKYC stands for Central KYC (Know Your Customer) Records, which is managed through the Central KYC Records Registry (CKYCR) operated by CERSAI (Central Registry of Securitisation Asset Reconstruction and Security Interest of India) [1]. The CKYC registry requirement mandates that regulated entities capture and upload customer KYC records into the CKYCR within 10 days of establishing an account-based relationship with the customer [3]. This applies to both individuals and legal entities, with the requirement for legal entities being phased in, starting from 1 April 2021 [5].

What are the UIDAI data security regulations that AUA/KUA must follow?

AUA/KUA must follow the UIDAI (Aadhaar) Data Security Regulations, 2016 [1].

What are the NPCI and UPI security requirements?

The NPCI and UPI security requirements include:

1. Volume-cap compliance for Third-Party Application Providers (TPAPs), with a deadline of 31 December 2026, as per NPCI's volume-cap guidelines for UPI (referencing circular NPCI/UPI/OC-97/2020-21).

2. Audit and compliance obligations on TPAPs, including audits by CERT-In empanelled auditors and UPI data storage within India, as detailed in NPCI's Guidelines for Third-Party Application Providers in UPI (circular OC 97, 2020).

These requirements are effective as of their respective deadlines and are enforced through various circulars and guidelines issued by NPCI.

What are the NPCI and UPI security and audit requirements?

NPCI and UPI security and audit requirements include:

1. **Audit Obligations**: TPAPs must undergo audits conducted by CERT-In empanelled auditors. These audits are part of the TPAP guidelines (OC 97, 2020) which impose audit and compliance obligations on TPAPs. ([1])

2. **Data Storage**: UPI data must be stored within India. PSP banks retain audit rights over TPAP UPI infrastructure. ([1])

3. **Volume-Cap Compliance**: Existing TPAPs exceeding the volume-cap must comply by 31 December 2026, following a two-year extension from the original deadline of 31 December 2024. ([2])

4. **API Usage Monitoring**: PSPs and acquiring banks must monitor and control API usage as per NPCI's Guidelines on usage of UPI APIs (OC 215 series, May 2025), with non-compliance potentially leading to API restrictions, penalties, or suspension of new customer onboarding. ([2])

5. **Security Audits**: Pre-go-live and periodic security audits are required for TPAPs, PSP banks, aggregators, and fintechs across various payment systems including UPI, IMPS, RuPay, NACH, AePS, and NETC. ([4])

These requirements ensure compliance and security standards are met in the UPI ecosystem. ([1][2][4])

What is ISNP and who needs ISNP certification?

ISNP stands for Insurance Self Network Platform [2]. It is subject to an IRDAI-mandated security audit requirement [1, 3, 4]. Specifically, Insurance Self-Network Platforms operating under IRDAI permission must undergo an annual ISNP security audit, which involves controls assessment, gap closure, and audit readiness [1, 4]. This requirement applies to insurance companies, brokers, web aggregators, and technology providers that deal with the ISNP [3].

The ISNP security audit must be conducted by an external Certified Information Systems Auditor (CISA), a Chartered Accountant holding DISA (ICAI), or a CERT-In empanelled expert [4]. The resulting report should be presented to the Board or its sub-committee [4].

What are the IRDAI cyber security requirements for insurers?

The IRDAI cyber security requirements for insurers, as per the Information and Cyber Security Guidelines, 2026 [1], include:

- All Insurers, including Foreign Re-Insurance Branches (FRBs) and Insurance Intermediaries regulated by IRDAI, must comply with these guidelines.

- Insurers are responsible for ensuring that Insurance Agents, Micro-Insurance Agents, Point of Sale Persons, and Individual Surveyors follow a minimum security framework under the Insurer’s Board-approved policy, even though these entities are expressly outside the purview of the guidelines themselves.

These guidelines became effective on 6 April 2026 [1].

What are the IRDAI information and cyber security requirements for insurers?

The IRDAI Information and Cyber Security Guidelines, 2026 (Version 2.0) outline the requirements for insurers. These guidelines apply to all Insurers, including Foreign Re-Insurance Branches (FRBs) and Insurance Intermediaries regulated by IRDAI, and cover all data created, received, or maintained by Regulated Entities in any form. Insurers are responsible for ensuring that Insurance Agents, Micro-Insurance Agents, Point of Sale Persons, and Individual Surveyors follow a minimum security framework under the Insurer’s Board-approved policy. The guidelines were effective from 6 April 2026, replacing the 2023 version. [1][5]

What is CERT-In empanelment and why does it matter for VAPT?

CERT-In empanelment refers to the process where cybersecurity firms and professionals are evaluated and certified by the Computer Emergency Response Team - India (CERT-In) to ensure they meet certain standards and criteria for handling cybersecurity services. This empanelment is crucial for Value Added Penetration Testing (VAPT) because:

- Regulators and enterprises increasingly require CERT-In empanelment to ensure the quality and reliability of cybersecurity services. [2]

- CERT-In empanelment ensures that VAPT partners adhere to specific standards and methodologies, enhancing the trustworthiness of the services provided. [3]

Thus, choosing a CERT-In empanelled VAPT partner is important for ensuring compliance and the quality of the security assessments conducted. [2]

What is the CERT-In 6-hour incident reporting requirement?

The CERT-In 6-hour incident reporting requirement states that specified cyber incidents must be reported to CERT-In within 6 hours of noticing. This requirement is effective as of 28 June 2022 and applies to service providers, intermediaries, data centres, body corporates, and government organisations. [1][4]

What logs must be retained under the CERT-In directions?

ICT system logs must be maintained for a rolling 180 days, within Indian jurisdiction. [1]

What logs must be retained and for how long under the CERT-In directions?

ICT system logs must be maintained for a rolling 180 days, within Indian jurisdiction. [1]

What records must VPN and cloud providers retain under the CERT-In directions?

VPN and cloud providers must register and retain accurate subscriber/customer records for 5 years after cancellation or withdrawal of service. [1]

What is CMMI and what is new in CMMI v3.0?

CMMI (Capability Maturity Model Integration) is a framework designed to help organizations improve their processes and achieve better outcomes. CMMI V3.0 introduces updates to the model, including the eight domains, Maturity Levels 1–5, and all 31 Practice Areas. The updated version provides a comprehensive guide covering the appraisal lifecycle, CMMI AIM, and other relevant aspects of the model. [1]

What is PCI DSS and who must comply with it?

PCI DSS stands for Payment Card Industry Data Security Standard. It is a set of requirements designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. Compliance with PCI DSS is mandatory for QSAs [1], and entities that handle cardholder data, such as e-commerce merchants [2, 4], must adhere to its standards. The standard provides a framework for protecting cardholder data and includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures.

What changed in PCI DSS v4.0.1?

The context indicates that PCI DSS v4.0.1 was published on 11 June 2024 and is a limited revision with no new requirements added or removed compared to v4.0. Therefore, there were no changes in requirements between v4.0 and v4.0.1. [1]

What is the PCI DSS v4.0.1 effective date and what are the key deadlines?

The PCI DSS v4.0.1 effective date is 31 March 2025. Key deadlines include:

- Future-dated v4.x requirements becoming mandatory in assessments from 31 March 2025 [1].

The last-verified date for this information is 2026-08-01.

When did the future-dated PCI DSS v4.0 requirements become mandatory?

The future-dated PCI DSS v4.0 requirements became mandatory in assessments from 31 March 2025. [1]

What are the PCI DSS merchant levels?

PCI DSS merchant levels are classified by Visa into four levels based on annual transaction volume:

- Level 1: More than 6 million Visa transactions per year across all channels (or any merchant designated Level 1 by Visa, e.g., after a compromise) - annual on-site assessment and Report on Compliance (ROC) plus quarterly network scan. [2]

- Level 2: 1 to 6 million transactions per year - annual Self-Assessment Questionnaire (SAQ) and quarterly scan. [2]

- Level 3: 20,000 to 1 million Visa e-commerce transactions per year - SAQ and quarterly scan. [2]

- Level 4: Fewer than 20,000 Visa e-commerce transactions, or up to 1 million total transactions per year - SAQ and scan as required by the acquirer. [2]

Other card brands set broadly similar but not identical thresholds; the acquirer confirms a merchant's level. [2]

What are the PCI DSS SAQ types and when is a ROC required instead?

PCI DSS defines nine SAQ types, each scoped to how a merchant handles cardholder data:

- SAQ A (fully outsourced e-commerce or mail/telephone order, no data handling)

- SAQ A-EP (e-commerce that partially controls the payment page)

- SAQ B (imprint machines or standalone dial-out terminals, no electronic storage)

- SAQ B-IP (standalone PTS-approved IP-connected terminals)

- SAQ C-VT (web-based virtual terminal, one transaction at a time)

- SAQ C (payment application connected to the internet)

- SAQ P2PE (hardware terminals in a validated PCI P2PE solution)

- SAQ D for Merchants (all others that store, process or transmit cardholder data - the most comprehensive)

- SAQ D for Service Providers (applies to service providers)

A merchant who cannot meet an SAQ's eligibility criteria, or who is a Level 1 merchant, completes a full Report on Compliance (ROC) instead of an SAQ [1].

What are the 12 requirements of PCI DSS?

The 12 requirements of PCI DSS are:

1. Build and maintain a secure network.

2. Build and maintain secure systems and applications.

3. Protect cardholder data.

4. Encrypt cardholder data during transmission over open, public networks.

5. Develop and maintain secure systems and applications.

6. Maintain a vulnerability management program.

7. Implement strong access control measures.

8. Regularly monitor and test networks.

9. Maintain a policy that addresses information security for employees and contractors.

10. Track and monitor all access to network resources and cardholder data.

11. Regularly test security systems and processes.

12. Maintain a written information security policy.

These requirements are structured under six goals as outlined in PCI DSS v4.0.1, which was published in June 2024. [1]

What is PCI PIN Security?

PCI PIN Security is a standard from the PCI Security Standards Council governing the secure management, processing, and transmission of personal identification number (PIN) data during payment card transactions at ATMs and point-of-sale terminals. It applies to acquirers, processors, and their agents that handle PIN-based transactions and cryptographic key management. The requirements are grouped into control objectives covering secure equipment and key management, PIN encryption, and the generation, distribution, and destruction of cryptographic keys. [1]

What is PCI Point-to-Point Encryption (P2PE)?

PCI Point-to-Point Encryption (P2PE) is a standard defined by the PCI Security Standards Council. It specifies requirements for solutions that cryptographically protect account data from the point of capture at a merchant device until it reaches a secure decryption environment. This standard applies to P2PE solution providers, component providers, and merchants using PCI-listed P2PE solutions. A validated P2PE solution can significantly reduce a merchant's applicable PCI DSS scope. The requirements encompass secure devices, secure applications, encryption and decryption environments, and cryptographic key operations. [1]

What is the PCI 3DS Core Security Standard?

The PCI 3DS Core Security Standard, from the PCI Security Standards Council, defines physical and logical security requirements for environments where EMV 3-D Secure functions such as the Access Control Server (ACS), Directory Server (DS) and 3DS Server (3DSS) are performed. It applies to entities performing these 3DS functions and is separate and independent from PCI DSS. It is structured in two parts: baseline security requirements for the environment, and 3DS-specific requirements protecting 3DS data, technologies and processes that support card-not-present authentication. [1]

What is the PCI Software Security Framework?

The PCI Software Security Framework (SSF) is a collection of standards and validation programmes from the PCI Security Standards Council that promotes security in payment software and replaced PA-DSS. It comprises two standards: the Secure Software Standard, which assesses payment-software products, and the Secure Software Lifecycle (Secure SLC) Standard, which assesses a vendor's ongoing secure-development processes. It applies to payment-software vendors and their products; PA-DSS was formally retired at the end of October 2022, after which the SSF became the applicable framework. [1]

What is OWASP ASVS?

OWASP ASVS (Application Security Verification Standard) is a framework for assessing the security of web applications and APIs. It consists of 345 verification requirements organized into 17 chapters (V1-V17), effective from May 2025 [2][3]. The requirements are categorized into three verification levels (L1-L3), with Level 1 containing 70 requirements, Level 2 containing 183, and Level 3 containing 92 [4]. Each application verified at a higher level is expected to satisfy the requirements of the lower levels as well [4]. The latest version is v5.0.0, which includes substantial restructuring compared to previous versions [1].

What are the three levels of the OWASP Application Security Verification Standard (ASVS)?

The three levels of the OWASP Application Security Verification Standard (ASVS) are Level 1, Level 2, and Level 3. [1] [2]

What is ISO 27001 certification and what does it involve?

ISO 27001 certification involves establishing, implementing, maintaining, and continually improving an information security management system (ISMS) according to the requirements specified in the ISO/IEC 27001 standard [2]. This standard, published in October 2022 as the third edition, is titled "Information security, cybersecurity and privacy protection — Information security management systems — Requirements" [2]. The certification process ensures that an organization has a robust framework for managing information security risks effectively [5].

What is the ISO 27001:2022 transition deadline for existing certificates?

The ISO 27001:2022 transition deadline for existing certificates is 31 October 2025. This is the end of the IAF three-year transition window for ISO/IEC 27001:2013 certificates. Certificates not transitioned to the 2022 revision by this date will lapse. [1]

How many controls are in ISO 27001:2022 Annex A and what are the four themes?

ISO 27001:2022 Annex A contains 93 controls organised into four themes:

- Organisational (37 controls, clause 5)

- People (8 controls, clause 6)

- Physical (14 controls, clause 7)

- Technological (34 controls, clause 8)

These numbers reflect a restructuring from the 2013 edition, where the count fell through consolidation and merging rather than a reduction in scope. [1]

What is a Statement of Applicability in ISO 27001?

A Statement of Applicability (SoA) in ISO 27001 is a document that must be produced as part of the organization's information-security risk-treatment process. According to ISO/IEC 27001:2022 clause 6.1.3(d), the SoA must include the necessary controls (whether from Annex A or elsewhere), the justification for their inclusion, whether each necessary control is implemented, and the justification for excluding any of the Annex A controls. The SoA is a mandatory, auditable document that serves as the reference point for auditors to confirm that all applicable controls are addressed. [1]

What is ISO/IEC 27002 and how does it relate to ISO 27001?

ISO/IEC 27002 is an international standard from ISO and IEC that provides a reference set of information security controls with detailed implementation guidance. It is a companion to ISO/IEC 27001 and is not certifiable on its own; organizations use it to implement the controls selected in an ISO/IEC 27001 Information Security Management System (ISMS). [1]

The 2022 edition of ISO/IEC 27002 reorganizes the controls into the same four themes as ISO/IEC 27001:2022 Annex A—organizational, people, physical, and technological—and covers 93 controls. [1]

ISO/IEC 27001 Annex A contains 93 controls organized into these four themes, which aligns with the controls provided in ISO/IEC 27002. [2]

What is ISO/IEC 27701 (PIMS)?

ISO/IEC 27701 is an international standard from ISO and IEC that specifies requirements and guidance for a Privacy Information Management System (PIMS). It applies to organizations acting as PII controllers and PII processors and adds privacy-specific requirements and controls on top of an information security management system. [1]

What is ISO/IEC 27017 for cloud security?

ISO/IEC 27017 is an international standard from ISO and IEC providing a code of practice for information security controls for cloud services, based on ISO/IEC 27002. It gives cloud-specific implementation guidance for both cloud service providers and cloud service customers and adds cloud-specific controls covering shared roles and responsibilities, return or removal of customer assets, segregation in virtual environments, and administrative operations. [1]

What is ISO/IEC 27018 for PII in the cloud?

ISO/IEC 27018 is an international standard from ISO and IEC establishing controls to protect personally identifiable information (PII) in public cloud computing environments where the cloud provider acts as a PII processor. It applies to public cloud service providers that process PII on behalf of their customers and builds on ISO/IEC 27002, addressing consent, transparency, restrictions on use, disclosure and cross-border handling of cloud-processed PII, and accountability. [1]

What is the CSA Cloud Controls Matrix and STAR?

The CSA Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing published by the Cloud Security Alliance (CSA), organised into 17 domains of cloud security and privacy controls and mapped to leading standards and regulations. It defines responsibilities between cloud service providers and customers and is used to assess cloud security posture. Together with the Consensus Assessments Initiative Questionnaire (CAIQ), the CCM is the basis for CSA's Security, Trust, Assurance and Risk (STAR) programme and its public registry of provider self-assessments and third-party certifications. [1][2][3]

What is FedRAMP?

FedRAMP (Federal Risk and Authorization Management Program) is a U.S. government-wide programme providing a standardised approach to security assessment, authorisation and continuous monitoring for cloud products and services, based on NIST SP 800-53 controls. It is operated by the General Services Administration and maintains a marketplace of authorised cloud services, authorising agencies and recognised third-party assessment organisations. Cloud service providers must obtain a FedRAMP authorisation (Low, Moderate or High baseline) to sell cloud services to U.S. federal agencies. [1]

What is StateRAMP or GovRAMP?

StateRAMP or GovRAMP is a non-profit programme that standardises cloud security verification for state, local, tribal, and education (SLTT) government entities. It was rebranded from StateRAMP to GovRAMP in 2025 to reflect a broader whole-of-state mission. The programme is built on NIST SP 800-53 control baselines and operates on a complete-once, use-many model, allowing a provider to be authorised once and reused across participating jurisdictions. Verification levels scale by control count. It applies to cloud service providers selling to participating government entities and to the governments requiring independent security validation. [1][2]

What is the difference between SOC 2 Type I and Type II?

The difference between SOC 2 Type I and Type II is explained in [2] and [4]. Type I provides an assessment of controls at a specific point in time, while Type II offers a more comprehensive view over a specified period, typically six months. Both types evaluate controls related to security, availability, confidentiality, processing integrity, and privacy, but Type II includes the results of ongoing testing and monitoring.

What are the five SOC 2 Trust Services Criteria?

The five SOC 2 Trust Services Criteria are Security, Availability, Processing Integrity, Confidentiality, and Privacy. [1]

What is a SOC 1 report?

A SOC 1 report is a reporting framework governed by the AICPA under attestation standard SSAE 18 (AT-C section 320), examining the controls at a service organisation that are relevant to its user entities' internal control over financial reporting (ICFR). The report can be a Type 1 (design of controls at a point in time) or Type 2 (design and operating effectiveness over a period) and is used by user entities and their financial-statement auditors. [1]

What is the ISO 22301 standard and what does it require?

ISO 22301:2019 is a standard for business continuity management systems, published on 30 October 2019, replacing the 2012 first edition. It does not specify detailed requirements but provides a framework for organizations to establish, implement, maintain, and continually improve their business continuity management systems. The amendment ISO 22301:2019/Amd 1:2024, published in February 2024, adds considerations for climate change to the management system requirements, though these amendments supplement the original standard rather than replace it. [1][2]

What is ISO/IEC 20000-1 for IT service management?

ISO/IEC 20000-1 is an international standard jointly published by ISO and IEC that specifies requirements to establish, implement, maintain and continually improve a service management system (SMS) for the planning, design, transition, delivery and improvement of services. It applies to any organisation delivering services, regardless of type or size, and is the only part of the ISO/IEC 20000 family to which an organisation can be certified. [1]

What is ISO 9001 for quality management?

ISO 9001 is the international standard published by ISO specifying requirements for a quality management system (QMS). It applies to organisations of any size and sector that need to consistently provide products and services meeting customer and applicable regulatory requirements and to enhance customer satisfaction. Its requirements are structured around context of the organisation, leadership, planning, support, operation, performance evaluation and improvement (Plan-Do-Check-Act). [1]

What is ISO/IEC 27005 for information security risk?

ISO/IEC 27005 is a framework that provides guidance on managing information security risks. It supports the establishment and operation of information security risk management within an ISO/IEC 27001 ISMS. The standard applies to organizations of all types and sizes, offering a structured approach for identifying, analyzing, evaluating, and treating information security risks, aligned with ISO/IEC 27001:2022 and ISO 31000:2018. [1]

What is ISO 31000 risk management?

ISO 31000 is an international standard published by ISO that provides principles, a framework, and a process for managing risk of any type faced by an organisation. It centres on creating and protecting value and describes a risk management process including scope and context establishment, risk assessment (identification, analysis, evaluation), risk treatment, monitoring, and communication. [1]

What is ISO 42001 and what does an AI management system require?

ISO 42001 is the first AI management system (AIMS) standard, published in December 2023 by ISO/IEC, which specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system. However, the specific requirements and clauses of ISO 42001 are not detailed in the provided context [1]. For more detailed information on what an AI management system requires, including mapping to the EU AI Act and NIST AI RMF, refer to the resource provided [4].

What is ISO/IEC 42001 for AI management systems?

ISO/IEC 42001:2023 is the first certifiable international standard for an Artificial Intelligence Management System (AIMS), published in December 2023. It specifies requirements for establishing, implementing, maintaining and continually improving an AIMS, so that an organisation developing, providing or using AI does so responsibly. [1]

What is the NIST Cybersecurity Framework?

The NIST Cybersecurity Framework (CSF) 2.0, released on 26 February 2024, is organised around six Functions: GOVERN (GV), IDENTIFY (ID), PROTECT (PR), DETECT (DE), RESPOND (RS), and RECOVER (RC) [3]. It defines four Tiers of risk governance rigor: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3), and Adaptive (Tier 4) [2]. The framework provides a taxonomy of high-level cybersecurity outcomes without prescribing specific methods for achieving these outcomes [4]. It is designed to be applicable to organizations of various sizes, sectors, and maturity levels [4]. The GOVERN function is new in version 2.0 and focuses on establishing and monitoring cybersecurity risk management strategies [3].

What are the five functions of the NIST Cybersecurity Framework?

The five functions of the NIST Cybersecurity Framework are GOVERN (GV), IDENTIFY (ID), PROTECT (PR), DETECT (DE), and RESPOND (RS). GOVERN is new in version 2.0 and covers how an organisation establishes and monitors its cybersecurity risk management strategy, expectations, and policy. [1]

What are the maximum administrative fines under GDPR Article 83?

The maximum administrative fines under GDPR Article 83 are:

- Up to EUR 10 million, or up to 2% of total worldwide annual turnover of the preceding financial year - for breaches of obligations such as security of processing, records of processing, and data protection by design and by default.

- Up to EUR 20 million, or up to 4% of total worldwide annual turnover - for breaches of the basic principles for processing (including conditions for consent), data subjects' rights, and the rules on transfers to third countries.

Fines must be effective, proportionate, and dissuasive. [1][2]

What are the six functions of the NIST Cybersecurity Framework 2.0?

The six functions of the NIST Cybersecurity Framework 2.0 are:

- GOVERN (GV) - establishing and monitoring the organization's cybersecurity risk management strategy, expectations, and policy.

- IDENTIFY (ID)

- PROTECT (PR)

- DETECT (DE)

- RESPOND (RS)

- RECOVER (RC)

These functions are intended to be performed concurrently and continuously. [2][5]

What is NIST SP 800-53?

NIST SP 800-53 is a U.S. National Institute of Standards and Technology publication providing a comprehensive catalog of security and privacy controls for information systems and organizations. It supports U.S. federal agencies (and is widely used by others) in protecting operations, assets, and individuals from a broad range of threats and privacy risks. Revision 5 consolidates security and privacy controls into a single catalog, makes them outcome-based and control-organisation-neutral, and groups them into 20 control families. [1]

What is NIST SP 800-171 and CUI?

NIST SP 800-171 is a U.S. National Institute of Standards and Technology publication that provides recommended security requirements for protecting the confidentiality of Controlled Unclassified Information (CUI) when it resides in nonfederal systems and organizations. It applies to contractors, universities, and other nonfederal entities that process, store, or transmit CUI on behalf of U.S. federal agencies. [1]

What is the NIST Privacy Framework?

The NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management (Version 1.0) is a voluntary framework from the U.S. National Institute of Standards and Technology to help organisations identify and manage privacy risk. It is organised into five functions (Identify-P, Govern-P, Control-P, Communicate-P and Protect-P) subdivided into categories and subcategories, and is designed to align structurally with the NIST Cybersecurity Framework. It is technology-, sector- and law-agnostic and can be used by organisations of any size. [1]

What is NIST SP 800-207 Zero Trust Architecture?

NIST SP 800-207, Zero Trust Architecture, is a U.S. NIST publication defining zero trust concepts and an abstract model of components, deployment scenarios, and use cases for enterprises adopting zero trust. It describes zero trust as moving defenses from static network perimeters to focus on users, assets, and resources, with access decisions made per session based on policy and continuous verification. It is aimed at enterprise network architects and is a widely referenced federal baseline for zero-trust guidance. [1]

What are the CIS Critical Security Controls v8?

The CIS Critical Security Controls v8 are a prioritised set of cybersecurity best practices published and maintained by the Center for Internet Security (CIS). This version consolidates the guidance into 18 top-level Controls containing 153 Safeguards, organised into three Implementation Groups (IG1 to IG3) scaled to an organisation's risk and resources. They apply to organisations of any size and are mapped to other frameworks such as the NIST Cybersecurity Framework. [1]

What is the HITRUST CSF?

The HITRUST CSF is a certifiable security and privacy control framework created and maintained by HITRUST. It harmonises and maps to more than 60 authoritative sources—such as ISO 27001, the NIST publications, HIPAA, and PCI DSS—into a single control library. Originally focused on healthcare, it is applicable across sectors and risk levels. Organisations can achieve HITRUST certification (e1, i1, or r2) through validated assessments performed with an authorised external assessor. [1]

What is UK Cyber Essentials?

UK Cyber Essentials is a UK government-backed minimum standard of cyber security for organizations of all sizes, developed by the National Cyber Security Centre (NCSC) and delivered through IASME as the official partner. It certifies organizations against five technical controls: firewalls, secure configuration, security update management, user access control, and malware protection. [1]

What is the Australian Essential Eight?

The Australian Essential Eight is a set of prioritised baseline mitigation strategies published by the Australian Signals Directorate Australian Cyber Security Centre (ASD ACSC). The eight strategies are:

1. Patch applications

2. Patch operating systems

3. Multi-factor authentication

4. Restrict administrative privileges

5. Application control

6. Restrict Microsoft Office macros

7. User application hardening

8. Regular backups

It is supported by the Essential Eight Maturity Model, which defines Maturity Levels Zero to Three; organisations are advised to reach the same maturity level across all eight strategies before progressing to a higher level. [1] [3] [4]

What is COBIT 2019?

COBIT 2019 is ISACA's framework for the governance and management of enterprise information and technology, and the successor to COBIT 5. It is built around six governance principles and 40 governance and management objectives grouped into five domains (Evaluate-Direct-Monitor, Align-Plan-Organise, Build-Acquire-Implement, Deliver-Service-Support, and Monitor-Evaluate-Assess). It is designed to be tailored to an organisation's size, strategy, risk profile and sourcing model using components such as processes, structures, policies, information, skills and culture, and applies to any enterprise seeking to align IT with business goals while balancing value, risk and resources. [1]

What is MITRE ATT&CK?

MITRE ATT&CK is a globally accessible, curated knowledge base of adversary tactics and techniques based on real-world observations, maintained by the MITRE Corporation. It is structured around tactics (adversary goals), techniques and sub-techniques (how goals are achieved) and procedures, organised into matrices for Enterprise, Mobile and ICS environments. It is used across the private sector, government, and the security community as a foundation for threat modelling, detection engineering, and defensive assessment, and is freely available. [1]

What are CIS Benchmarks?

CIS Benchmarks are consensus-developed secure configuration recommendations from the Center for Internet Security (CIS) for hardening technologies against attack, distinct from the outcome-oriented CIS Critical Security Controls. They cover more than 100 baselines across many vendor product families, including operating systems, cloud platforms, containers, databases, network devices, mobile devices and server and desktop software. They are produced through a global consensus process, available as free PDFs for non-commercial use, and mapped to frameworks such as the NIST CSF, ISO 27001, PCI DSS and HIPAA. [1]

What are the MAS Technology Risk Management Guidelines?

The MAS Technology Risk Management (TRM) Guidelines are risk-management principles and best-practice standards issued by the Monetary Authority of Singapore (MAS) for financial institutions. These guidelines, revised in 2021, set expectations for technology-risk governance and oversight, secure system development, resilience, incident response, and third-party and cloud-risk management to strengthen cyber resilience. They apply to all MAS-regulated financial institutions, including banks, insurers, fund managers, and payment service providers. The guidelines were issued on 18 January 2021. [1][2]

What are the SWIFT CSP mandatory controls and the attestation deadline?

The SWIFT CSP mandatory controls are 26 out of the 32 controls in the Customer Security Controls Framework (CSCF) v2026. The attestation deadline for compliance against CSCF v2026 is between July and December 2026.

Mandatory controls: 26

Attestation deadline: July to December 2026 [3]

What are the levels of the CMMC (Cybersecurity Maturity Model Certification)?

The CMMC (Cybersecurity Maturity Model Certification) defines three levels:

- Level 1 (Foundational) - 17 practices protecting Federal Contract Information (FCI), verified by annual self-assessment. [1]

- Level 2 (Advanced) - the 110 security requirements of NIST SP 800-171 Revision 2, protecting Controlled Unclassified Information (CUI), most requiring a third-party assessment by a Certified Third-Party Assessment Organization (C3PAO). [1]

- Level 3 (Expert) - Level 2 plus a subset of NIST SP 800-172 requirements for the highest-value CUI, assessed by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). [1]

What is the CCPA and CPRA in California?

The California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA), provide California residents with rights over the personal information businesses collect about them. Businesses subject to these laws include for-profit entities doing business in California that meet certain thresholds (over 25 million US dollars gross annual revenue; buying, selling, or sharing the personal information of 100,000 or more California residents; or deriving 50 percent or more of revenue from selling residents' personal information). Consumers have rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive information, and non-discrimination. The CPRA's additional protections took effect on 1 January 2023. These laws are enforced by the California Attorney General and the California Privacy Protection Agency. [1]

What is Brazil LGPD data protection law?

The Brazil LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) regulates the processing of personal data by individuals and public or private entities to protect the fundamental rights of freedom and privacy. It is enforced by the Autoridade Nacional de Proteção de Dados (ANPD). This law applies to any processing carried out in Brazil, or that offers goods or services to or processes the data of individuals located in Brazil. It sets out legal bases for processing, data-subject rights, and administrative penalties (fines up to 2 percent of Brazil revenue, capped at 50 million reais per infraction). [1]

What is PIPEDA in Canada?

PIPEDA, or the Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), is Canada's federal private-sector privacy law [1]. It governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activity and sets rules for electronic documents and signatures. The act is overseen by the Office of the Privacy Commissioner of Canada through a complaint-and-investigation mechanism. It applies to private-sector organizations across Canada, except in provinces with substantially similar legislation, and includes mandatory breach-reporting and record-keeping provisions. Last verified on 2026-08-13.

What is Singapore PDPA?

Singapore PDPA refers to the Personal Data Protection Act 2012, which governs the collection, use, disclosure, and care of personal data by organizations in Singapore. It establishes the national Do Not Call registry and is administered and enforced by the Personal Data Protection Commission (PDPC). The act imposes several data-protection obligations including consent, purpose-limitation, protection, accountability, and mandatory data-breach-notification on private-sector organizations. These obligations became effective on 2 July 2014.

Source: [1]

What is POPIA in South Africa?

POPIA, or the Protection of Personal Information Act 4 of 2013, is a framework in South Africa that gives effect to the constitutional right to privacy by regulating how public and private bodies process personal information. It is monitored and enforced by the Information Regulator (South Africa). The substantive conditions for lawful processing under POPIA became fully enforceable on 1 July 2021, requiring responsible parties to meet eight conditions for lawful processing and to safeguard personal information. Penalties include administrative fines and, for some offences, imprisonment. [1][2][4]

What is the Thailand Personal Data Protection Act?

The Thailand Personal Data Protection Act B.E. 2562 (2019) is a comprehensive data protection law enforced by the Personal Data Protection Committee (PDPC). It governs the collection, use, and disclosure of personal data by data controllers and processors, requiring a lawful basis (often consent), data-subject rights, security safeguards, and rules on cross-border transfers. Its main operative provisions became effective on 1 June 2022. [1]

What is UK GDPR and the Data Protection Act 2018?

The UK GDPR together with the Data Protection Act 2018 form the United Kingdom's data protection framework, regulated and enforced by the Information Commissioner's Office (ICO). The UK GDPR sets the core principles, lawful bases, and data-subject rights, while the DPA 2018 supplements it with UK-specific exemptions, rules for law enforcement and intelligence processing, and the ICO's powers and penalties. It applies to organizations processing the personal data of individuals in the UK; the DPA 2018 took effect on 25 May 2018, and the UK GDPR applied following the Brexit transition. [1]

What is the Australia Privacy Act and the Australian Privacy Principles?

The Australia Privacy Act and the Australian Privacy Principles (APPs) are governed by the Privacy Act 1988, which is Australia's principal legislation protecting the handling of personal information. Regulated by the Office of the Australian Information Commissioner (OAIC), the APPs consist of 13 principles that dictate how APP entities must collect, use, disclose, store, secure, and provide access to personal information. This act applies to most Australian Government agencies and private-sector organizations with an annual turnover exceeding AUD 3 million, among other entities. The APPs commenced on 12 March 2014. [1]

What is HIPAA compliance?

HIPAA compliance involves adhering to the Health Insurance Portability and Accountability Act's Security Rule, which became effective on 20 April 2005 for most covered entities, with small health plans having until 20 April 2006. This rule mandates the implementation of administrative, physical, and technical safeguards for electronic protected health information (ePHI). Specifically, covered entities must notify affected individuals without unreasonable delay, but no later than 60 calendar days following the discovery of a breach of unsecured ePHI, unless a law-enforcement delay applies. For breaches affecting 500 or more individuals, the covered entity must also notify the Secretary of the Department of Health and Human Services contemporaneously with the notification to individuals. For breaches affecting fewer than 500 individuals, the entity must maintain a log and report them not later than 60 days after the end of the calendar year in which they were discovered. [1][2][3][4]

What is the SWIFT Customer Security Programme (CSP)?

The SWIFT Customer Security Programme (CSP) is a framework designed to enhance the security of financial transactions involving SWIFT. It includes a set of mandatory and advisory security controls that organizations connected to SWIFT must attest against annually. Key aspects include:

- An independent assessment became mandatory for attestations starting in 2021, replacing pure self-attestation.

- The latest version, CSCF v2026, introduces several changes, such as requiring multi-factor authentication for external privileged access, recognizing Swift Universal Confirmation as a transaction validation option, and adding controls related to system hardening, malware protection, and security training.

- The framework consists of 32 controls, with 26 being mandatory and 6 advisory.

- Customer client connectors have been made a mandatory in-scope component, impacting the scope of assessments for some users.

- The current attestation period runs from July to December 2026, based on the controls outlined in CSCF v2026, which was published in mid-2025. [1][2][3][4][5]

What is the HIPAA breach notification requirement?

According to HIPAA, the breach notification requirement involves two main aspects:

1. For breaches involving 500 or more individuals, the covered entity must notify the Secretary contemporaneously with the notice to individuals, following discovery of the breach [1].

2. For breaches involving fewer than 500 individuals, the entity must maintain a log and report them not later than 60 days after the end of the calendar year in which they were discovered [1].

Additionally, following discovery of a breach, a covered entity must notify each affected individual "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach", except where a law-enforcement delay under § 164.412 applies [2].

What is the GLBA Safeguards Rule?

The GLBA Safeguards Rule (16 CFR Part 314), mandated by the 1999 Gramm-Leach-Bliley Act, requires financial institutions under FTC jurisdiction to develop, implement and maintain an information security programme with administrative, technical and physical safeguards to protect customer information. It is enforced by the Federal Trade Commission and applies to entities engaged in activities that are financial in nature. The amended rule also requires reporting to the FTC of notification events in which the unencrypted customer information of 500 or more consumers is acquired without authorization. [1]

What is FISMA?

FISMA stands for the Federal Information Security Modernization Act of 2014 [1]. This act amended the 2002 Federal Information Security Management Act and updated the U.S. federal government information-security framework. Under this act, CISA, with OMB oversight, administers the implementation of information-security policies for non-national-security federal Executive Branch systems. It mandates that the head of each federal agency must provide information-security protections commensurate with risk, report on the effectiveness of their security programmes, and report major information-security incidents. [1]

What is the HITECH Act?

The HITECH Act is part of the American Recovery and Reinvestment Act of 2009, administered by the U.S. Department of Health and Human Services. It promotes the adoption and meaningful use of electronic health records while strengthening the privacy and security protections established under HIPAA. Key aspects include extending HIPAA Security Rule safeguards, direct liability to business associates, establishing tiered civil monetary penalties, and introducing breach-notification requirements for covered entities and business associates handling protected health information. [1]

What is the FFIEC IT Examination Handbook?

The FFIEC IT Examination Handbook is a set of examination booklets issued by the Federal Financial Institutions Examination Council to guide examiners in assessing the IT and cybersecurity risk of U.S. financial institutions and their service providers. It comprises booklets such as Information Security, Management, Business Continuity Management, and Architecture, Infrastructure and Operations, covering governance, risk identification, controls, incident response and third-party oversight. It applies to banks, credit unions and other financial institutions supervised by the FFIEC member agencies. [1]

When does the EU AI Act take effect and what are its key dates?

The EU AI Act takes effect with several key dates:

- **2 August 2024**: Regulation (EU) 2024/1689 entered into force, marking the commencement of the Act. [3]

- **2 February 2025**: Chapters I and II (general provisions and prohibited AI practices) apply. [4]

- **2 August 2025**: Governance rules and obligations for general-purpose AI (GPAI) model providers apply, along with other obligations under Chapter III Section 4, Chapter V, Chapter VII, Chapter XII, and Article 78 (notifying authorities, general-purpose AI models, governance, penalties, and confidentiality). [3, 4]

- **2 August 2026**: The main provisions of the Regulation apply, except for Article 6(1) concerning high-risk classification for AI as a safety component of products already regulated under Union law. [4]

- **2 December 2027**: Postponed deadline for high-risk AI systems designated under Article 6(2) and Annex III. [1]

- **2 August 2028**: Postponed deadline for AI embedded in products regulated under Annex I sectoral legislation. [1]

- **2 August 2027**: Compliance deadline for providers of general-purpose AI models placed on the market before 2 August 2025. [5]

- **31 December 2030**: Compliance deadline for AI systems that are components of the large-scale IT systems listed in Annex X and placed on the market before 2 August 2027. [5]

These dates reflect the staggered implementation of various aspects of the EU AI Act. [4, 5]

What are the penalties under the EU AI Act?

Penalties under the EU AI Act include:

- Up to EUR 35,000,000 or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher, for infringement of the Article 5 prohibited-practices rules. [3]

- Up to EUR 15,000,000 or 3% for breach of most other operator obligations. [3]

- Up to EUR 7,500,000 or 1% for supplying incorrect, incomplete, or misleading information to notified bodies or national authorities. [3]

For Small and Medium-sized Enterprises (SMEs) including start-ups, each ceiling is the lower rather than the higher of the two figures. [3]

What risk categories does the EU AI Act define?

The EU AI Act defines high-risk AI systems, which are subject to specific obligations and deadlines as per the regulation. However, the context provided does not explicitly list the specific risk categories defined by the EU AI Act. Therefore, based solely on the given context, I cannot provide a definitive list of risk categories.

For a precise answer, you should refer to the primary source of the EU AI Act. [1] [2] [3] [4] [5]

What is the EU NIS2 Directive?

The EU NIS2 Directive (Directive (EU) 2022/2555) is a cybersecurity directive adopted on 14 December 2022, which lays down measures for a high common level of cybersecurity across the European Union. It repeals the earlier NIS Directive (EU) 2016/1148 and applies to essential and important entities across critical sectors such as energy, transport, banking, health, digital infrastructure, and public administration. The directive imposes cybersecurity risk-management measures, governance accountability, and significant-incident reporting, backed by supervision and enforcement. Each member state must transpose this directive into its national law. [1]

What is DORA (the Digital Operational Resilience Act)?

DORA (the Digital Operational Resilience Act) is a directly applicable EU regulation, Regulation (EU) 2022/2554, adopted on 14 December 2022. It sets uniform requirements for the security of network and information systems of financial entities and their critical ICT third-party providers. The act applies to a broad range of EU-regulated financial entities such as banks, insurers, investment firms, and payment institutions. It requires ICT risk management, ICT-related incident reporting, digital operational resilience testing, and oversight of ICT third-party risk. It became applicable across all member states on 17 January 2025. [1][2]

What is the UAE PDPL (Personal Data Protection Law)?

The UAE PDPL (Personal Data Protection Law) is Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. It came into effect on 2 January 2022 [3]. The law outlines various obligations and rights for controllers and processors of personal data, including reporting breaches, appointing a Data Protection Officer, honoring data-subject rights, securing data, conducting data protection impact assessments, and controlling cross-border transfers [1]. Consent is the default basis for processing personal data, with specific exceptions outlined in the law [2]. The law also provides for an enforcement structure, including mechanisms for filing complaints and imposing penalties, though the issuance of the Executive Regulation detailing the law's implementation remains unresolved [4].

What is Saudi Arabia NCA ECC (Essential Cybersecurity Controls)?

Saudi Arabia NCA ECC (Essential Cybersecurity Controls) is a framework consisting of 108 main controls and 92 sub-controls organized into 4 main domains and 28 subdomains. It applies to government agencies and private-sector entities owning, operating, or hosting Critical National Infrastructure within the Kingdom, including their affiliated companies and entities both inside and outside the Kingdom. The framework was first issued as ECC-1:2018 and updated to ECC-2:2024, which mandates compliance through self-assessments, periodic reports, and field auditing visits by the National Cybersecurity Authority (NCA). Compliance is required by Article 10(3) of the NCA Statute and High Order No. 57231 dated 10/11/1439H. The framework includes specific requirements for establishing an independent cybersecurity department, filling all cybersecurity positions with full-time, qualified Saudi nationals, and documenting and approving a cybersecurity strategy. [1][2][3][4]

What is SAMA CSF?

SAMA CSF (Saudi Arabia) is a Cyber Security Framework issued by the Saudi Central Bank (SAMA) in May 2017. It applies to all SAMA-regulated Member Organizations, including banks, insurance and reinsurance companies, financing companies, credit bureaus, and the Financial Market Infrastructure. The framework is principle-based and draws on NIST, ISF, ISO, Basel, and PCI standards. Member Organizations are expected to operate at maturity level 3 or higher. [1]

What is the Qatar NIA framework?

The Qatar NIA (National Information Assurance) framework is mandated by Qatar's National Cyber Security Agency (NCSA) for government entities and critical infrastructure. The current revision of the National Information Assurance Policy is version 2.1, effective as of May 2023, which supersedes version 2.0. This framework provides security controls, classification, and compliance approaches for organizations within the jurisdiction. [1][5]

What are the penalties under the UAE PDPL and who enforces it?

The UAE PDPL establishes administrative penalties for violations [2]. The enforcement structure includes mechanisms for data subjects to file complaints with the UAE Data Office (Article 24) and for grievances against the Office's decisions to be addressed (Article 25). The law also provides for administrative penalties for violations (Article 26), though the specific nature and details of these penalties are not detailed within the provided context. The Executive Regulation to detail the law's implementation, including potential penalties, has not yet been issued [1].

For more detailed information on penalties and enforcement, refer to the official UAE Legislation portal for Federal Decree-Law 45/2021, specifically Articles 24-26 [1, 2].

Who must comply with the SAMA Cyber Security Framework?

The SAMA Cyber Security Framework must be complied with by all SAMA-regulated Member Organizations, including banks, insurance and reinsurance companies, financing companies, credit bureaus, and the Financial Market Infrastructure. [1]

Who must comply with the Qatar National Information Assurance (NIA) framework?

The Qatar National Information Assurance (NIA) framework mandates compliance for government entities and critical infrastructure. This is stated in verified fact [1].

What is the Bahrain Personal Data Protection Law?

The Bahrain Personal Data Protection Law (Law No. 30 of 2018) is Bahrain's national data protection statute, enforced by the Personal Data Protection Authority established under the Ministry of Justice and Islamic Affairs. It applies to the processing of personal data of individuals in Bahrain by data managers and processors in the public or private sector. As a core rule, it prohibits processing personal data without the data subject's explicit consent except on specified legal grounds, and it restricts transferring personal data outside Bahrain unless an adequate level of protection or a specific authorisation exists. [1]

What is the Oman Personal Data Protection Law?

The Oman Personal Data Protection Law, promulgated by Royal Decree 6/2022, is Oman's national data protection statute. It is enforced by the Ministry of Transport, Communications and Information Technology. This law governs the processing of personal data and grants data owners rights including consent, withdrawal of consent, correction, and deletion. Controllers and processors are subject to certain obligations under this law. The law consists of 32 articles spread across five chapters and requires the data owner's consent before processing personal data. An Executive Regulation supporting the law is expected to be issued in 2024. [1]

What are the key control domains of the Saudi NCA Essential Cybersecurity Controls (ECC)?

The key control domains of the Saudi NCA Essential Cybersecurity Controls (ECC) are:

1. Cybersecurity Governance

2. Cybersecurity Defense

3. Cybersecurity Resilience

4. Third-Party and Cloud Computing Cybersecurity [2]

What is TISAX in the automotive industry?

TISAX (Trusted Information Security Assessment Exchange) is an assessment and results-exchange mechanism for information security governed by the ENX Association on behalf of the German automotive industry association VDA. Vehicle manufacturers, suppliers, and service providers use it to demonstrate and mutually recognize information security across the automotive supply chain, avoiding duplicate audits. Assessments are performed by ENX-approved audit providers against the VDA Information Security Assessment (ISA) catalogue, which is based on key aspects of ISO/IEC 27001, and the resulting labels are valid for three years. [1][2][3]