Is a payment provider, in Namibia

Credit Bureau Regulations, 2014 (Government Notice 103 of 2014, Government Gazette 5518), regs. 3, 17, 20, 21, 23, 24, 28 and 30 · Read the law's page

• If you receive or investigate credit applications, credit agreements or payment histories, compile data from them and issue reports on individuals or businesses, register with the Bank of Namibia as a credit bureau before you offer the service, and do not also act as a credit provider or debt collection agency.
• Keep the consumer information you receive confidential, and release it to subscribers only as the data subject concerned has explicitly authorised in writing, subject to the other provisions of the regulation and any other law.
• Do not hold in your database or include in a credit report any information on a data subject's race, colour, ethnic origin, sex, religion or social or economic status.
• Do not sell, lease or transfer your credit performance information, apart from selling credit reports, except to another credit bureau with the approval of the Bank of Namibia; aggregated information may be sold only if the personal information of data subjects is not disclosed.
• Maintain rigorous standards of security and reliability, and protect data against loss, corruption, destruction, misuse, undue access or disclosure.
• Give a natural person who requests it a free copy of his or her credit report once every 12 months, inform the person of the right to challenge the information, and on a challenge endorse the report, ask the information provider for credible evidence within seven working days, and within 20 working days either give the person the evidence or remove the information and all record of it.
• Submit periodic returns and statistics to the Bank of Namibia in the format and frequency it determines, and furnish any record the Bank requests during an inspection.

PSD-12, cyber incident reporting, paras. 11.13 to 11.15 · Read the law's page

• This binds the payment system operators, participants and payment service providers within Namibia's National Payment System: Financial Market Infrastructures, Designated Non-Bank Financial Institutions, participants of Financial Market Infrastructures, Retail Payment Systems such as electronic funds transfers, payment cards and electronic money, Payment Service Providers and any other entity licensed or authorised within the National Payment System (reached by declaring that you are a payment provider or a bank).
• Report every successful cyberattack incident to the Bank of Namibia, with a preliminary notification within 24 hours (paragraph 11.13).
• After that notification, conduct an impact assessment of the successful cyberattack incident and report to the Bank within a month from the time the incident becomes known (paragraph 11.14).
• Make the impact report indicate at least any financial loss, data loss and availability loss (paragraph 11.15).

PSD-12, cybersecurity standards, paras. 9 to 13 · Read the law's page

• This binds the payment system operators, participants and payment service providers within Namibia's National Payment System: Financial Market Infrastructures, Designated Non-Bank Financial Institutions, participants of Financial Market Infrastructures, Retail Payment Systems such as electronic funds transfers, payment cards and electronic money, Payment Service Providers and any other entity licensed or authorised within the National Payment System (reached by declaring that you are a payment provider or a bank).
• Have your board establish and approve a Framework for information security, cybersecurity and operational resilience, and set risk tolerances aligned with the key risk indicators in paragraph 13 (paragraphs 9.1 and 9.3).
• Identify and classify your business functions and supporting processes and perform a risk assessment at least once every year, and include one penetration test every three years for critical systems in your threat intelligence processes (paragraphs 11.1 and 11.3).
• Encrypt, tokenize or mask data transmitted across open and public networks in line with best practice standards (paragraph 12.1).
• Meet the key risk indicators and tolerance levels in paragraph 13, including recovery time and recovery point objectives for critical systems, and test your response, resumption and recovery plans (paragraph 13).