United Arab EmiratesADGM General Rulebook, notification of a material Cyber Incident
ADGM General Rulebook (GEN), Rule 3.5.18
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an Authorised Person under the Abu Dhabi Global Market General Rulebook, a firm authorised by the ADGM Financial Services Regulatory Authority (reached by declaring that you hold a financial-services license), from .
- Notify the Regulator immediately, and in any event no later than 24 hours, after you become aware or have information which reasonably suggests that a material Cyber Incident has occurred (Rule 3.5.18).
- Notification should use the prescribed incident reporting form available on the relevant electronic portal (Rule 3.5.18).
- Review your Cyber Incident Response Plan after a material Cyber Incident that is reportable under Rule 3.5.18 (Rule 3.5.16(4)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Financial Services Regulatory Authority of Abu Dhabi Global Market, the Regulator to which an Authorised Person reports a material Cyber Incident.
What this law does
Rule 3.5.18 requires an Authorised Person to notify the Regulator immediately, and in any event no later than 24 hours, after it becomes aware or has information which reasonably suggests that a material Cyber Incident has occurred. Rule 3.5.18 states that notification to the Regulator should use the prescribed incident reporting form available on the relevant electronic portal.
Rule 3.5.16 requires an Authorised Person to review its Cyber Incident Response Plan after the occurrence of a material Cyber Incident that is reportable under Rule 3.5.18. The FSRA notice of states that Authorised Persons must notify the FSRA immediately upon discovery of a suspected material cyber incident and, in any event, no later than 24-hours after they become aware of information that reasonably suggests such an incident has occurred.
The ADGM Financial Services Regulatory Authority states that the Cyber Risk Management Rules under GEN 3.5 come into effect on .
When LexLint raises it
When your app profile says your app provides financial services.