United Arab EmiratesDFSA General Module, notification of a material Cyber Incident
DFSA Rulebook, General Module (GEN), Rule 5.5.19
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://dfsaen.thomsonreuters.com/entiresection/26146In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an Authorised Person under the Dubai Financial Services Authority Rulebook in the Dubai International Financial Centre (reached by declaring that you hold a financial-services license).
- Notify the DFSA as soon as reasonably practicable, and in any event no later than 72 hours, after you become aware or have information which reasonably suggests that a material Cyber Incident has occurred, using the appropriate form on the DFSA electronic portal (Rule 5.5.19).
- Investigate a detected potential or actual Cyber Incident to determine its nature and extent (Rule 5.5.18).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Dubai Financial Services Authority, to which an Authorised Person notifies a material Cyber Incident.
What this law does
The DFSA states that its cyber supervision applies to all DFSA Authorised Firms, Registered Auditors, Credit Rating Agencies and Authorised Market Institutions. Rule 5.5.19 requires an Authorised Person to notify the DFSA of a material Cyber Incident as soon as reasonably practicable and in any event no later than 72 hours after becoming aware. Rule 5.5.18 requires an Authorised Person to investigate a detected potential or actual Cyber Incident to determine its nature and extent.
When LexLint raises it
When your app profile says your app provides financial services.