MaltaGaming Authorisations and Compliance Directive, Notification of Information Security Breaches
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds a licensee of the Malta Gaming Authority: a business-to-consumer licensee providing a gaming service, or a business-to-business licensee providing a critical gaming supply such as a back-end service. Read it by hand if you supply or operate a gaming product licensed in Malta.
- Notify the Authority forthwith, and in any case no later than three working days after the breach, of any breach of your information security that adversely affects the confidentiality of information relating to players (article 37(2)(c)).
- Notify the Authority on the same clock of any breach of your information security that precludes players from accessing their accounts for a period exceeding twelve hours (article 37(2)(d)).
- Submit the notice as an incident report through the Licensee Portal of the Malta Gaming Authority.
These lines are LexLint's reading of the law's text. Also read by: Malta Gaming Authority, Reporting Requirements page of the Licensee Hub (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
Malta Gaming Authority
Settledness
- As of
- Guidance link
- https://www.mga.org.mt/licensee-hub/compliance/licensees-information-reporting-requirements/reporting-requirements/
- Guidance body
- Malta Gaming Authority, Reporting Requirements page of the Licensee Hub
- Open questions
- Does a licensee have three working days, as article 37(2) of the Directive provides, or 72 hours, as the Authority Reporting Requirements page states, to report a breach of information security that affects player confidentiality or locks players out of accounts for more than twelve hours?
What this law does
Article 37(2) of the Gaming Authorisations and Compliance Directive requires a licensee to notify the Malta Gaming Authority of any breach of its information security that adversely affects the confidentiality of information relating to players, and of any such breach that precludes players from accessing their accounts for a period exceeding twelve hours. The notice is due forthwith and in any case no later than three working days after the breach.
A licensee is a business-to-consumer licensee providing a gaming service or a business-to-business licensee providing a critical gaming supply. The Authority takes the notice as an incident report submitted through its Licensee Portal.
Back to the example · Lint your app
Page updated .