NamibiaBank of Namibia Determination on Information Security (BID-30) of 2026, Incident Reporting
BID-30 (2026), incident reporting, paras. 12.1 to 12.5
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This Determination takes effect six months after its publication in the Gazette on (paragraph 14); until then the Determination of 2017 applies. It binds a banking institution or microfinance banking institution authorised by the Bank of Namibia to conduct banking business or microfinance banking business in Namibia (reached by declaring that you are a bank).
- Report to the Director of the Banking Supervision Department at the Bank of Namibia, by telephone or in writing, immediately upon becoming aware of material information relating to an information or cyber security incident, and send regular updates until the incident is contained (paragraph 12.1).
- Submit information about the incident on the form the Bank issues within 24 hours after detecting it, or by the next working day where the incident occurred on a weekend or public holiday (paragraph 12.5).
- Treat an incident as material when it meets one or more of the higher impact level criteria or three or more of the lower impact level criteria in Table 1 and Annexure A (paragraphs 12.3 and 12.4).
- Assess each incident against the transactions affected, users affected, service downtime, economic impact, escalation, other institutions affected and reputational impact, and put the outcome in the incident reporting form (paragraph 12.6).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bank of Namibia, which may impose an administrative fine under section 94(1) of the Banking Institutions Act, 2023.
Settledness
- As of
- Open questions
- Does the 2026 Determination take effect on , six months after its gazette of as paragraph 14 reads, or on , the date the Bank of Namibia determinations listing gives?
What this law does
Paragraph 5 of the Determination on Information Security (BID-30) of 2026 applies it to all banking institutions and microfinance banking institutions authorised by the Bank to conduct banking business and microfinance banking business in Namibia.
Paragraph 12.1 of the 2026 Determination requires the institution to report immediately, on becoming aware of material information relating to an information or cyber security incident, to the Director of the Banking Supervision Department at the Bank by telephone or in writing, followed by regular updates until the incident is contained.
Paragraph 12.5 of the 2026 Determination requires the institution to submit information about the incident on a form issued by the Bank within 24 hours after detecting the incident, or the next working day where the incident occurred on a weekend or public holiday. Paragraph 14 of the 2026 Determination brings it into effect six months after the date of publication in the Gazette.
Paragraph 13.1 of the 2026 Determination says any contravention or failure to comply is subject to administrative penalties as contemplated in section 94(1) of the Act.
Section 94(1) of the Banking Institutions Act, 2023 lets the Bank of Namibia, after an inquiry, impose on a banking institution, microfinance banking institution or controlling company that contravenes or fails to comply with a determination referred to in section 108(3) an administrative fine not exceeding an amount the Bank determines.
When LexLint raises it
When your app profile says your app is a bank.