Source: https://advisera.com/27001academy/knowledgebase/laws-regulations-information-security-business-continuity/
Timestamp: 2018-02-20 05:44:07+00:00

Document:
﻿ List of information security and business continuity legislation
Home / Knowledge base / About ISO 27001, ISO 22301 and other standards / Laws and regulations on information security and business continuity
Personal Data Protection Act of 2000 (aka Habeas Data)
Data Protection infrigments and penalties. Provision 1/2003
Security measures for the treatment and maintenance of personal data contained in files, records, databanks or databases. Provision 11/2006
BANCO CENTRAL DE LA REPÚBLICA ARGENTINA – COMUNICACIÓN “A“ 4609 (12/2006)
Ley de Delitos Informáticos (2008) – Ley 26.388
Data Protection Act 2000, Austrian Federal Law Gazette part I No. 165/1999 (Datenschutzgesetz 2000 or DSG 2000)
Protective Security Framework – June 2010 (Australian Government – Attorney General‘s Department (AGD))
Prudential Standard CPS232 Business Continuity Management (Australian Prudential Regulation Authority (APRA))
Prudential Standard SPS232 Business Continuity Management
Prudential Standard APS 222 Associations with Related Entities (APRA)
Prudential Standard CPS 231 Outsourcing (APRA)
Prudential Practice Guide PPG 231 Outsourcing (APRA)
Prudential Practice Guide SPG 231 Outsourcing (APRA)
Prudential Practice Guide CPG 233 Pandemic Planning (APRA)
Prudential Practice Guide CPG 234 Management of Security Risk in Information and Information Technology (APRA)
Prudential Practice Guide LPG 232 Business Continuity Management (APRA)
Prudential Practice Guide SPG 232 Business Continuity Management (APRA)
Crimes Act 1958 (Vic.)
Essential Services Act 1958 (Vic)
Audit Act 1994 (Vic)
Employment Law Act 2009
Intelligence Services Act 2001 (Cth)
National Security Information (Criminal and Civil Proceedings) Act 2004 (Cth)
Telemarketing and Research Industry Standard 2007
Data deletion standards
Victorian Recordkeeping Standards
Disaster Preparedness and Response Act 2006; Emergency Relief Guarantee Fund Act 1999 (National Emergency Management Agency (NEMA))
PU19-0406 – Supervisory and Regulatory Guidelines – Business Continuity 1st May 2007 (The Central Bank of the Bahamas)
Operational Risk Guidelines, June 2007 (The Central Bank of Barbados)
Belgium Data Protection Law and Belgian Data Privacy Commission Privacy Blog
The National Bank of Belgium (NBB)
Personal Data Protection Act / Zakon o zaštiti ličnih podataka (“Sl. glasnik BiH“ broj: 49/06)
Pravilnik o načinu vođenja i obrascu evidencije o zbirkama ličnih podataka (“Sl. glasnik BiH“ broj: 52/09)
Pravilnik o načinu čuvanja i posebnim mjerama tehničke zaštite ličnih podataka (“Sl. glasnik BiH“ broj: 67/09)
Pravilnik o inspekcijskom nadzoru u oblasti zaštite ličnih podataka (“Sl. glasnik BiH“ broj: 51/09)
Pravilnik o postupku po prigovoru nosioca podataka u Agenciji za zaštitu ličnih podataka u Bosni i Hercegovini (“Sl. glasnik BiH“ broj: 51/09)
Instrukcija o načinu provjere obrade ličnih podataka prije uspostavljanja zbirke ličnih podataka (“Sl. glasnik BiH“ broj: 76/09)
Constituição Federal, arts. 5, 23, 37 e 216
Código Civil, arts. 927 e 932
Consolidação das Leis do Trabalho – CLT, art. 482
Código de Conduta da Alta Administração, arts. 5 e 14
Decreto nº 1.171/94 (Código de Ética do Servidor Público), Seções I e II.
Código de Defesa do Consumidor, arts. 43 e 44
Código Penal, arts. 151-154, 184, 266, 297, 298, 305, 307, 311, 313, 314, 325
Código Processo Penal, arts. 20, 207, 745
Código Tributário Nacional, art. 198
Código de Processo Civil, arts. 347 e 406
Lei nº 12.965, de 23 abril de 2014. (Marco Civil da Internet)
Law on classified information – ЗАКОН ЗА ЗАЩИТА НА КЛАСИФИЦИРАНАТА ИНФОРМАЦИЯ – ДВ. бр.109 от 20 Декември 2007г
Law on personal data protection – ЗАКОН ЗА ЗАЩИТА НА ЛИЧНИТЕ ДАННИ – ДВ. бр.57 от 13 Юли 2007г.
Law on free access to public information – ЗАКОН ЗА ДОСТЪП ДО ОБЩЕСТВЕНА ИНФОРМАЦИЯ – Доп. – ДВ, бр. 49 от 2007 г.
Telecommunications Act – Promulgated State Gazette No. 88/7.10.2003, effective 7.10.2003, amended and supplemented, SG No. 19/1.03.2005, SG No. 77/27.09.2005, SG No. 88/4.11.2005
E-Commerce Law – ЗАКОН ЗА ЕЛЕКТРОННАТА ТЪРГОВИЯ – ДВ. бр.41 от 22 Май 2007г.
Law for data in electronic form and electronic signature – ЗАКОН ЗА ЕЛЕКТРОННИЯ ДОКУМЕНТ И ЕЛЕКТРОННИЯ ПОДПИС – ДВ. бр.38 от 11 Май 2007г.
Law on Copyright and related rights – ЗАКОН ЗА АВТОРСКОТО ПРАВО И СРОДНИТЕ МУ ПРАВА – ДВ. бр.59 от 20 Юли 2007г.
Law on electronic data – ЗАКОН ЗА ЕЛЕКТРОННИТЕ СЪОБЩЕНИЯ -ДВ. бр.109 от 20 Декември 2007г.
Law on electronic management – ЗАКОН ЗА ЕЛЕКТРОННОТО УПРАВЛЕНИЕ – ДВ. бр.46 от 12 Юни 2007г.
Law on crises management – ЗАКОН ЗА УПРАВЛЕНИЕ ПРИ КРИЗИ – ДВ. бр.78 от 28 Септември 2007г.
The Privacy Act – July 1983
Emergency Management Act of 2007 (Canadian Government)
Emergency Management & Civil Protection Act – Ontario Regulation (Province of Ontario)
Ontario Regulation 380/04
IDA By-Law 17.19 – Business Continuity Plan Requirement (OSC (Ontario Securities Commission))
Letter to Federally Regulated Financial Institutions, Insurance Companies, CBA etc March 2006
Act on the Protection of Personal Data, August 1998
Guidelines on the Risk Management of Commercial Banks’ Information Technology
Information Security Technology – Guide of Personal Information Protection (Release on 30 Jan 2011, Draft and Under Consultation)
银行、证券跨行业信息系统突发事件应急处置工作指引
银行业重要信息系统突发事件应急管理规范（试行）
银行业金融机构外包风险管理指引
银行业金融机构重要信息系统投产及变更管理办法
商业银行业务连续性监管指引
Two laws affecting data privacy – Law 1266 of 2008 and Law 1273 of 2009
Ley 599 de 2000, Derechos de autor: Articulo 270. Violación a los derechos morales de autor.
Ley 599 de 2000: Por la cual se expide el Código Penal. En esta se mantuvo la estructura del tipo penal de “violación ilícita de comunicaciones”, se creó el bien jurídico de los derechos de autor y se incorporaron algunas conductas relacionadas indirectamente con el delito informático, tales como el ofrecimiento, venta o compra de instrumento apto para interceptar la comunicación privada entre personas. Se tipificó el “Acceso abusivo a un sistema informático”, así: “Art. 195. El que abusivamente se introduzca en un sistema informático protegido con medida de seguridad o se mantenga contra la voluntad de quien tiene derecho a excluirlo, incurrirá en multa.”
Decreto 2649 del 1993 articulo 134: Retención de registros información financiera
Resolución 0275 de 2001, Gobierno corporativo Superintendencia de valores: Se establecen los requisitos que deben acreditar las personas jurídicas públicas y privadas que pretendan ser destinatarias de la inversión de recursos de los fondos de pensiones
Ley 527 de 1999. Comercio electrónico: Se define y reglamenta el acceso y uso de los mensajes de datos, del comercio electrónico y de las firmas digitales, y se establecen las entidades de certificación y se dictan otras disposiciones.
Habeas data: El objetivo de esta ley es desarrollar el derecho constitucional que tienen todas las personas a conocer, actualizar y rectificar las informaciones que se hayan recogido sobre ellas en bancos de datos, y los demás derechos, libertades y garantías constitucionales relacionadas con la recolección, tratamiento y circulación de datos personales. A lo que se refiere el artículo 15 de la Constitución Política, así como el derecho a la información establecido en el artículo 20 de la Constitución Política, particularmente en relación con la información financiera y crediticia, comercial, de servicios y la proveniente de terceros países.
Circular 052 de 2007 (Superintendencia Financiera de Colombia): La circular 052 de la Superintendencia Financiera, es un conjunto de buenas prácticas para el sector financiero en Colombia que busca establecer un referente fundamental para el desarrollo de la Seguridad Informática en Colombia. Mediante esta circular, los bancos e instituciones financieras deben proteger todos sus canales de atención a clientes frente a riesgos de fraude y de reputación. Algunas de las prácticas que deben implementar para lograrlo son: Inscripción, Almacenamiento, Video vigilancia, Firewalls y demás sistemas de protección informática, Planes de Contingencia bajo el uso de Centros de Cómputo de Alta Disponibilidad, entre otros.
Circular Externa No.002 del 06 de Enero de 1998 emanada de la Superintendencia Financiera: Seguridad en transacciones financieras realizadas mediante la utilización de Tarjetas Crédito y Débito a través de Cajeros Automáticos, Puntos de Servicios en establecimientos comerciales y oficinas de las instituciones financieras
Ley 1221 de 2008: Regula el teletrabajo en Colombia (Una forma de organización laboral, que consiste en el desempeño de actividades remuneradas o la prestación de servicios a terceros utilizando como soporte las tecnologías de la información y las comunicaciones)
Ley 1480 de 2011: Estatuto del Consumidor: tiene como objetivo principal, proteger, promover y garantizar la efectividad y el libre ejercicio de los derechos de los consumidores. Se establecen las reglas de protección para el comercio electrónico.
Proyecto de Ley Estatutaria 046 de 2010 por la cual se dictan disposiciones generales para la protección de datos personales
Ley No. 1273 de 2009, “POR MEDIO DE LA CUAL SE MODIFICA EL CÓDIGO PENAL, SE CREA UN NUEVO BIEN Jurídico TUTELADO – DENOMINADO “DE LA Protección DE LA Información Y DE LOS DATOS”· Y SE PRESERVAN INTEGRALMENTE LOS SISTEMAS QUE UTILICEN LAS Tecnologías DE LA Información Y LAS COMUNICACIONES, ENTRE OTRAS DISPOSICIONES”.
LEY ESTATUTARIA 1581 DE 2012, Por la cual se dictan disposiciones generales para la protección de datos personales, Artículo 1°. Objeto. La presente ley tiene por objeto desarrollar el derecho constitucional que tienen todas las personas a conocer, actualizar y rectificar las informaciones que se hayan recogido sobre ellas en bases de datos o archivos, y los demás derechos, libertades y garantías constitucionales a que se refiere el artículo 15 de la Constitución Política; así como el derecho a la información consagrado en el artículo 20 de la misma.
DECRETO 1377 DE 2013 Por el cual se reglamenta parcialmente la Ley 1581 de 2012, que tiene por objeto, “reglamentar parcialmente la Ley 1581 de 2012, por la cual se dictan disposiciones generales para la protección de datos personales.”
Ley 9048, Ley de Delitos Informáticos.
Laws and regulations applicable to all organizations:
Personal Data4Protection Act (Official Gazette 103/03) and Act on Amendments and Addenda to the Personal Data Protection Act (Official Gazette 41/08) – Zakon o zaštiti osobnih podataka (NN 103/03) i Zakon o izmjenama i dopunama Zakona o zaštiti osobnih podataka (NN 41/08) – propisuju da se svi osobni podaci moraju primjereno zaštititi
Law on protection and rescue (Official Gazette 174/04) – Zakon o zaštiti i spašavanju (NN 174/04) – u članku 18 propisuje da sve pravne osobe de facto moraju pripremiti planove kontinuiteta poslovanja
Electronic Document Act (Official Gazette 150/2005)- Zakon o elektroničkoj ispravi (NN 150/05) – u članku 20 propisuje koje mjere sigurnosti mora osigurati elektronička arhiva; u članku 25 određuje se ovjera informacijske i komunikacije opreme za tijela državne uprave
Regulation on the procedure for storage and special measures relating to the technical protection of special categories of personal data (Official Gazette 139/04) – Uredba o načinu pohranjivanja i posebnim mjerama tehničke zaštite posebnih kategorija osobnih podataka (NN 139/04) – preciznije se određuju mjere zaštite za zbirke osobnih podataka koje sadržavaju tzv. posebne kategorije
Laws and regulations applicable to government bodies:
Information Security Act (Official Gazette 79/07) – Zakon o informacijskoj sigurnosti (NN 79/07) – propisuje obvezu uvođenja informacijske sigurnosti u sva tijela državne uprave
Regulation on Information Security Measures (Official Gazette 46/08) – Uredba o mjerama informacijske sigurnosti (NN46/08) – propisuje način provedbe Zakona o informacijskoj sigurnosti
Data Secrecy Act (Official Gazette 79/07) – Zakon o tajnosti podataka (NN 79/07) – propisuje način klasifikacije podataka shodno tajnosti, pristup istima, te zaštitu
Regulation on classified information marking, the content and form of security clearance and statement on classified information handling (Official Gazette 102/07) – Uredba o načinu označavanja klasificiranih podataka, sadržaju i izgledu uvjerenja o obavljenoj sigurnosnoj provjeri i Izjave o postupanju s klasificiranim podacima (NN 102/07)
Security Vetting Act (Official Gazette 85/08) – Zakon o sigurnosnim provjerama (NN 85/08) – sistem provjere osoba koje ostvaruju pristup klasificiranim podacima
Regulation on the content, form, filling in and handling the Security Vetting Questionnaire (Official Gazette 114/08) – Uredba o sadržaju, izgledu, načinu ispunjavanja i postupanju s upitnikom za sigurnosnu provjeru (NN 114/08)
Ordinance on criteria for establishing information security advisor positions (Official Gazette 30/11) – Pravilnik o kriterijima za ustrojavanje radnih mjesta savjetnika za informacijsku sigurnost (NN 30/11)
Laws and regulations for banks and other credit institutions:
Decision on Adequate Information System Management (Official Gazette 80/07) – Odluka o primjerenom upravljanju informacijskim sustavom (NN 80/07) – precizno određene odgovornosti banaka za uvođenje informacijske sigurnosti, kao i rokovi
Guidelines for information system management for decreasing the operational risk (Croatian National Bank, March 2006) – Smjernice za upravljanje informacijskim sustavom u cilju smanjenja operativnog rizika (HNB, ožujak 2006.)
Decision on outsourcing (Official Gazette 01/09) – Odluka o eksternalizaciji (NN 01/09) – propisuje obvezu procjene rizika dobavljača u slučaju outsourcinga, što uključuje i procjenu rizika vezanog za zaštitu informacija
Decision on adequate outsourcing risk management (Croatian National Bank, October 2005) – Smjernice za adekvatno upravljanje rizikom eksternalizacije (HNB, listopad 2005.)
Guidelins for managing the information system risk in credit unions (Croatian National Bank, November 2007) – Smjernice za ovladavanje rizikom informacijskog sustava u kreditnim unijama (HNB, studeni 2007.)
Decision on risk management (Official Gazette 01/09) – Odluka o upravljanju rizicima (NN 01/09) – među ostalim određuje pravila za upravljanje operativnim rizikom, te u sklopu tog rizika upravljanje informacijskim sustavom i rizikom informacijskog sustava
Laws and regulations for other financial institutions:
Ordinance on the detailed form and minimum scope and content of audit reviews and audit reports of insurance companies (Official Gazette 76/2006) – Pravilnik o detaljnom obliku i najmanjem opsegu te sadržaju revizorskog pregleda i revizorskog izvješća društava za osiguranje (NN 76/06) – obvezuje revizora da među ostalim provjeri koliko su informatički sustavi zaštićeni
Ordinance on operating conditions for authorised companies (Official Gazette 14/2007) – Pravilnik o uvjetima za obavljanje poslova ovlaštenog društva (NN 14/07) – u člancima 12 i 13 se propisuje zaštita informacijskog sustava odnosno dokumentacije za burzovne kuće
Ordinance regulating business operations of investment fund management companies (Official Gazette 25/2007) – Pravilnik kojim se uređuje poslovanje društva za upravljanje investicijskim fondovima (NN 25/07) – u člancima 11 i 12 se propisuje zaštita informacijskog sustava odnosno dokumentacije
Ordinance on organisational requirements for providing investment services and conducting investment activities and ancillary services (Official Gazette 5/2009) – Pravilnik o organizacijskim zahtjevima za pružanje investicijskih usluga i obavljanje investicijskih aktivnosti i pomoćnih usluga (NN 5/09) – u članku 4 nalaže da je društvo dužno ustrojiti i primjenjivati sustave i procedure koji osiguravaju sigurnost, cjelovitost i tajnost podataka, kao i mjere za neprekidno poslovanje; u članku 13 propisuje na koji način se mora čuvati poslovna dokumentacija i podaci
Laws and regulations for telecom operators:
Ordinance on means and deadlines for implementation of safeguards and integrity of networks and services (Official Gazette 109/12) – Pravilnik o načinu i rokovima provedbe mjera zaštite sigurnosti i cjelovitosti mreža i usluga (NN 109/12) – u Dodatku 1 (Minimalne mjere sigurnosti) se direktno traži implementacija pojedinih elemenata ISO 27001, ISO 27002, ISO 27005 i ISO 22301
Act on Protection of Personal Data (April 2000) No. 101
Act on Processing of Personal Data, Act No. 429, May 2000
Resolution JB-2012-2148: information security on electronic channels (applies to all financial institutions)
Resolution JB-2014-3066: Information Security Management System based on ISO 27001 and Business Continuity Management System based on ISO 22301 (applies to all financial institutions)
Ministerial Agreement No. 166: Implementation of Government Scheme of Information Security based on local NTE ISO 27001 (local ISO based on ISO 27001:2005)
Operational Risk Management Resolution: new resolution that is an improvement of Resolution JB-2012-2148 and Resolution JB-2014-3066, and requires all financial institutions to define and implement an ISMS with a limited scope, information security on projects, and third-party information security management.
Personal Data Protection Act of 2003. June 1996, Consolidated July 2002.
European Union Data Protection Directive of 1998
EU Internet Privacy Law of 2002 (DIRECTIVE 2002/58/EC)
Data Protection Act , 1998.
Basel II: BASEL capital accord (April 2003) (Basel Committee on Banking Supervision)
EU General Data Protection Regulation (EU GDPR), 2016
Act on the Amendment of the Personal Data Act (986) 2000
Data Protection Act of 1978 (revised in 2004)
Grundgesetz für die Bundesrepublik Deutschland (GG) Art 10
Gesetz zum Schutz personenbezogener Daten (Landesdatenschutzgesetz – LDSG – Baden-Württemberg
Bayerisches Datenschutzgesetz (BayDSG) – Bayern
Gesetz zum Schutz personenbezogener Daten in der Berliner Verwaltung (Berliner Datenschutzgesetz – BlnDSG) – Berlin
Gesetz zum Schutz personenbezogener Daten im Land Brandenburg (Brandenburgisches Datenschutzgesetz – BbgDSG) – Brandenburg
Bremisches Datenschutzgesetz (BremDSG) – Bremen
Hamburgisches Datenschutzgesetz (HmbDSG) – Hamburg
Hessisches Datenschutzgesetz (HDSG) – Hessen
Gesetz zum Schutz des Bürgers bei der Verarbeitung seiner Daten (Landesdatenschutzgesetz – DSG M-V) – Mecklenburg-Vorpommern
Niedersächsisches Datenschutzgesetz (NDSG) – Niedersachsen
Gesetz zum Schutz personenbezogener Daten (Datenschutzgesetz Nordrhein-Westfalen – DSG NRW -) – Nordrhein-Westfalen
Landesdatenschutzgesetz (LDSG) – Rheinland-Pfalz
Saarländisches Gesetz zum Schutz personenbezogener Daten (Saarländisches Datenschutzgesetz – SDSG –) – Saarland
Gesetz zum Schutz der informationellen Selbstbestimmung im Freistaat Sachsen (Sächsisches Datenschutzgesetz – SächsDSG) – Sachsen
Gesetz zum Schutz personenbezogener Daten der Bürger (DSG-LSA) – Sachsen-Anhalt
Schleswig-Holsteinisches Gesetz zum Schutz personenbezogener Informationen (Landesdatenschutzgesetz – LDSG -) – Schleswig-Holstein
Thüringer Datenschutzgesetz (ThürDSG) – Thüringen
Gesetz zur Kontrol­le und Transparenz im Unternehmensbereich (KonTraG)
Aktiengesetz (AktG) § 91 Abs. 2 und § 93 Abs. 2 AktG
GMBH Gesetz (GmbHG) § 43 Abs. 1 GmbHG
Handelsgesetzbuch (HGB) § 317 Abs. 4 und § 317 Abs. 2 HGB
Abgabenordnung (AO) § 147 AO
Strafgesetzbuch (StGB) § 202 und § 203 StGB
Verordnung über den Datenschutz bei der geschäftsmäßigen Erbringung von Postdiensten (Postdienste-Datenschutzverordnung – PDSV)
Sozialgesetzbuch (SGB) SGB X
Law 2472/1997 on Protection of Individuals with regard to the Processing of Personal Data
Law 3471/2006 on Protection of personal data and privacy in the electronic telecommunications
Law 3917/2011 on Retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks, use of surveillance systems by taking or recording audio or video in public areas and related provisions
Regulation 26/2004 on Conditions for the lawful processing of personal data for purposes of direct marketing or advertising and credit assessment
Common Act of National Data Protection Authority and Authority for Telecommunications Security regarding the Security Requirements for systems processing personal data in order to respond to legal requests for data
Law 3614/2008 titled “Strengthening the institutional framework to safeguard the confidentiality of telephone communications and other provisions”
Regulation 1742/Β/15-7-2013 on Security and Availability of Networks and Electronic Communication Services
Regulation 384/Β/24-3-2005 on Secrecy Assurance for Postal Services
Regulation 165/2011 on telecommunications security
Presidential Decree 47/2004 for privacy waiver and lawful interception
Article 19 of Greek Constitution on confidentiality of correspondence and communication
Law 2225/94 on Protection and freedom of communications
Law 3917/11 on Retention of data that are intended for processing for legal purposes
Ν.4174/2013 Taxation procedures and relevant processes
Guideline 1/2005 of Greek Data Protection Authority for destroying personal data archives
Law 3758/2009 on Requirements For Collection Organizations and other issues
Data Protection (Bailiwick of Guernsey) Law of 2001
Comisión Nacional de Bancos y Seguros NORMAS PARA REGULAR LA ADMINISTRACIÓN DE LAS TECNOLOGÍAS DE INFORMACIÓN Y COMUNICACIONES EN LAS INSTITUCIONES DEL SISTEMA FINANCIERO CIRCULAR CNBS No.119/2005
Personal Data (Privacy) Ordinance (Office of the Privacy Commissioner for Personal Data – the Government of the Hong Kong Special Admin Region)
Business continuity planning supervisory policy manual – TM-G-2 (The Hong Kong Monetary Authority)
Circular to licensed corporations – “Business continuity planning against serious communicable diseases” (Securities and Futures Commission of Hong Kong)
HKMA Supervisory Policy Manual, BCP TM-G-2 V1 02.12.02 (Hong Kong Monetary Authority)
HKMA Supervisory Policy Manual, General Principles for Technology Risk Management TM-G-1 V.1 24.06.03 (Hong Kong Monetary Authority)
HKMA, Supervisory Policy Manual, Supervision of E-Banking TM-E-1 V.1 17.02.04 (Hong Kong Monetary Authority)
IT Security Guidelines – G3 (Information Technology Services Dept – The Government of the Hong Kong Special Admin Region)
Management, Supervision and Internal Control Guidelines (“the Internal Control Guidelines”) (Securities and Futures Commission of Hong Kong)
Act No. CVIII of 2001. on certain issues of electronic commerce services and information society services
Act No. XXXV. of 2001. on Electronic Signatures
Act No. C. of 2003. on Electronic Communications
Act No. CXL. of 2004. on the General Rules of Administrative Proceedings and Services
Act No. CLV. of 2009. Protection of classified information
Act No. CLVII. of 2010.Protection of the national data assets
Act No. CXII. of 2011. on Informational self-determination and Freedom of information (instead of the Act. No. LXIII. Of. 1992.)
Act No. CLXVI. of 2012. on the identification,designation and protection of critical infrastructures
Act No. L of 2013. on Electronic Information Safety of the Governmental and Municipal Organisations
Act of Protection of Individual; Processing Personal Data (Jan 2000)
Data Protection Act 1988 and Amendment Act 2003
The Electronic Privacy Regulations 2011 (S.I. 336 of 2011) giving effect to the EU ePrivacy Directive 2002/58/EC
The Criminal Damage Act 1991, Section 2,3,4,5
The Criminal Justice (Theft and Fraud Offences) Act 2001, Section 9
British-Irish Agreement Act, 1999, Section 51 – Data protection in cross-border bodies
EC (Protection of Consumers in respect of contracts made by means of distance communication) Regulations 2001
Employment (Information) Act 1994
Unfair Dismissal Acts, 1997 to 2001
European Convention of Human Rights Act 2003
Others which may be worth reviewing:
Communications (Retention of Data) Act 2011 – for Internet and Telephone Service Providers
Freedom of Information Acts 1997 and 2003 – for public sector bodies
The Official Languages Act 2003 – for public sector bodies
Offences Against the State Act – Section 30
The Convention on Cybercrime – is signed but not yet ratified by Ireland as of 1/5/2013
Information Technology Act as amended by Act of 2008
.IN Domain Name Registration Policy
.IN Domain Name Dispute Resolution Policy
Gujarat Information technology Rules, 2004
Karnataka Cyber Cafe Regulations
India BCP (1. Reserve Bank of India (RBI); 2. Securities & Exchange Board of India (SEBI); 3. National Stock Exchange (NSE); 4. Bombay Stock Exchange (BSE))
Companies Act, 1956 Income Tax Act,1961 Employees Provident Fund Act,1952
Information and Electronic Transaction / Undang-Undang Informasi dan Transaksi Elektronik(UU No.11 2008)
Regulation No 9/15/PBI/2007 (Bank Indonesia)
Regulation no. 6/8/PBI/2004 (Bank Indonesia)
Indonesia BCP (Bank Indonesia (Central Bank))
سند راهبردی امنیت فضای تبادل اطلاعات کشور – افتا
Unique Text on Privacy – Decreto Legislativo n° 196 del 30 giugno 2003 “Testo unico sulla Privacy”
Protection of persons and other subjects related to the processing of personal data – Legge L. 675/1996 del 31 dicembre 1996 “Tutela delle persone e di altri soggetti rispetto al trattamento dei dati personali” (Superseded by D.Lgs 196/2003)
Guidelines for implementation, management and maintenance of Business Continuity in the Banking Sector (ABI – Association of Italian Banks)
Guidelines for Crisis Management in the Banking Sector (ABI – Association of Italian Banks)
Personal Information Protection Law (Act)
Law for the Protection of Computer Processed Data Held by Administrative Organs, December 1988.
Business Continuity at Bank of Japan (BOJ (Bank of Japan))
Manual for the Development of Contingency Plans in Financial Institutions. Japan FSA (FISC (The Centre for Financial Industry Information System))
E-Transactions Law, 2001
Freedom of Information Act, 2007
Cyber Crime Law, 2010
Protection of Nation Secrets and Documentation, 1971
Government Regulation as of 30 Sept 2005. Instruction #359. (Financial Control Agency of Kazakhstan (local name – АФН))
Central Bank (CBK) Prudential Guidelines on BCM for Institutions Licenced under Banking Act. (The Central Bank of Kenya)
Act on Prevention of Divulgence and Protection of Industrial Technology
IT security policies and regulations:
Information technology security measures for critical infrastructure planning and implementation arrangements (February 2011)
Regulations on electronic communications companies information to be included in the Action Plan, the follow-up plan and the procedure for end users (April 2011)
Procedures for ensuring information and communication technology systems in compliance with the minimum safety requirements (July 2015)
State Information Systems Law
State Information System General safety requirements (October 2005)
Information systems security test guidelines
BCM provision for Payment and Securities Settlement Systems in Latvia (Latvjas Banka (Bank of Latvia))
Law on Legal Protection of Personal Data (June 1996)
Law on classified information – Закон за класифицирани информации – 9/2004 (last change113/2007)
Law on personal data protection – Закон за заштита на лични податоци – 7/2005
Law on free access to public information – Слободен пристап до информации од јавен карактер – 13/20006
Law on electronic communications – Закон за електронските комуникации – 13/2005 (last change55/2007)
Law on communications monitoring – Закон за следење на комуникациите – 121/2006
Law on electronic governance – Закон за електронско управување
E-Commerce Law – Закон за електронска трговија – 133/2007
Law for data in electronic form and electronic signature – Закон за податоците во електронски облик и електронски потпис – 34/2001 (last change 06/2002)
Law on Copyright and related rights – Закон за авторското право и сродните права – 47/1996 (last change 131/2007)
Law on industrial property – Закон за индустриската сопственост – 47/2002 (last change 79/2007)
Criminal code – Кривичен закон – 37/1996 (last change 7/08)
Common Law principle of confidentiality
Banking and Financial Institutions Act of 1989 privacy provisions
BNM/RH/GL013-3 Guidelines on BCM for Banking Institutions – July 2008 (Bank Negara Malaysia (BNM) – Central Bank of Malaysia)
Guidelines on Management of IT Environment (Bank Negara Malaysia (BNM) – Central Bank of Malaysia)
Cyberlaws in Malaysia (Digital Signature Act 1997; Computer Crime Act 1997; Telemedicine Act 1997; The Copyright (Amendment) Act 1997; The Communications and Multimedia Act 1998; The Electronic Government Activities Act 2007)
Data Protection Act (Act XXVI of 2001), Amended March 22, 2002, November 15, 2002 and July 15, 2003
Guidelines on Business Continuity and Contingency Procedures (The Central Bank of Malta)
Ley Federal de Transparencia y Acceso a la Información Pública Gubernamental (última reforma 2006) — Apicable al Gobierno Federal.
Manual Administrativo de Aplicación General en Materia de Tecnologías de Información y Comunicaciones (2010) — Aplicable al Gobierno Federal.
Ley Federal de Protección de Datos Personales en Posesión de Particulares (2010) — Aplicable a personas físicas y morales.
Personal Data Protection Act 2000
Data Breach Notification Requirement Act 2016
Privacy Act, May 1993; Privacy Amendment Act, 1993; Privacy Amendment Act, 1994
The Civil Defence & Emergency Management Act (2002)
Official information Act, 1982
Public records Act, 2005
New Zealand Cyber security strategy, June 2011
Data Protection Act 1998 Computer Security and Critical Information Infrastructure Protection Bill 2005
Personal Data Act (April 2000) – Act of 14 April 2000 No. 31 Relating to the Processing of Personal Data (Personal Data Act)
Risk Management – Guidelines for Commercial Banks and DFIs (State Bank of Pakistan (SBP))
LEY Nº 29733 Ley de protección de datos personales
542 (Philippines Central Bank)
269 (Philippines Central Bank)
268 (Philippines Central Bank)
Manila Bank BCP (Bank of Central Philippines (local central bank))
Act of the Protection of Personal Data (August 1997)
Business Continuity of Payment and Security Settlement Systems infra-structure (The National Bank of Poland)
Act on the Protection of Personal Data (Law 67/98 of 26 October)
Act on Attacks Against Information Systems (Law 109/2009 of 15 September)
Cyber crime law (law no. 14 of 2014)
Law No. 677/2001 on Protection of Persons concerning the Processing of Personal Data and the Free Circulation of Such Data
Law No. 506/2004 on Personal data processing and privacy in the electronic communications sector
Law No. 8/1996 on copyright and related rights
Personal Data (Law #152 of 26 January 2006)
STO BR IBBS-1.0-2010 (Central Bank of the Russian Federation (STO BR IBBS-1.0-2006))
242-P (Central Bank of the Russian Federation)
Telecommunications Act & Bylaws – Royal Decree No. M/12
Anti-Cyber Crime Law – Royal Decree No. M/17
Electronic Transactions Regulation – Royal Decree No. M/18
Law for Publishing and Disclosing Confidentials and Information – Royal Decree No. M/35
Law No.2008-08 on Electronic Transactions
Law No.2008-09 on Copyright and Related Rights
Law No.2008-10 on Orientation Law on the Information Society
Law No.2008-11 on Cybercrime
Law No.2008-12 on Protection of Personal Data
The E-commerce Code for the Protection of Personal Information and Communications of Consumers of Internet Commerce.
MAS Business Continuity Management Guidelines (June 2003) (MAS (Monetary Authority of Singapore)
SGX Member Rules Effective 22 January 2009 (SGX (Singapore Exchange Limited))
Computer Misuse and Cybersecurity Act (1998, Renamed in 2013)
Personal Data Protection Act 2012 (January 2013)
MAS Technology Risk Management (TRM) Notice and Guidelines June 2013 (Monetary Authority of Singapore)
Act No. 428 of 3 July 2002 on Personal Data Protection.
Personal Data Protection Act , RS No. 55/99.
Ministry for Provincial & local Government Disaster Management Act, 2002
Major Hazard Installation Regulations, 1993 (Occupational Health & Safety)
SAMOS and CLS Business Continuity Procedures – SA Reserve Bank (South African Reserve Bank National Payment System Department)
The Act on Promotion of Information and Communications Network Utilization and Data Protection of 2000
Act on Assistance to the Autonomous Activities of Enterprises for Disaster Mitigation (National Emergency Management Agency (NEMA))
Korea BCP (Financial Supervisory Commission)
Supervisory Guidelines for BCP (New Basel Accord Office, Financial Supervisory Service (FSS))
Real Decreto-Legislativo 1/1996, de 12 de abril, por el que se aprueba el Texto Refundido de la ley de propiedad intelectual.
Ley 56/ 2007 o Ley para el Impulso de la Sociedad de la Información.
Other documents issued by public bodys (non law status):
Magerit – versión 2. Metodología de Análisis y Gestión de Riesgos de los Sistemas de Información
Guías CCN-STIC para la seguridad de los sistemas de la Administración Pública
Guidelines on Business Continuity Planning (Insurance Board of Sri Lanka)
The Federal Law on Data Protection of 1992
FINMA Recommendations for BCM: Nov 2007 (Swiss Financial Market Supervisory Authority)
SFBC 06/6 (Swiss Federal Banking Commission (SFBC))
SFBC 06/3 (SFBC)
SBA Self Regulation (Swiss Bankers Association)
Personal Data Protection Act (1998:204), October 24, 1998
Regulations and General Guidelines regarding information security, IT operations and deposit systems (Finansinspektionen’s (FSA) Regulatory Code FFFS 2014:5)
Computer Processed Personal data Protection Law – applies only to public institutions.
Official Information Act (1997) for state agencies
118/2550 – Policy on BCM and BCP for Financial Institutions (Bank of Thailand)
6102 sayılı Türk Ticaret Kanunu (TTK), md.18.3: Kayıtlı elektronik posta
6102 sayılı Türk Ticaret Kanunu (TTK), Md.57: Haksız Rekabet
6102 sayılı Türk Ticaret Kanunu (TTK), Md.64: Haksız Rekabet
6102 sayılı Türk Ticaret Kanunu (TTK), Md.65: Haksız Rekabet
6102 sayılı Türk Ticaret Kanunu (TTK), Md.1524: Elektronik işlemler ve bilgi toplumu hizmetleri
5237 sayılı Türk Ceza Kanunu md.239
5237 sayılı Türk Ceza Kanunu md.244
5271 sayılı Ceza Muhakemesi Kanunu m.134 Bilgisayarlarda, bilgisayar programlarında ve kütüklerinde arama, kopyalama ve elkoyma
5846 sayılı Fikir Ve Sanat Eserleri Kanunu (FSEK)
38790 tarihli 26108 sayılı Resmi Gazetede yayınlanan ‘Sanal Ortamda Oynatılan Talih Oyunları Hakkında Yönetmelik’
41114 tarihli 28363 sayılı Resmi Gazetede yayınlanan ‘Elektronik Haberleşme Sektöründe Kişisel Verilerin İşlenmesi Ve Gizliliğinin Korunması Hakkında Yönetmelik’
40608 tarihli 27866 sayılı Resmi Gazetede yayınlanan ‘Mesafeli Sözleşmelere Dair Yönetmelik’
40783 tarihli 28036 sayılı Resmi Gazetede yayınlanan ‘Kayıtlı Elektronik Posta Sistemine İlişkin Usul Ve Esaslar Hakkında Yönetmelik’
40890 tarihli 28141 sayılı Resmi Gazetede yayınlanan ‘Elektronik Defter Genel Tebliği’
41284 tarihli 28524 sayılı Resmi Gazetede yayınlanan ‘Gümrük İşlemlerinin Kolaylaştırılması Yönetmeliği’
39416 tarihli 26716 sayılı Resmi Gazetede yayınlanan ‘İnternet Ortamında Yapılan Yayınların Düzenlenmesine Dair Usul Ve Esaslar Hakkında Yönetmelik’
38358 tarihli 25692 sayılı Resmi Gazetede yayınlanan ‘Elektronik İmza Kanununun Uygulanmasına İlişkin Usul Ve Esaslar Hakkında Yönetmelik’
38666 tarihli 25989 sayılı Resmi Gazetede yayınlanan ‘Telekomünikasyon Yoluyla Yapılan İletişimin Tespiti, Dinlenmesi, Sinyal Bilgilerinin Değerlendirilmesi Ve Kayda Alınmasına Dair Usul Ve Esaslar İle Telekomünikasyon İletişim Başkanlığının Kuruluş, Görev Ve Yetkileri Hakkında Yönetmelik’
39127 tarihli 26434 sayılı Resmi Gazetede yayınlanan ‘Telekomünikasyon Yoluyla Yapılan İletişimin Denetlenmesi, Gizli Soruşturmacı ve Teknik Araçlarla İzleme Tedbirlerinin Uygulanmasına İlişkin Yönetmelik’
40489 tarihli 27752 sayılı Resmi Gazetede yayınlanan ‘İnternet Alan Adları Yönetmeliği’
Computer Misuse Act (2011)
Electronic Transactions Act (2011)
Electronic Signatures Act (2011)
UK Electronic Communications Act 2000
The Telecommunications (lawful Business Practice and Interception of Communications) Regulations 2000
The Electronics Signatures Regulations 2002
The Telecommunications (Data Protection & Privacy, Direct Marketing) Regulations 1999
The Consumer Protection (Distance Selling) Regulations 2003
Civil Contingencies Act (2004 & 2005) (UK Government)
Business Continuity Practice Guide: 2006 (UK Tripartite Authorities: Financial Services Authority (FSA), HM Treasury, Bank of England)
Copyright, Designs and Patents Act 1988 (CDPA)
Companies Act 2006 contains a number of provisions concerning records and communications
6 CFR Part 29 Procedures for Handling Critical Infrastructure Information – Department of Homeland Security
ACH Rules Book of 2001 (National Automated Clearing House Association – NACHA)
Cable Communications Policy Act (Cable Act) of 1984
California SB 1386 Security of Non-encrypted Customer Information of 2003 (State of California) and progeny
The Californian Online Privacy Protection Act of 2004
Children’s Internet Protection Act (CIPA) of 2001
Computer Fraud and Abuse Act (CFAA) of 1986 (FTC – Federal Trade Commission)
Computer Security Act of 1987 – (Superseded by the Federal Information Security Management Act (FISMA)
Consumer Credit Protection Act (CCPA) of 1992 Section 2001 Title IX – Electronic Funds Transfer
Defense Federal Acquisition Regulation Supplement (DFARS) (aka NIST 800-171)
Electronic Freedom of Information Act (E-FOIA) of 1996
Electronic Fund Transfer Act (EFTA) (OCC)
Fair and Accurate Credit Transactions Act (FACTA) – including “Red Flags” rule
Family Education Rights and Privacy Act (FERPA; also know as the Buckley Amendment) of 1974
Federal Acquisition Regulation (FAR): Electronic Funds Transfer Final Rule (Securities and Exchange Commission)
Federal Information Security management Act (FISMA) of 2002 (FTC)
Federal Trade Commission Act (FTCA) of 1999
FERC COOP 2007: FERC RM01-12-00 (FERC – Federal Energy Regulatory Commission)
FFIEC FIL 67-97/82-96 (FFIEC – Federal Financial Institutions Examination Council)
FFIEC Policy SP-5 (FFIEC – Federal Financial Institutions Examination Council)
FIPA – Florida Information Protection Act of 2014
Foreign Corrupt Practices Act 1977 (P.L 95-213)
Gramm-Leach-Bliley Financial Services Modernization Act (GLBA) of 1999
Health Insurance Portability and Accountability Act (HIPAA) Final Security Rule #7. Contingency Plan 164.308 (a)(7)(i) / HITECH Act
Inter-Agency Policy of 1997 from Federal Financial Institutions Examination Council (FFIEC)
Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System of 2003 – Federal Reserve System; OCC (Office of the Comptroller of the Currency); SEC (Securities and Exchange Commission)
IRS Procedure 91-59 (superseded IRS Procedure 86-19) (IRS – Internal Revenue Service)
Massachusetts 201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth of 2010
Minnesota Plastic Card Security Act (PCSA) of 2007
NASD Rule 108 (Sept 9, 02) and SR-NASD 2002-112 (March 10 2003)(Release No. 34-48503: File NO SR-NASD-2002-108)(NASD (North American Securities Dealers Association) / SEC)
NASD Rule 3500: Emergency Preparedness Part 3510: Business Continuity Plans (NASD)
NASD Rule 3500: Emergency Preparedness Parts 3520: Emergency Contact information (NASD)
NERC(North American Electric Reliability Corporation)(CIP) Critical Infrastructure Protection – Cyber Security
Nevada Security of Personal Information Law of 2005
New York Department of Financial Services 23 NYCRR 500
NFA Compliance Rule 2-38: Business Continuity and Disaster Recovery Plan (CFTC – Commodity Futures Trading Commission)
NYSE Rule 446 : Business Continuity and Contingency Planning (NYSE – New York Stock Exchange)
OCC 2001-47. Third Party Relationships of 2001 (OCC – Office of the Comptroller of the Currency)
Privacy Act of 1974 (SUSC552a)
Privacy Protection Act (PPA) of 1980
Public Law 110-53 Title IX (PS Prep)
Right to Financial Privacy Act (RFPA) of 1978
Sarbanes-Oxley Act of 2002 (PL 107-204 2002 HR 3763) – Section 404 (PCAOB (Public Company Accounting Oversight Board))
Sarbanes-Oxley Act of 2002 : Section 409 (PCAOB)
Securities and Exchange Act, Sections 32(a) and (b) (SEC)
Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act (USA PATRIOT Act) of 2001
Video Privacy Protection Act of 1988 discussion and overview
Washington State HB 1149: Protecting consumers from breaches of security of 2009
Special Law Against Cybercrime Official Gazette No. 37,313 of the Bolivarian Republic of Venezuela dated 30 October 2001
Law data messages and electronic signatures Official Gazette No. 37,148 dated February 28, 2001
Policy Information Technology, Financial Services dematerialized, Electronic Banking and Online Virtual Bodies for Submitted to the Control, Regulation and Supervision of Banks and Other Financial Institutions, Caracas, March 2007.
Law credit cards, debit cards, prepaid cards and other financing or electronic payment, dated September 4, 2008.
Rules governing the use of electronic banking services Official Gazette No. 39597 dated January 19, 2011
The Law on Electronic Transactions 2008
Glossary of information security and business continuity terms
The basic logic of ISO 27001: How does information security work?

References: Resolución 
 artículo 15
 artículo 20
 Artículo 1
 artículo 15
 artículo 20