page_title: Information security
section_title: Laws and regulations
hierarchical_section_title: Information security / Laws and regulations
caption_attribution_description: English: Privacy International 2007 privacy ranking &#160;&#160; Consistently upholds human rights standards &#160;&#160; Significant protections and safeguards &#160;&#160; Adequate safeguards against abuse &#160;&#160; Some safeguards but weakened protections &#160;&#160; Systemic failure to uphold safeguards &#160;&#160; Extensive surveillance societies &#160;&#160; Endemic surveillance societies Deutsch: Privacy ranking von 2007 durch Privacy International &#160;&#160; Konsistente Hochhaltung der Menschenrechte &#160;&#160; Signifikanter Schutz und Sicherungsmaßnahmen &#160;&#160; Adäquate Sicherungsmaßnahmen gegen Missbrauch &#160;&#160; Einige Sicherungsmaßnahmen aber geschwächter Schutz &#160;&#160; Systematisches Versagen die Sicherungsmaßnahmen aufrechtzuerhalten &#160;&#160; Verbreitete Überwachungsgesellschaften &#160;&#160; Endemische Überwachungsgesellschaften
context_page_description: Information security, sometimes shortened to infosec, is the practice of protecting information by mitigating information risks. It is part of information risk management. It typically involves preventing or at least reducing the probability of unauthorized/inappropriate access to data, or the unlawful use, disclosure, disruption, deletion, corruption, modification, inspection, recording or devaluation of information. It also involves actions intended to reduce the adverse impacts of such incidents. Protected information may take any form, e.g. electronic or physical, tangible or intangible. Information security's primary focus is the balanced protection of the confidentiality, integrity and availability of data while maintaining a focus on efficient policy implementation, all without hampering organization productivity. This is largely achieved through a structured risk management process that involves:
  Identifying information and related assets, plus potential threats, vulnerabilities and impacts;
  Evaluating the risks;
  Deciding how to address or treat the risks i.e. to avoid, mitigate, share or accept them;
context_section_description: Below is a partial listing of governmental laws and regulations in various parts of the world that have, had, or will have, a significant effect on data processing and information security. Important industry sector regulations have also been included when they have a significant impact on information security.
  The UK Data Protection Act 1998 makes new provisions for the regulation of the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information. The European Union Data Protection Directive (EUDPD) requires that all E.U. members adopt national regulations to standardize the protection of data privacy for citizens throughout the E.U.
  The Computer Misuse Act 1990 is an Act of the U.K. Parliament making computer crime (e.g., hacking) a criminal offense. The act has become a model upon which several other countries, including Canada and the Republic of Ireland, have drawn inspiration from when subsequently drafting their own information security laws.
  The E.U.'s Data Retention Directive (annulled) required internet service providers and phone companies to keep data on every electronic message sent and phone call made for between six months and two years.
  The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232 g; 34 CFR Part 99) is a U.S. Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record.
  The Federal Financial Institutions Examination Council's (FFIEC) security guidelines for auditors specifies requirements for online banking security.
  The Health Insurance Portability and Accountability Act (HIPAA) of 1996 requires the adoption of national standards for electronic health care transactions and national identifiers for providers, health insurance plans, and employers. Additionally, it requires health care providers, insurance providers and employers to safeguard the security and privacy of health data.
  The Gramm–Leach–Bliley Act of 1999 (GLBA), also known as the Financial Services Modernization Act of 1999, protects the privacy and security of private financial information that financial institutions collect, hold, and process.
  Section 404 of the Sarbanes–Oxley Act of 2002 (SOX) requires publicly traded companies to assess the effectiveness of their internal controls for financial reporting in annual reports they submit at the end of each fiscal year. Chief information officers are responsible for the security, accuracy and the reliability of the systems that manage and report the financial data. The act also requires publicly traded companies to engage with independent auditors who must attest to, and report on, the validity of their assessments.
  The Payment Card Industry Data Security Standard (PCI DSS) establishes comprehensive requirements for enhancing payment account data security. It was developed by the founding payment brands of the PCI Security Standards Council — including American Express, Discover Financial Services, JCB, MasterCard Worldwide and Visa International — to help facilitate the broad adoption of consistent data security measures on a global basis. The PCI DSS is a multifaceted security standard that includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures.
  State security breach notification laws (California and many others) require businesses, nonprofits, and state institutions to notify consumers when unencrypted "personal information" may have been compromised, lost, or stolen.
  The Personal Information Protection and Electronics Document Act (PIPEDA) of Canada supports and promotes electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communic
caption: Privacy International 2007 privacy ranking
  green: Protections and safeguards
  red: Endemic surveillance societies
exif: {}