Lebanon

Requires banks, finance companies and other institutions regulated by Banque du Liban to take measures in line with the EU GDPR, to notify the BDL Compliance Unit and the Banking Control Commission of them by 31 December 2018 (appointing a data protection officer from the Compliance Unit and an EU representative, and amending the compliance programme), and to have external auditors verify compliance (Arts. 1-2). It sets no data breach notification duty.

Requires banks and financial institutions to adopt cybercrime prevention policies (Art. 1), controls on electronically received transfer orders (Art. 2) and incident response including reporting to the SIC (Art. 3). The Compliance Department is responsible for implementation (Art. 4).

Tells financial institutions to notify the Banking Control Commission in writing as soon as they learn of a breach of trust, embezzlement, forgery or material accidental incident, whether the act comes from inside or outside the institution. The notice must cover the date, causes, losses and insurance cover, preventive measures and any legal complaints, and the internal audit report must follow. No fixed number of days is set.

Bars insiders, and anyone who obtained inside information through their work, from trading on it, passing it to third parties or advising others to trade on it. Penalties are one to three years' imprisonment and a fine of two to ten times the gain realised, and a court may bar the offender from their profession. It takes effect on publication in the Official Gazette.

Requires each bank to prepare a business continuity plan covering disaster prevention and detection, operation during and after a disaster and the return to normal (Art. 1), built on ISO/IEC 27002-2005 principles including alternate site, data transfer, security and testing (Art. 2). External auditors check that a plan exists and is adequate (Art. 4). The text does not address outsourcing or cloud services.

Establishes the independent banking supervision commission at Banque du Liban (Art. 8) and charges it with verifying that the banking regime in the Code of Money and Credit is applied to each bank, with periodic audits of all banks (Art. 9). Art. 8 as amended by Law 4/85 gives the commission five members.