Operational and ICT incident reporting to the Bank of Albania Albania Initial report within 4 hours of classifying an event as critical; classification no later than 24 hours after discovery
— source View →
Outsourcing risk assessment and monitoring Albania — — source View →
Designate a person responsible for information systems security Algeria — — source View →
Retain user and traffic data for investigators Algeria 1 year from recording
— source View →
Cyber-incident reporting by financial institutions Angola First report after detection; updates every 4 hours until service is restored
— source View →
Notification to the BNA before contracting cloud services Angola At least 60 days before contracting; 90 days before changes
— source View →
Ransomware and cyber extortion payment reporting Australia Within 72 hours of the payment or of becoming aware of it
— source View →
Reporting major ICT-related incidents to the FMA Austria Initial: within 4 hours of classification and no later than 24 hours from discovery; intermediate: 72 hours after the initial report; final: within one month of the last intermediate report
— source View →
ICT third-party register and notification of critical outsourcing Austria Register submitted annually in a window announced each year; contract notifications 'in a timely manner'
— source View →
Cybersecurity incident reporting by essential and important entities Austria Early warning within 24 hours of becoming aware; notification within 72 hours; final report within one month of the notification
— source View →
Prior CBB approval for material outsourcing Bahrain At least 6 weeks before committing
— source View →
Report cyber incidents to the Financial Services Commission Barbados Within 4 hours after classification; classification within 24 hours of detection
— source View →
Major operational or security incident reporting Benin Notice without delay; report within 72 hours
— source View →
Digital signature and ATT-authorised certificates for documents in the national payment system Bolivia Ongoing; retention of at least 10 years for certificate data and signed documents
— source View →
Providers of public services to accept digitally signed documents and digital-citizenship acts Bolivia — — source View →
Personal data breach notification to the ANPD and data subjects Brazil Within 3 business days; preliminary notice completed within 20 business days
— source View →
Retention of internet connection and application access logs Brazil Connection logs 1 year; application access logs 6 months
— source View →
Notification of cloud and data-processing outsourcing to the Central Bank (financial institutions) Brazil Within 10 days after contracting; 60 days before contracting abroad without an information-exchange agreement
— source View →
Notification of cloud and data-processing outsourcing to the Central Bank (payment institutions) Brazil Within 10 days after contracting; 60 days before contracting abroad without an information-exchange agreement
— source View →
Cyber incident reporting to SUSEP Brazil Within 5 business days of learning of the event
— source View →
Notification of cloud and data-processing outsourcing to SUSEP Brazil Within 30 days after signing the contract
— source View →
Cyber incident reporting by financial institutions Brunei Within 1 hour of discovery; assessment within 2 hours
— source View →
Major operational and cyber incident reporting (payment institutions) Burkina Faso Without delay; detailed report within 72 hours
— source View →
Operational risk framework and incident notification to the Bank of Canada Canada No later than 48 hours after determining the incident is material
— source View →
Technology and cyber incident reporting to OSFI Canada Within 24 hours, or sooner if possible
— source View →
Business continuity plan and IT backup for credit institutions Central African Republic — — source View →
Report significant cyber incidents to the national CSIRT Chile Early alert within 3 hours; update within 72 hours; final report within 15 calendar days
— source View →
Report cybersecurity incidents within 1, 2 or 4 hours China 1 hour (CII operators), 2 hours (central government departments), 4 hours (others)
— source View →
Report data security incidents to NFRA within 2 hours China Within 2 hours; written report within 24 hours
— source View →
Report significant IT outsourcing to the regulator 20 working days before signing China 20 working days before the contract is signed
— source View →
Anti-fraud controls against online scams Costa Rica Notifications within one minute of each transaction (Art. 15)
— source View →
Major incident notification by payment institutions Côte d'Ivoire Without delay; detailed report within 72 hours
— source View →
Prior notice of outsourcing of critical functions Côte d'Ivoire At least 30 days before outsourcing a critical function
— source View →
Report ICT security incidents immediately Cuba Immediately ("inmediata"); no fixed deadline
— source View →
Major ICT-related incident reporting under DORA Denmark Initial: within 4 hours of classification and no later than 24 hours after awareness; intermediate: within 72 hours; final: within one month
— source View →
Significant incident notification under the NIS 2 Act Denmark Early warning within 24 hours; notification within 72 hours; final report within one month
— source View →
Certification entities: send an annual external security audit and submit new certificates for approval Ecuador Annually, within the first 15 days of the following year
— source View →
Retain service-provider user and traffic data for 180 days Egypt 180 days
— source View →
Cyber incident reporting to the Central Bank Eswatini Within 2 hours of verifying the incident; report by the 4th working day
— source View →
Hosting provider notification to the Commission (condition of liability exemption) Eswatini Promptly on becoming aware
— source View →
Notify the Reserve Bank of material cybersecurity incidents Fiji Within 24 hours of becoming aware (s.17.2); quarterly report in Form QCR (Appendix 2)
— source View →
Report major ICT-related incidents to the ACPR France Within 4 hours of classification as major, and within 24 hours of detection
— source View →
Personal data breach notification Gabon Without undue delay
— source View →
NIS-2 cybersecurity risk-management measures Germany Continuous
— source View →
Personal data breach notification Ghana As soon as reasonably practicable after discovery
— source View →
Report cybersecurity incidents (critical information infrastructure owners) Ghana Within 24 hours of detection
— source View →
Incident notification to the National Cybersecurity Authority (NIS2) Greece Early warning 24 hours; update 72 hours; final report 1 month
— source View →
Major ICT incident reporting and ICT third-party register (DORA) Greece Deadlines per RTS (EU) 2025/301
— source View →
Periodic conformity assessment audit of qualified trust service providers Greece At least every 24 months
— source View →
Reporting of major operational and cyber incidents to the BCEAO Guinea-Bissau Without delay; detailed report within 72 hours
— source View →
Prior notice of outsourcing of critical operational functions Guinea-Bissau At least 30 days before execution
— source View →
Report computer-system security incidents to the Commissioner's Office Hong Kong 12 hours (serious) or 48 hours (other); written report within 14 days
— source View →
Cloud services: register and information to the MNB Hungary — — source View →
Cybersecurity registration of covered organisations Hungary Within 30 days of coming under the Act
— source View →
Incident notification by operators of essential services Iceland As soon as possible ('svo fljótt sem verða má')
— source View →
Report cyber incidents to RBI within six hours (non-bank payment system operators) India Within 6 hours of detection
— source View →
Report cyber incidents to CERT-In within six hours India Within 6 hours of noticing the incident
— source View →
Keep system logs for 180 days within India India Rolling 180 days (logs); 5 years (VASP KYC and transaction records)
— source View →
Adopt a Board-approved outsourcing policy and give RBI access to outsourced records (commercial banks) India Ongoing; existing IT outsourcing agreements to comply at renewal or by 10 April 2026, whichever is earlier
— source View →
Report outsourced-provider cyber incidents and data leakage to RBI (commercial banks) India Within 6 hours of detection by the provider; immediately for data leakage
— source View →
Comply with the Cybersecurity and Cyber Resilience Framework (SEBI regulated entities) India Effective 1 January 2025 or 1 April 2025 depending on entity category
— source View →
Personal data breach notification by electronic communications providers Ireland Without undue delay
— source View →
Cyber incident and technology failure reporting (banks) Israel Phone within 2 hours; written within 8 hours of the phone report
— source View →
Prompt cyber-incident reporting to authorities by financial institutions Japan Promptly; no deadline stated in the guideline
— source View →
Third-party, outsourcing and cloud risk management Japan — — source View →
Cyber incident reporting by banks to the CBK Kenya Within 24 hours of the incident; quarterly report by the 10th day after quarter end
— source View →
Business continuity plan Lebanon Plan within one year of the 2009 decision; simulation at least once; update on changes
— source View →
Reporting of IT and operational disruptions to the Banking Control Commission Lebanon Within 24 hours of confirming the incident
— source View →
Outsourcing of IT services: due diligence, contract terms and exit arrangements Lebanon Before outsourcing; ongoing monitoring
— source View →
Personal data breach notification Lesotho As soon as reasonably possible after discovery (s. 23)
— source View →
Outsourcing notice and ICT security for e-money issuers Lesotho Prior notice before outsourcing
— source View →
Confidentiality and security of telecom customer data Liberia Ongoing
— source View →
Practising permit for cybersecurity service providers Libya Before offering the services
— source View →
Cyber-incident reporting to the Stabsstelle Cyber-Sicherheit Liechtenstein Early warning 24 hours; notification 72 hours; final report within one month
— source View →
ICT third-party (outsourcing and cloud) risk management Liechtenstein — — source View →
Outsourcing notification to the CSSF (Circular 22/806) Luxembourg 3 months before; 1 month with a Luxembourg support PFS
— source View →
Notification of planned ICT third-party arrangements for critical or important functions (DORA entities) Luxembourg At least 3 months before; 1 month with a Luxembourg support PFS
— source View →
Cybersecurity incident reporting by critical infrastructure operators Macao No fixed time limit stated for ordinary incidents; immediate response for serious incidents
— source View →
Consult Bank Negara Malaysia before first-time public cloud adoption Malaysia Before first-time public cloud adoption for critical systems
— source View →
Customer information breach notification to Bank Negara Malaysia and customers Malaysia Immediately on becoming aware; detailed report within 1 working day after Board tabling
— source View →
Major operational incident reporting (payment institutions) Mali Without delay; detailed report within 72 hours of notification
— source View →
Annual independent IT security audit for critical information infrastructure Mauritius Annually or after major changes
— source View →
Notify data subjects of security breaches Mexico Immediately (no fixed period stated)
— source View →
ICT incident reporting by payment service providers to the NBM Moldova Initial notice same or next working day; intermediate 3 days; final 20 days
— source View →
Outsourcing approval and notification by banks Moldova Prior approval for material outsourcing; notifications within 10 working days
— source View →
Personal data breach notification Monaco As soon as possible, if possible within 72 hours of becoming aware
— source View →
Cyber-incident notification Mongolia Immediately
— source View →
Notify the Central Bank before outsourcing critical or important functions Montenegro No later than 60 days before the arrangement
— source View →
Cybersecurity incident declaration to the national authority Morocco As soon as the entity becomes aware (Art. 8); without delay (Art. 30)
— source View →
Authorisation or notification of outsourcing, cloud and offshore data hosting Mozambique Authorisation before moving; Bank decides within 30 days
— source View →
Cyber incident notification by banking institutions Namibia Immediately; formal submission within 24 hours of detection (paras 12.1, 12.5)
— source View →
Cyber incident notification by payment service providers Namibia Within 24 hours of a successful cyberattack (s 11.23)
— source View →
Notification and approval of material outsourcing arrangements Namibia Prior notification and authorisation at least 30 working days before signing (s 9.1)
— source View →
Notify the GCSB before certain telecommunications network changes New Zealand Before making the change
— source View →
Report technology incidents to the Superintendencia Nicaragua Notify immediately; outcome and corrective actions within 24 hours
— source View →
Reporting of major operational incidents to the BCEAO Niger Without delay; detailed report within 72 hours
— source View →
Report significant incidents under the Digital Security Act Norway Without undue delay (sections 8 and 11); NSM states 24 hours for essential-service providers
— source View →
Notify the CBO of outsourcing arrangements Oman Within five working days of signing
— source View →
Report significant data breaches to the CBO and affected consumers Oman Without undue delay
— source View →
Personal data breach notification to the President of UODO Poland Without undue delay and, where feasible, within 72 hours of becoming aware
— source View →
No obligations for this country.
