ARCHIVED CONTENT
You are viewing ARCHIVED CONTENT released online between 1 April 2010 and 24 August 2018 or content that has been selectively archived and is no longer active. Content in this archive is NOT UPDATED, and links may not function.Extract from article by Conor Ward
There are currently no mandatory reporting requirements under UK law specific to cybersecurity incidents except in relation to those communications service providers that are subject to the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended). However, where personal data has been compromised or destroyed, it is generally accepted practice to notify the Information Commissioner’s Office — as a failure to notify may well be taken into account when the ICO decides on what sanctions (if any) should be levied as a result of the incident.
For regulated entities, regulators may require notification of cybersecurity incidents in particular where they are as a result of a breakdown in systems and controls or where there was an actual or potential risk to the provision of the services or to customers.
However, this is all about to change as a result of the following EU legislation that has been adopted and that will come into effect during the course of 2018:
- The Network and Information Security Directive (NIS Directive): The NIS Directive is the cornerstone of the European Union’s cybersecurity legislative policy. EU Member states have until May 10, 2018 to adopt implementing legislation. The NIS Directive sets cybersecurity obligations for operators of essential services (as selected by individual Member States) and digital service providers. For many organizations, the directive imposes the first breach reporting requirement in Europe.
- General Data Protection Regulation (GDPR): The GDPR represents a major overhaul to existing European data protection law. The key provisions impose security obligations directly on data controllers and processors of personal data and introduce mandatory personal data breach reporting obligations. As it is a Regulation, the GDPR will take direct effect in the UK on May 25, 2018.
- Payment Services Directive 2 (PSD 2): PSD 2 is a sector-specific European Directive that will impose cybersecurity requirements on payment service providers (PSPs), including banks. The Directive must be implemented by member states by January 13, 2018. Affected organizations will be obliged to report security incidents to regulators. If a security incident could impact a customer’s financial interests, those customers must also be notified.
Read the complete article at The UK’s Cybersecurity Regulatory Landscape: An Overview
