Cyber Security Act 2024 (Cyber Security Act 2024 [Act 854]): in force, As of 2026-10-12 · Source (opens in a new window)
Risk Management in Technology (RMiT)
Risk Management in Technology (RMiT) (Risk Management in Technology (RMiT), BNM/RH/PD 028-98): Guidance, As of 2026-10-12 · Source (opens in a new window)
personal data
Personal Data Protection Act 2010
Personal Data Protection Act 2010 (Akta Perlindungan Data Peribadi 2010 [Akta 709]): in force, As of 2026-10-12 · Source (opens in a new window)
Personal Data Protection (Amendment) Act 2024
Personal Data Protection (Amendment) Act 2024 (Akta Perlindungan Data Peribadi (Pindaan) 2024 [Akta A1727]): in force, As of 2026-10-12 · Source (opens in a new window)
critical infrastructure
Cyber Security Act 2024
Cyber Security Act 2024 (Cyber Security Act 2024 [Act 854]): in force, As of 2026-10-12 · Source (opens in a new window)
cross-border data
Personal Data Protection Act 2010
Personal Data Protection Act 2010 (Akta Perlindungan Data Peribadi 2010 [Akta 709]): in force, As of 2026-10-12 · Source (opens in a new window)
Guidelines on Cross-Border Personal Data Transfer (unofficial English translation of the name)
Guidelines on Cross-Border Personal Data Transfer (unofficial English translation of the name) (Garis Panduan Perlindungan Data Peribadi Pemindahan Data Peribadi Rentas Sempadan (CBPDT)): Guidance, As of 2026-10-12 · Source (opens in a new window)
incident reporting
Commissioner's Circular No. 2 of 2025 (Data Breach Notification) (unofficial English translation of the name)
Commissioner's Circular No. 2 of 2025 (Data Breach Notification) (unofficial English translation of the name) (Pekeliling Pesuruhjaya Perlindungan Data Peribadi Bilangan 2 Tahun 2025 (Pemberitahuan Pelanggaran Data)): Guidance, As of 2026-10-12 · Source (opens in a new window)
Guidelines on Personal Data Breach Notification (unofficial English translation of the name)
Guidelines on Personal Data Breach Notification (unofficial English translation of the name) (Garis Panduan Perlindungan Data Peribadi Pemberitahuan Pelanggaran Data): Guidance, As of 2026-10-12 · Source (opens in a new window)
finance sector rules
Risk Management in Technology (RMiT)
Risk Management in Technology (RMiT) (Risk Management in Technology (RMiT), BNM/RH/PD 028-98): Guidance, As of 2026-10-12 · Source (opens in a new window)
telecom sector rules
Communications and Multimedia Act 1998
Communications and Multimedia Act 1998 (Communications and Multimedia Act 1998 [Act 588]): in force, As of 2026-10-12 · Source (opens in a new window)
Cybersecurity Code of Practice for Critical Information Infrastructure 2026
Cybersecurity Code of Practice for Critical Information Infrastructure 2026 (The Cybersecurity Code of Practice for Critical Information Infrastructure 2026): Code of practice, As of 2026-10-12 · Source (opens in a new window)
Criminal Law (Miscellaneous Amendments) Act 2025 (Criminal Law (Miscellaneous Amendments) Act 2025 (No. 21 of 2025)): enacted, not yet in force, As of 2026-10-12 · Source (opens in a new window)
Compliance checklist for Hong Kong
cybersecurity
Protection of Critical Infrastructures (Computer Systems) Ordinance
Protection of Critical Infrastructures (Computer Systems) Ordinance (Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)): in force, As of 2026-10-12 · Source (opens in a new window)
Code of Practice (Generic), Version 1.0
Code of Practice (Generic), Version 1.0 (Code of Practice Pursuant to the Protection of Critical Infrastructures (Computer Systems) Ordinance, Version 1.0): Code of practice, As of 2026-10-12 · Source (opens in a new window)
Protection of Critical Infrastructures (Computer Systems) Ordinance
Protection of Critical Infrastructures (Computer Systems) Ordinance (Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)): in force, As of 2026-10-12 · Source (opens in a new window)
Code of Practice (Generic), Version 1.0
Code of Practice (Generic), Version 1.0 (Code of Practice Pursuant to the Protection of Critical Infrastructures (Computer Systems) Ordinance, Version 1.0): Code of practice, As of 2026-10-12 · Source (opens in a new window)
incident reporting
Protection of Critical Infrastructures (Computer Systems) Ordinance
Protection of Critical Infrastructures (Computer Systems) Ordinance (Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)): in force, As of 2026-10-12 · Source (opens in a new window)
Code of Practice (Generic), Version 1.0
Code of Practice (Generic), Version 1.0 (Code of Practice Pursuant to the Protection of Critical Infrastructures (Computer Systems) Ordinance, Version 1.0): Code of practice, As of 2026-10-12 · Source (opens in a new window)
Supervisory Policy Manual TM-C-1: Supervisory Approach on Cyber Risk Management
Supervisory Policy Manual TM-C-1: Supervisory Approach on Cyber Risk Management: Guidance, As of 2026-10-12 · Source (opens in a new window)
telecom security
Protection of Critical Infrastructures (Computer Systems) Ordinance
Protection of Critical Infrastructures (Computer Systems) Ordinance (Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)): in force, As of 2026-10-12 · Source (opens in a new window)
cybercrime
Computer-crime provisions of the Crimes Ordinance and the Telecommunications Ordinance (unofficial English translation of the name)
Computer-crime provisions of the Crimes Ordinance and the Telecommunications Ordinance (unofficial English translation of the name) (Crimes Ordinance (Cap. 200) ss.60 and 161; Telecommunications Ordinance (Cap. 106) s.27A): in force, As of 2026-10-12 · Source (opens in a new window)
finance sector rules
Supervisory Policy Manual TM-C-1: Supervisory Approach on Cyber Risk Management
Supervisory Policy Manual TM-C-1: Supervisory Approach on Cyber Risk Management: Guidance, As of 2026-10-12 · Source (opens in a new window)
Compliance checklist for Japan
cybersecurity
Basic Act on Cybersecurity (unofficial English translation of the name)
Basic Act on Cybersecurity (unofficial English translation of the name) (サイバーセキュリティ基本法（平成二十六年法律第百四号）): in force, As of 2026-10-12 · Source (opens in a new window)
Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name)
Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name) (重要電子計算機に対する不正な行為による被害の防止に関する法律（令和七年法律第四十二号）): partly in force, As of 2026-10-12 · Source (opens in a new window)
personal data
Act on the Protection of Personal Information (unofficial English translation of the name)
Act on the Protection of Personal Information (unofficial English translation of the name) (個人情報の保護に関する法律（平成十五年法律第五十七号）): in force, As of 2026-10-12 · Source (opens in a new window)
critical infrastructure
Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name)
Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name) (重要電子計算機に対する不正な行為による被害の防止に関する法律（令和七年法律第四十二号）): partly in force, As of 2026-10-12 · Source (opens in a new window)
Economic Security Promotion Act (unofficial English translation of the name)
Economic Security Promotion Act (unofficial English translation of the name) (経済施策を一体的に講ずることによる安全保障の確保の推進に関する法律（令和四年法律第四十三号）): in force, As of 2026-10-12 · Source (opens in a new window)
cross-border data
Act on the Protection of Personal Information (unofficial English translation of the name)
Act on the Protection of Personal Information (unofficial English translation of the name) (個人情報の保護に関する法律（平成十五年法律第五十七号）): in force, As of 2026-10-12 · Source (opens in a new window)
incident reporting
Act on the Protection of Personal Information (unofficial English translation of the name)
Act on the Protection of Personal Information (unofficial English translation of the name) (個人情報の保護に関する法律（平成十五年法律第五十七号）): in force, As of 2026-10-12 · Source (opens in a new window)
Telecommunications Business Act (unofficial English translation of the name)
Telecommunications Business Act (unofficial English translation of the name) (電気通信事業法（昭和五十九年法律第八十六号）): in force, As of 2026-10-12 · Source (opens in a new window)
Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name)
Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name) (重要電子計算機に対する不正な行為による被害の防止に関する法律（令和七年法律第四十二号）): partly in force, As of 2026-10-12 · Source (opens in a new window)
telecom security
Telecommunications Business Act (unofficial English translation of the name)
Telecommunications Business Act (unofficial English translation of the name) (電気通信事業法（昭和五十九年法律第八十六号）): in force, As of 2026-10-12 · Source (opens in a new window)
cybercrime
Act on the Prohibition of Unauthorized Computer Access (unofficial English translation of the name)
Act on the Prohibition of Unauthorized Computer Access (unofficial English translation of the name) (不正アクセス行為の禁止等に関する法律（平成十一年法律第百二十八号）): in force, As of 2026-10-12 · Source (opens in a new window)
finance sector rules
Guidelines on Cybersecurity in the Financial Sector (unofficial English translation of the name)
Guidelines on Cybersecurity in the Financial Sector (unofficial English translation of the name) (金融分野におけるサイバーセキュリティに関するガイドライン): Guidance, As of 2026-10-12 · Source (opens in a new window)
telecom sector rules
Telecommunications Business Act (unofficial English translation of the name)
Telecommunications Business Act (unofficial English translation of the name) (電気通信事業法（昭和五十九年法律第八十六号）): in force, As of 2026-10-12 · Source (opens in a new window)
Compliance checklist for South Korea
personal data
Personal Information Protection Act
Personal Information Protection Act (Personal Information Protection Act (개인정보 보호법)): in force, As of 2026-10-12 · Source (opens in a new window)
cross-border data
Personal Information Protection Act
Personal Information Protection Act (Personal Information Protection Act (개인정보 보호법)): in force, As of 2026-10-12 · Source (opens in a new window)
incident reporting
Personal Information Protection Act
Personal Information Protection Act (Personal Information Protection Act (개인정보 보호법)): in force, As of 2026-10-12 · Source (opens in a new window)
Act on Promotion of Information and Communications Network Utilization and Information Protection (unofficial English translation of the name)
Cybersecurity Act, B.E. 2562 (2019) (unofficial English translation of the name)
Cybersecurity Act, B.E. 2562 (2019) (unofficial English translation of the name) (Cybersecurity Act, B.E. 2562 (2019)): in force, As of 2026-10-11 · Source (opens in a new window)
personal data
Personal Data Protection Act, B.E. 2562 (2019) (unofficial English translation of the name)
Personal Data Protection Act, B.E. 2562 (2019) (unofficial English translation of the name) (พระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562): partly in force, As of 2026-10-12 · Source (opens in a new window)
critical infrastructure
Cybersecurity Act, B.E. 2562 (2019) (unofficial English translation of the name)
Cybersecurity Act, B.E. 2562 (2019) (unofficial English translation of the name) (Cybersecurity Act, B.E. 2562 (2019)): in force, As of 2026-10-11 · Source (opens in a new window)
cross-border data
Personal Data Protection Act, B.E. 2562 (2019) (unofficial English translation of the name)
Personal Data Protection Act, B.E. 2562 (2019) (unofficial English translation of the name) (พระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562): partly in force, As of 2026-10-12 · Source (opens in a new window)
incident reporting
Personal Data Protection Act, B.E. 2562 (2019) (unofficial English translation of the name)
Personal Data Protection Act, B.E. 2562 (2019) (unofficial English translation of the name) (พระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562): partly in force, As of 2026-10-12 · Source (opens in a new window)
cybercrime
Computer Crime Act, B.E. 2550 (2007), as amended (No. 2) B.E. 2560 (2017) (unofficial English translation of the name)
Computer Crime Act, B.E. 2550 (2007), as amended (No. 2) B.E. 2560 (2017) (unofficial English translation of the name) (พระราชบัญญัติว่าด้วยการกระทำความผิดเกี่ยวกับคอมพิวเตอร์ พ.ศ. 2550 (แก้ไขเพิ่มเติม ฉบับที่ 2 พ.ศ. 2560)): in force, As of 2026-10-12 · Source (opens in a new window)
finance sector rules
Policies and Measures on Security of Information Technology Systems (unofficial English translation of the name)
Policies and Measures on Security of Information Technology Systems (unofficial English translation of the name) (Bank of Thailand Notification No. SorNorChor. 11/2561 Re: Policies and Measures on Security of Information Technology Systems): Code of practice, As of 2026-10-12 · Source (opens in a new window)
Compliance checklist for Indonesia
cybersecurity
Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (unofficial English translation of the name)
Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (unofficial English translation of the name) (Peraturan Pemerintah Nomor 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi Elektronik): in force, As of 2026-10-12 · Source (opens in a new window)
OJK Regulation No. 11/POJK.03/2022 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name)
OJK Regulation No. 11/POJK.03/2022 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name) (Peraturan Otoritas Jasa Keuangan Nomor 11/POJK.03/2022 tentang Penyelenggaraan Teknologi Informasi oleh Bank Umum): in force, As of 2026-10-12 · Source (opens in a new window)
personal data
Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name)
Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name) (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi): in force, As of 2026-10-12 · Source (opens in a new window)
cross-border data
Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name)
Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name) (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi): in force, As of 2026-10-12 · Source (opens in a new window)
incident reporting
Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name)
Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name) (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi): in force, As of 2026-10-12 · Source (opens in a new window)
Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (unofficial English translation of the name)
Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (unofficial English translation of the name) (Peraturan Pemerintah Nomor 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi Elektronik): in force, As of 2026-10-12 · Source (opens in a new window)
cybercrime
Law No. 1 of 2024, second amendment to the Electronic Information and Transactions Law (unofficial English translation of the name)
Law No. 1 of 2024, second amendment to the Electronic Information and Transactions Law (unofficial English translation of the name) (Undang-Undang Nomor 1 Tahun 2024 tentang Perubahan Kedua atas Undang-Undang Nomor 11 Tahun 2008 tentang Informasi dan Transaksi Elektronik): in force, As of 2026-10-12 · Source (opens in a new window)
finance sector rules
OJK Regulation No. 11/POJK.03/2022 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name)
OJK Regulation No. 11/POJK.03/2022 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name) (Peraturan Otoritas Jasa Keuangan Nomor 11/POJK.03/2022 tentang Penyelenggaraan Teknologi Informasi oleh Bank Umum): in force, As of 2026-10-12 · Source (opens in a new window)
OJK Board Member Regulation No. 1 of 2026 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name)
OJK Board Member Regulation No. 1 of 2026 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name) (Peraturan Anggota Dewan Komisioner OJK Nomor 1 Tahun 2026 tentang Penyelenggaraan Teknologi Informasi oleh Bank Umum): in force, As of 2026-10-12 · Source (opens in a new window)
Law on Cybersecurity (Law No. 116/2025/QH15) (unofficial English translation of the name)
Law on Cybersecurity (Law No. 116/2025/QH15) (unofficial English translation of the name) (Luật An ninh mạng (Luật số 116/2025/QH15)): in force, As of 2026-10-12 · Source (opens in a new window)
personal data
Law on Personal Data Protection (Law No. 91/2025/QH15) (unofficial English translation of the name)
Law on Personal Data Protection (Law No. 91/2025/QH15) (unofficial English translation of the name) (Luật Bảo vệ dữ liệu cá nhân (Luật số 91/2025/QH15)): in force, As of 2026-10-12 · Source (opens in a new window)
Decree No. 13/2023/ND-CP on personal data protection (unofficial English translation of the name)
Law on Cybersecurity (Law No. 116/2025/QH15) (unofficial English translation of the name)
Law on Cybersecurity (Law No. 116/2025/QH15) (unofficial English translation of the name) (Luật An ninh mạng (Luật số 116/2025/QH15)): in force, As of 2026-10-12 · Source (opens in a new window)
Law on Cybersecurity (Law No. 24/2018/QH14) (unofficial English translation of the name)
Cybersecurity Law (Law No. 13/2019) (Lei n.º 13/2019 — Lei da cibersegurança / 第13/2019號法律《網絡安全法》): in force, As of 2026-10-12 · Source (opens in a new window)
Guideline on Technology and Cyber Risk Management
Guideline on Technology and Cyber Risk Management (Circular No. 017/B/2023-DSB/AMCM: Guideline on Technology and Cyber Risk Management): Guidance, As of 2026-10-12 · Source (opens in a new window)
personal data
Personal Data Protection Act (Law No. 8/2005) (unofficial English translation of the name)
Personal Data Protection Act (Law No. 8/2005) (unofficial English translation of the name) (第8/2005號法律《個人資料保護法》 / Lei n.º 8/2005 — Lei da Protecção de Dados Pessoais): in force, As of 2026-10-12 · Source (opens in a new window)
critical infrastructure
Cybersecurity Law (Law No. 13/2019)
Cybersecurity Law (Law No. 13/2019) (Lei n.º 13/2019 — Lei da cibersegurança / 第13/2019號法律《網絡安全法》): in force, As of 2026-10-12 · Source (opens in a new window)
cross-border data
Personal Data Protection Act (Law No. 8/2005) (unofficial English translation of the name)
Personal Data Protection Act (Law No. 8/2005) (unofficial English translation of the name) (第8/2005號法律《個人資料保護法》 / Lei n.º 8/2005 — Lei da Protecção de Dados Pessoais): in force, As of 2026-10-12 · Source (opens in a new window)
incident reporting
Cybersecurity Law (Law No. 13/2019)
Cybersecurity Law (Law No. 13/2019) (Lei n.º 13/2019 — Lei da cibersegurança / 第13/2019號法律《網絡安全法》): in force, As of 2026-10-12 · Source (opens in a new window)
Guideline on Technology and Cyber Risk Management
Guideline on Technology and Cyber Risk Management (Circular No. 017/B/2023-DSB/AMCM: Guideline on Technology and Cyber Risk Management): Guidance, As of 2026-10-12 · Source (opens in a new window)
cybercrime
Law on Combating Computer Crime (Law No. 11/2009) (unofficial English translation of the name)
Law on Combating Computer Crime (Law No. 11/2009) (unofficial English translation of the name) (第11/2009號法律《打擊電腦犯罪法》 / Lei n.º 11/2009 — Lei de combate à criminalidade informática): in force, As of 2026-10-12 · Source (opens in a new window)
finance sector rules
Guideline on Technology and Cyber Risk Management
Guideline on Technology and Cyber Risk Management (Circular No. 017/B/2023-DSB/AMCM: Guideline on Technology and Cyber Risk Management): Guidance, As of 2026-10-12 · Source (opens in a new window)
Compliance checklist for Bangladesh
cybersecurity
Cyber Protection Act, 2026 (Act No. 81 of 2026) (unofficial English translation of the name)
Cyber Protection Act, 2026 (Act No. 81 of 2026) (unofficial English translation of the name) (সাইবার সুরক্ষা আইন, ২০২৬ (২০২৬ সনের ৮১ নং আইন)): in force, As of 2026-10-12 · Source (opens in a new window)
personal data
Personal Data Protection Act, 2026 (Act No. 63 of 2026) (unofficial English translation of the name)
Personal Data Protection Act, 2026 (Act No. 63 of 2026) (unofficial English translation of the name) (ব্যক্তিগত উপাত্ত সুরক্ষা আইন, ২০২৬ (২০২৬ সনের ৬৩ নং আইন)): partly in force, As of 2026-10-12 · Source (opens in a new window)
critical infrastructure
Cyber Protection Act, 2026 (Act No. 81 of 2026) (unofficial English translation of the name)
Cyber Protection Act, 2026 (Act No. 81 of 2026) (unofficial English translation of the name) (সাইবার সুরক্ষা আইন, ২০২৬ (২০২৬ সনের ৮১ নং আইন)): in force, As of 2026-10-12 · Source (opens in a new window)
cross-border data
Personal Data Protection Act, 2026 (Act No. 63 of 2026) (unofficial English translation of the name)
Personal Data Protection Act, 2026 (Act No. 63 of 2026) (unofficial English translation of the name) (ব্যক্তিগত উপাত্ত সুরক্ষা আইন, ২০২৬ (২০২৬ সনের ৬৩ নং আইন)): partly in force, As of 2026-10-12 · Source (opens in a new window)
cybercrime
Cyber Protection Act, 2026 (Act No. 81 of 2026) (unofficial English translation of the name)
Cyber Protection Act, 2026 (Act No. 81 of 2026) (unofficial English translation of the name) (সাইবার সুরক্ষা আইন, ২০২৬ (২০২৬ সনের ৮১ নং আইন)): in force, As of 2026-10-12 · Source (opens in a new window)
Information and Communication Technology Act, 2006 (Act No. 39 of 2006) (unofficial English translation of the name)
Information and Communication Technology Act, 2006 (Act No. 39 of 2006) (unofficial English translation of the name) (তথ্য ও যোগাযোগ প্রযুক্তি আইন, ২০০৬ (২০০৬ সনের ৩৯ নং আইন)): in force, As of 2026-10-12 · Source (opens in a new window)
telecom sector rules
Bangladesh Telecommunication Act, 2001 (Act No. 18 of 2001) (unofficial English translation of the name)
Bangladesh Telecommunication Act, 2001 (Act No. 18 of 2001) (unofficial English translation of the name) (বাংলাদেশ টেলিযোগাযোগ আইন, ২০০১ (২০০১ সনের ১৮ নং আইন)): in force, As of 2026-10-12 · Source (opens in a new window)
Compliance checklist for Sri Lanka
cybersecurity
Banking Act Directions No. 16 of 2021: Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks
Banking Act Directions No. 16 of 2021: Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks: Code of practice, As of 2026-10-09 · Source (opens in a new window)
Banking Circular No. 2 of 2025: Reporting of Information Technology and Cybersecurity Incidents of Licensed Banks
Banking Circular No. 2 of 2025: Reporting of Information Technology and Cybersecurity Incidents of Licensed Banks: Code of practice, As of 2026-10-09 · Source (opens in a new window)
Banking Act Directions No. 16 of 2021: Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks
Banking Act Directions No. 16 of 2021: Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks: Code of practice, As of 2026-10-09 · Source (opens in a new window)
Banking Circular No. 2 of 2025: Reporting of Information Technology and Cybersecurity Incidents of Licensed Banks
Banking Circular No. 2 of 2025: Reporting of Information Technology and Cybersecurity Incidents of Licensed Banks: Code of practice, As of 2026-10-09 · Source (opens in a new window)
RFP security points
Select the text to copy it into your own document.
Does the supplier publish vulnerability disclosure and patch timelines?
Does the supplier commit to incident notification times and a named contact?
Are data location and cross-border transfer arrangements written into the contract?
Can a software bill of materials for third-party components be provided?
Is cooperation with regulator-required audits and testing allowed?
Cross-border data decision tree
Choose a jurisdiction to generate a checklist.
Result: Malaysia
Read the official text of the verified instruments below before deciding whether data may leave.
Personal Data Protection Act 2010
Personal Data Protection Act 2010 (Akta Perlindungan Data Peribadi 2010 [Akta 709]): in force, As of 2026-10-12 · Source (opens in a new window)
Guidelines on Cross-Border Personal Data Transfer (unofficial English translation of the name)
Guidelines on Cross-Border Personal Data Transfer (unofficial English translation of the name) (Garis Panduan Perlindungan Data Peribadi Pemindahan Data Peribadi Rentas Sempadan (CBPDT)): Guidance, As of 2026-10-12 · Source (opens in a new window)
Result: Singapore
Cross-border rules for this jurisdiction are not yet verified (status under re-verification); consult the official sources.
Result: Hong Kong
Cross-border rules for this jurisdiction are not yet verified (status under re-verification); consult the official sources.
Result: Japan
Read the official text of the verified instruments below before deciding whether data may leave.
Act on the Protection of Personal Information (unofficial English translation of the name)
Act on the Protection of Personal Information (unofficial English translation of the name) (個人情報の保護に関する法律（平成十五年法律第五十七号）): in force, As of 2026-10-12 · Source (opens in a new window)
Result: South Korea
Cross-border rules for this jurisdiction are not yet verified (status under re-verification); consult the official sources.
Result: Thailand
Cross-border rules for this jurisdiction are not yet verified (status under re-verification); consult the official sources.
Result: Indonesia
Read the official text of the verified instruments below before deciding whether data may leave.
Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name)
Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name) (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi): in force, As of 2026-10-12 · Source (opens in a new window)
Result: Philippines
Cross-border rules for this jurisdiction are not yet verified (status under re-verification); consult the official sources.
Result: Vietnam
Cross-border rules for this jurisdiction are not yet verified (status under re-verification); consult the official sources.
Result: Macao
Read the official text of the verified instruments below before deciding whether data may leave.
Personal Data Protection Act (Law No. 8/2005) (unofficial English translation of the name)
Personal Data Protection Act (Law No. 8/2005) (unofficial English translation of the name) (第8/2005號法律《個人資料保護法》 / Lei n.º 8/2005 — Lei da Protecção de Dados Pessoais): in force, As of 2026-10-12 · Source (opens in a new window)
Result: Bangladesh
Cross-border rules for this jurisdiction are not yet verified (status under re-verification); consult the official sources.
Result: Sri Lanka
Cross-border rules for this jurisdiction are not yet verified (status under re-verification); consult the official sources.