Data Protection Act 2018: Primary UK legislation that implements and supplements the GDPR, setting out the data protection framework in the UK including requirements for security incident handling and reporting.
UK GDPR: Post-Brexit version of the EU GDPR, providing comprehensive requirements for personal data protection, including mandatory breach notification and security measures.
Network and Information Systems Regulations 2018: UK regulations implementing the EU NIS Directive, focusing on cybersecurity requirements for operators of essential services and digital service providers.
Computer Misuse Act 1990: Legislation criminalizing unauthorized access to computer systems and data, relevant for incident classification and reporting to law enforcement.
Privacy and Electronic Communications Regulations 2003: Regulations governing electronic communications, including requirements for security of services and breach notification obligations.
Financial Services and Markets Act 2000: Key financial services legislation in the UK, including requirements for operational resilience and incident management for financial institutions.
FCA Regulations: Financial Conduct Authority regulations providing specific requirements for incident management and reporting in the financial sector.
PCI DSS: Payment Card Industry Data Security Standard providing requirements for organizations handling credit card data, including incident response procedures.
Health and Social Care Act 2012: Legislation governing healthcare organizations, including requirements for handling and reporting security incidents involving patient data.
ISO/IEC 27001:2013: International standard for information security management systems, providing framework for security controls and incident management.
ISO/IEC 27035: Specific international standard focusing on information security incident management, providing guidelines for incident response.
NIST Cybersecurity Framework: US-developed framework widely adopted globally, providing guidance on security incident detection, response, and recovery.
ITIL Framework: IT service management framework including specific guidance on incident management processes and procedures.
Common Law Duties: Legal obligations arising from common law principles, including duty of confidentiality and reasonable care in handling sensitive information.
Third Party Contractual Obligations: Requirements arising from contracts with vendors, customers, and partners regarding security incident handling and notification.
