# Regulations covered by Secure iQube

## India regulations

Indian laws and regulator directions, RBI, SEBI, IRDAI, CERT-In, DPDP, PMLA, IT Act, Companies Act controls, BRSR, sectoral cyber rules and workplace laws.

- **DPDP Act**: India Digital Personal Data Protection Act, 2023. India’s data protection law, with its Rules phasing in core obligations by May 2027. https://securei3.com/standards/india-dpdp.md
- **RBI IT Governance Master Direction**: RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices. RBI’s consolidated expectations on IT governance, IT risk, controls, business continuity and IS audit for regulated entities. https://securei3.com/standards/rbi-it-governance.md
- **RBI Cyber Security Framework**: RBI Cyber Security Framework in Banks. The RBI baseline for cyber security policy, a cyber crisis management plan, a security operations centre and incident reporting in banks. https://securei3.com/standards/rbi-cyber-security-framework.md
- **RBI IT Outsourcing Master Direction**: RBI Master Direction on Outsourcing of Information Technology Services. Rules for how RBI-regulated entities select, contract, monitor and exit IT and cloud service providers. https://securei3.com/standards/rbi-it-outsourcing.md
- **RBI Digital Payment Security Controls**: RBI Master Direction on Digital Payment Security Controls. Security requirements for internet banking, mobile banking, card and other digital payment channels of regulated entities. https://securei3.com/standards/rbi-digital-payment-security.md
- **RBI Cyber Resilience for Payment System Operators**: RBI Master Directions on Cyber Resilience and Digital Payment Security Controls for Non-bank Payment System Operators. Cyber resilience and payment security requirements for non-bank PSOs such as PPI issuers, payment aggregators and card networks. https://securei3.com/standards/rbi-pso-cyber-resilience.md
- **RBI Payment Aggregator Guidelines**: RBI regulation of payment aggregators and payment gateways. Authorisation, governance, merchant onboarding and baseline technology requirements for payment aggregators. https://securei3.com/standards/rbi-payment-aggregators.md
- **RBI Payment Data Localisation**: RBI directive on storage of payment system data. Payment system data must be stored only in India, a requirement that shapes cloud, vendor and architecture decisions. https://securei3.com/standards/rbi-payment-data-localisation.md
- **RBI Digital Lending Directions**: RBI framework for digital lending by regulated entities and lending service providers. Rules on digital loan journeys, lending service providers, data collection, disclosures and grievance redress. https://securei3.com/standards/rbi-digital-lending.md
- **RBI KYC Master Direction**: RBI Master Direction – Know Your Customer (KYC) Direction, 2016. Customer due diligence, beneficial ownership, risk categorisation, monitoring and reporting obligations for RBI-regulated entities. https://securei3.com/standards/rbi-kyc-master-direction.md
- **RBI Fraud Risk Management Directions**: RBI Master Directions on Fraud Risk Management. Board-level fraud governance, early warning signals, fraud classification and reporting for banks and NBFCs. https://securei3.com/standards/rbi-fraud-risk-management.md
- **SEBI CSCRF**: SEBI Cybersecurity and Cyber Resilience Framework. SEBI’s unified cyber framework for regulated entities, scaled by category, with goals to anticipate, withstand, contain, recover and evolve. https://securei3.com/standards/sebi-cscrf.md
- **SEBI Cloud Framework**: SEBI framework for adoption of cloud services by regulated entities. Governance, data localisation, security, audit and exit requirements for SEBI-regulated entities using cloud. https://securei3.com/standards/sebi-cloud-framework.md
- **IRDAI Cyber Security Guidelines**: IRDAI Information and Cyber Security Guidelines, 2023. Information and cyber security requirements for insurers, intermediaries and other IRDAI-regulated entities. https://securei3.com/standards/irdai-cyber-guidelines.md
- **CERT-In Directions**: CERT-In Directions under Section 70B(6) of the IT Act (April 2022). Six-hour cyber incident reporting, 180-day log retention and clock synchronisation for organisations in India. https://securei3.com/standards/cert-in-directions.md
- **IT Act & SPDI Rules**: Information Technology Act, 2000 and Reasonable Security Practices (SPDI) Rules, 2011. India’s foundational cyber law, including security practices for sensitive personal data as the DPDP regime phases in. https://securei3.com/standards/india-it-act.md
- **PMLA**: Prevention of Money-laundering Act, 2002 and PML Rules. India’s anti-money laundering law: reporting entities must verify clients, maintain records and report to FIU-IND. https://securei3.com/standards/india-pmla.md
- **Internal Financial Controls (Companies Act)**: Internal financial controls under the Companies Act, 2013. Directors and auditors must report on the adequacy and operating effectiveness of internal financial controls. https://securei3.com/standards/india-ifc.md
- **SEBI BRSR**: SEBI Business Responsibility and Sustainability Reporting (including BRSR Core). Mandatory ESG disclosure for India’s largest listed companies, with assurance of BRSR Core indicators phasing in. https://securei3.com/standards/india-brsr.md
- **Telecom Cyber Security Rules**: Telecommunications Act, 2023 and Telecom Cyber Security Rules, 2024. Cyber security obligations for telecom entities, including security policies, CTSO appointment and incident reporting. https://securei3.com/standards/india-telecom-cyber.md
- **CEA Power Sector Cyber Guidelines**: Central Electricity Authority (Cyber Security in Power Sector) Guidelines. Cyber security requirements for generation, transmission and distribution utilities, including OT environments. https://securei3.com/standards/cea-power-cyber.md
- **NABH Accreditation**: National Accreditation Board for Hospitals & Healthcare Providers standards. India’s accreditation for hospitals and healthcare providers, focused on patient safety and quality of care. https://securei3.com/standards/nabh-accreditation.md
- **POSH Act**: Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013. Every employer with ten or more employees must have an Internal Committee, a policy and an annual compliance cycle. https://securei3.com/standards/india-posh.md
- **India Labour Codes**: India’s four labour codes on wages, industrial relations, social security and occupational safety. Consolidated labour law across wages, industrial relations, social security and workplace safety, now in force. https://securei3.com/standards/india-labour-codes.md
- **Aadhaar (UIDAI) compliance**: Aadhaar Act, 2016 and UIDAI authentication regulations for AUAs and KUAs. Security and audit obligations for organisations using Aadhaar authentication and e-KYC. https://securei3.com/standards/uidai-aadhaar.md
- **MeitY cloud empanelment**: MeitY empanelment of cloud service offerings for government. Empanelment that allows cloud service providers to host Indian government workloads. https://securei3.com/standards/meity-cloud-empanelment.md
- **GIGW & STQC website audit**: Guidelines for Indian Government Websites and Apps (GIGW 3.0) and STQC certification. Quality, accessibility and security requirements for government websites and apps. https://securei3.com/standards/gigw-stqc.md
- **E-commerce & consumer protection rules**: Consumer Protection (E-Commerce) Rules, 2020 and dark pattern guidelines. Disclosure, grievance and fair-practice duties for e-commerce platforms and sellers in India. https://securei3.com/standards/india-ecommerce-rules.md

## GCC regulations

Cybersecurity, data protection, AML and financial-sector requirements across the UAE, Saudi Arabia, Qatar, Bahrain and Oman.

- **UAE PDPL**: UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). The UAE’s federal data protection law for organisations processing personal data in or from the UAE. https://securei3.com/standards/uae-pdpl.md
- **KSA PDPL**: Saudi Arabia Personal Data Protection Law. Saudi Arabia’s data protection law, fully enforceable since September 2024 and supervised by SDAIA. https://securei3.com/standards/ksa-pdpl.md
- **NCA ECC**: Saudi National Cybersecurity Authority Essential Cybersecurity Controls. Mandatory baseline cybersecurity controls for Saudi government entities and critical infrastructure operators. https://securei3.com/standards/nca-ecc.md
- **SAMA CSF**: Saudi Central Bank Cyber Security Framework. The cyber security framework for banks, insurers and finance companies regulated by the Saudi Central Bank. https://securei3.com/standards/sama-csf.md
- **UAE IA Standard**: UAE Information Assurance Regulation (TDRA). The UAE’s national information assurance controls for government entities and critical sectors. https://securei3.com/standards/uae-ia-standard.md
- **CST Cloud Class A, B, C**: CST Cloud Computing Regulatory Framework and cloud provider registration. Registration and classification of cloud service providers in Saudi Arabia, from Qualifying to Class C, which decides the data and sectors you can serve. https://securei3.com/standards/cst-ccrf.md
- **Dubai ISR**: Dubai Information Security Regulation (Dubai Electronic Security Center). Dubai’s information security regulation for government entities and critical sectors in the emirate. https://securei3.com/standards/dubai-isr.md
- **ADHICS**: Abu Dhabi Healthcare Information and Cyber Security Standard (DoH). Mandatory information and cyber security standard for healthcare entities licensed by the Abu Dhabi Department of Health. https://securei3.com/standards/adhics.md
- **CBUAE Requirements**: Central Bank of the UAE regulations for licensed financial institutions. Outsourcing, business continuity, consumer protection and operational risk expectations for UAE-licensed financial institutions. https://securei3.com/standards/cbuae-regulations.md
- **NCA CSCC**: NCA Critical Systems Cybersecurity Controls. Additional cybersecurity controls for critical systems inside national critical entities in Saudi Arabia, building on the ECC. https://securei3.com/standards/nca-cscc.md
- **UAE AML/CFT**: UAE anti-money laundering and counter-terrorist financing framework. AML/CFT obligations for UAE financial institutions and designated non-financial businesses, including goAML reporting. https://securei3.com/standards/uae-aml.md
- **DIFC & ADGM Data Protection**: DIFC Data Protection Law No. 5 of 2020 and ADGM Data Protection Regulations 2021. GDPR-aligned data protection laws for firms in the UAE’s financial free zones. https://securei3.com/standards/difc-adgm-data-protection.md
- **NCA TCC**: NCA Telework Cybersecurity Controls. Saudi cybersecurity controls for remote and hybrid working, covering devices, connections, access and monitoring. https://securei3.com/standards/nca-tcc.md
- **NCA CCC**: NCA Cloud Cybersecurity Controls. Saudi cloud cybersecurity controls for cloud service providers and organisations using cloud services. https://securei3.com/standards/nca-ccc.md
- **NCA DCC**: NCA Data Cybersecurity Controls. Saudi controls for protecting data according to its classification throughout its life cycle. https://securei3.com/standards/nca-dcc.md
- **NCA OSMACC**: NCA Organisations’ Social Media Accounts Cybersecurity Controls. Saudi controls for securing official organisational social media accounts against takeover, leaks and impersonation. https://securei3.com/standards/nca-osmacc.md
- **NCA OTCC**: NCA Operational Technology Cybersecurity Controls. Saudi cybersecurity controls for industrial control systems and operational technology. https://securei3.com/standards/nca-otcc.md
- **SAMA BCM Framework**: Saudi Central Bank Business Continuity Management Framework. Business continuity requirements for banks, insurers and finance companies regulated by SAMA. https://securei3.com/standards/sama-bcm.md
- **SAMA Counter-Fraud Framework**: Saudi Central Bank Counter-Fraud Framework. Fraud governance, prevention, detection and response requirements for SAMA-regulated institutions. https://securei3.com/standards/sama-counter-fraud.md
- **KSA AML/CTF**: Saudi Arabia anti-money laundering and counter-terrorism financing laws. AML/CTF obligations for Saudi financial institutions and designated non-financial businesses and professions. https://securei3.com/standards/ksa-aml.md
- **NDMO Data Standards**: NDMO Data Management and Personal Data Protection Standards (SDAIA). SDAIA’s national standards for data governance, classification, quality, sharing and personal data protection across 14 domains. https://securei3.com/standards/ndmo-data-standards.md
- **SDAIA AI Ethics Principles**: Saudi Data & AI Authority AI Ethics Principles. Saudi Arabia’s national principles for developing and using AI responsibly. https://securei3.com/standards/sdaia-ai-ethics.md
- **Qatar NIA**: Qatar National Information Assurance Policy and Standard. Qatar’s national information assurance framework for government and critical sectors. https://securei3.com/standards/qatar-nia.md
- **Qatar PDPPL**: Qatar Personal Data Privacy Protection Law (Law No. 13 of 2016). Qatar’s data protection law, one of the first in the GCC. https://securei3.com/standards/qatar-pdppl.md
- **Bahrain PDPL**: Bahrain Personal Data Protection Law (Law No. 30 of 2018). Bahrain’s data protection law, supervised by the Personal Data Protection Authority. https://securei3.com/standards/bahrain-pdpl.md
- **Oman PDPL**: Oman Personal Data Protection Law (Royal Decree 6/2022). Oman’s data protection law with its executive regulations. https://securei3.com/standards/oman-pdpl.md
- **SAMA ITGF**: SAMA Information Technology Governance Framework. The Saudi Central Bank’s framework for IT governance, IT risk and IT operations in regulated financial institutions. https://securei3.com/standards/sama-itgf.md
- **DESC CSP Standard**: Dubai Electronic Security Center Cloud Service Provider Security Standard. Mandatory security certification for cloud providers serving Dubai government and semi-government entities. https://securei3.com/standards/desc-csp.md
- **UAE ICT Health Law**: UAE Federal Law No. 2 of 2019 on the use of ICT in health fields. UAE federal rules for health data: confidentiality, retention, data location and the use of technology in healthcare. https://securei3.com/standards/uae-ict-health-law.md
- **VARA Rulebooks**: Dubai Virtual Assets Regulatory Authority regulations and rulebooks. Dubai’s licensing and conduct rules for virtual asset service providers, including technology, compliance and risk management rulebooks. https://securei3.com/standards/vara-rulebooks.md

## Global & regional laws

International and regional laws with cross-border reach, EU, UK, US and Asia-Pacific data protection, cyber, AI and financial regulation.

- **GDPR**: EU General Data Protection Regulation. The EU’s data protection law, which applies to anyone offering goods or services to, or monitoring, people in the EU. https://securei3.com/standards/gdpr.md
- **DORA**: EU Digital Operational Resilience Act. EU regulation on ICT risk and operational resilience for financial entities and their critical ICT providers, applying since January 2025. https://securei3.com/standards/dora.md
- **NIS2**: EU Network and Information Security Directive. The EU’s cybersecurity directive for essential and important entities across 18 sectors. https://securei3.com/standards/nis2.md
- **EU AI Act**: EU Artificial Intelligence Act. The EU’s risk-based AI law, with obligations phasing in from 2025 and high-risk rules now expected from late 2027. https://securei3.com/standards/eu-ai-act.md
- **HIPAA**: US Health Insurance Portability and Accountability Act. US rules protecting health information, applying to covered entities and their business associates. https://securei3.com/standards/hipaa.md
- **UK GDPR**: UK GDPR and Data Protection Act 2018. The UK’s data protection regime, closely based on the EU GDPR. https://securei3.com/standards/uk-gdpr.md
- **CCPA / CPRA**: California Consumer Privacy Act as amended by the CPRA. California’s consumer privacy law, the most influential US state privacy law. https://securei3.com/standards/ccpa-cpra.md
- **Singapore PDPA**: Singapore Personal Data Protection Act 2012. Singapore’s data protection law, including mandatory breach notification. https://securei3.com/standards/singapore-pdpa.md
- **EU Cyber Resilience Act**: EU Cyber Resilience Act (Regulation (EU) 2024/2847). Cybersecurity requirements for products with digital elements sold in the EU. https://securei3.com/standards/eu-cyber-resilience-act.md
- **SOX**: US Sarbanes-Oxley Act (Sections 302 and 404). Internal control over financial reporting requirements for companies listed in the US. https://securei3.com/standards/sox.md
- **EU AML Package**: EU Anti-Money Laundering Regulation, 6th AML Directive and AMLA. The EU’s single AML rulebook and new supervisory authority, phasing in through 2027. https://securei3.com/standards/eu-amlr.md