Every UAE cybersecurity and data regulator, on one page, kept current.

The UAE Information Assurance Standard Version 2, published by the Cyber Security Council in September 2025, replaces the older NESA IAS. It reorganises controls into 15 families, 134 controls and 449 sub-controls, aligned to ISO 27001:2022 and adding cloud, IoT, AI and post-quantum topics. It is mandatory for government entities and critical infrastructure and is the reference for NCAP and the sector regulators.

The Abu Dhabi Healthcare Information and Cyber Security Standard is the Department of Health Abu Dhabi’s mandatory cybersecurity standard for every hospital, clinic, pharmacy, insurer and health service provider handling patient data in the emirate. Version 2.0 took effect in August 2024. It runs across eleven control domains and three tiers (Basic, Transitional, Advanced), and compliance is tied to facility licensing.

NABIDH (National Backbone for Integrated Dubai Health) is the Dubai Health Authority’s unified electronic health record exchange. Every DHA-licensed facility must connect to it to obtain or renew its licence, using an approved EMR that meets the NABIDH minimum data set and HL7/FHIR messaging standards. Connection brings security duties: access control, audit logs, consent handling and secure integration.

Under Article 32 of the ADGM Data Protection Regulations 2021, a controller must notify the ADGM Office of Data Protection of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, or explain the delay. Affected individuals must also be told when the breach is likely to cause high risk to them. Processors notify controllers without undue delay.

DIFC Law No. 5 of 2020 does not use a fixed 72-hour clock. Article 41 requires notification to the Commissioner as soon as practicable when a breach compromises confidentiality, security or privacy, and Article 42 requires telling affected individuals when the risk to them is high. The practical answer is the same in both zones: decide in advance who makes the call and how the clock is evidenced.

VARA’s Technology and Information Rulebook and the FSRA cyber rules effective January 31, 2026 require notification of material incidents within 24 hours, weekends included. DFSA’s Cyber Risk Management rules, mandatory since January 1, 2024, allow up to 72 hours. CBUAE requires prompt reporting under its Information Assurance framework. A firm under more than one regulator meets the shortest clock.

No. The IA Standard is the control framework an organisation implements. NCAP, the National Cyber Accreditation Program, accredits the service providers that help them do it. An organisation complies with IA; a provider is accredited under NCAP.