What It Is

The Digital Operational Resilience Act (DORA), formally Regulation (EU) 2022/2554, is a transformative EU regulation bolstering digital operational resilience in the financial sector against ICT disruptions like cyberattacks. Enacted in 2022 and applying from January 17, 2025, it targets 20 financial entity types and critical third-party providers using a risk-based, proportional approach to harmonize rules across member states.

Key Components

DORA rests on four pillars: ICT risk management frameworks for identifying and mitigating risks with annual reviews; incident reporting requiring 4-hour notifications for major events; resilience testing including annual scans and triennial threat-led penetration testing (TLPT); and third-party oversight with ESAs supervising critical providers. It promotes information sharing without formal certification but enforces compliance via audits and penalties up to 2% of turnover.

Why Organizations Use It

Financial firms implement DORA to fulfill legal mandates, counter rising threats (74% ransomware incidence), reduce systemic risks, and enhance trust. It drives efficiency, innovation in tools, and competitive advantages through unified resilience, shifting from reactive to proactive strategies.

Implementation Overview

Entities conduct gap analyses, develop frameworks, roll out testing, and manage vendors proportionally by size and risk. Applicable EU-wide to ~22,000 entities; involves training, tools, and ESAs reporting by 2025 deadline, with ongoing maintenance.

What It Is

UAE PDPL (Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data) is a comprehensive federal regulation establishing the first economy-wide framework for personal data processing in onshore UAE. Effective from 2 January 2022, it adopts a risk-based approach with principles like fairness, purpose limitation, minimization, and security, overseen by the UAE Data Office.

Key Components

• Core processing controls (lawfulness, transparency, accuracy, storage limitation)
• Data subject rights (access, portability, erasure, objection to profiling)
• Controller/processor obligations (Records of Processing, DPOs, DPIAs for high-risk)
• Security, breach notification, cross-border transfers No fixed control count; compliance via accountability and records, no certification but enforcement by Data Office.

Why Organizations Use It

Mandated for onshore entities and extraterritorial processors of UAE data; reduces breach risks, builds trust, aligns with GDPR for multinationals, enhances cybersecurity maturity amid digital economy growth.

Implementation Overview

Phased: discovery/gap analysis, remediation (policies, DPIAs, vendor controls), operationalization (training, DSR workflows), monitoring. Applies to private sector (excl. free zones, sectoral data); medium-large orgs; audit via records submission. (178 words)