ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 8.3: Design for regulated data from the outset: locate it quickly, enforce retention and other obligations, and report risk events affecting it

What does 8.3 require?

Datasets carrying regulatory obligations such as statutory record keeping and personal data are acquired through mechanisms built for compliance from the start; the institution can quickly locate and manage such data, implements controls enabling compliance such as time-bound retention, and knows its reporting obligations when a risk event affects such data, reporting to the relevant authorities in time, for example a breach of personal data.