Presidential Decree No. 26-07, dated January 7, 2026, has established a structure responsible for information systems and data protection within public institutions, administrations, and bodies, defining its tasks, organization, and operations. The decree aims to create a dedicated unit for information systems security and data protection in every public entity, referred to in the text as the “Structure.”
Public institutions, administrations, and bodies are required to establish this structure, which must remain independent of the department responsible for information systems. The structure will report directly to the head of the institution or administration and will coordinate information security and data protection tasks with all subordinate bodies or services.
The structure is tasked with developing the information systems security policy for its respective institution and ensuring its implementation in accordance with the relevant strategy. It is also responsible for creating risk maps related to information systems security and personal data protection, as well as ensuring the execution of various recovery plans.
Furthermore, the structure will manage and administer information systems security and data protection solutions, along with cyber resilience measures. It will also conduct audits and monitoring operations in the field of information systems security in cooperation with competent authorities.
The structure is also responsible for ensuring continuous vigilance and permanent monitoring of the information systems under its jurisdiction. It must immediately report any cyber incident to the competent authorities and seek their assistance if necessary.
In the same context, the head of the structure will perform their duties externally by coordinating with the Information Systems Security Agency, the National Authority for the Protection of Personal Data, and any other institution or body required for the structure’s operation.
Reference: link
