Bhutan ICM Act 2018 (Data Protection)
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | BT ICM 2018 |
| Region | Asia-Pacific |
| Country or scope | Bhutan |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers BT ICM 2018
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
BT-ICM-SEC Security of Personal Information Systems | Service providers must safeguard the personal information they process against unauthorised alteration or disclosure, which integrity hashes on software components make verifiable (ICM Act 2018, data-protection and privacy provisions). | Scan |
BT-ICM-REC Records of Data-Handling Software | Regulated providers must be able to account for the systems through which they collect and process personal information, requiring a maintained component inventory (ICM Act 2018, data-protection and privacy provisions). | Scan |
BT-ICM-3P Third-Party Provider Accountability | Duties owed to users are not discharged by outsourcing, so components sourced from third parties must have named, accountable suppliers (ICM Act 2018, service-provider obligations). | Scan |
BT-ICM-ID Identifiable Processing Components | Protecting personal information requires knowing precisely which software handles it, so components should carry standard identifiers such as PURL or CPE (ICM Act 2018, data-protection and privacy provisions). | Scan |
BT-ICM-VER Version Records for Risk Assessment | Judging exposure of systems that hold personal information requires recorded versions for the components in operation (ICM Act 2018, data-protection and privacy provisions). | Scan |
BT-ICM-DOC Auditable System Documentation | BICMA's supervisory powers presuppose dated, identifiable documentation of the systems a provider operates (ICM Act 2018, regulatory oversight provisions). | Scan |
Policy templates
All 22 from the standard set, adapted to BT ICM 2018.
Bangladesh Cyber Security Act 2023
National cybersecurity framework: software asset inventory, component integrity, supply-chain verification, and vulnerability management.
Brunei Personal Data Protection Order 2025
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.