IT compliance on a cruise ship: a map of the rules

A cruise ship is a vessel, a hotel, a payments environment, a medical centre and a border-crossing passenger carrier at the same time, and each of those has its own rules about its systems. This is a map of them, not a ruling on any of them. For each one the question is "if your ship is ...", and the answer depends on your flag, your company, your routes and your contract date. Nothing here is legal advice.

Facts below were checked against primary sources on 1 November 2026. Where we could only find secondary sources, we say so or leave the detail out.

The ship: class rules and IMO guidance

• IACS UR E26 and E27 apply to ships contracted on or after 1 July 2024, and passenger ships on international voyages are in the mandatory scope. E26's scope reaches IP-based interfaces from in-scope operational systems, and it names passenger-servicing, administrative and crew-welfare networks as examples. That is the clause that ties hotel IT to OT: where those networks touch a propulsion, power, safety or navigation system, they are in the picture.
• IMO addresses cyber risk through the safety management system. Resolution MSC.428(98) (2017) affirms that an approved safety management system should take cyber risk management into account, and encourages administrations to ensure it is addressed no later than the first annual verification of a company's Document of Compliance after 1 January 2021. The IMO's current guidelines, MSC-FAL.1/Circ.3/Rev.4 (28 May 2026), are non-mandatory. At MSC 110 the Committee agreed that a non-mandatory cybersecurity code should be developed. We found no mandatory IMO cyber instrument.

The US: the Coast Guard and the CVSSA

• The Coast Guard cyber rule (33 CFR part 101, subpart F) covers US-flagged vessels required to hold a part 104 security plan, and US port facilities. A foreign-flagged cruise ship is not covered as a vessel, but the US terminals it uses may be, which matters for shared systems and for who reports what.
• The Cruise Vessel Security and Safety Act (46 U.S.C. 3507 and 3508) covers a passenger vessel authorized to carry 250 or more passengers, with overnight accommodations for 250 or more, on a voyage that embarks or disembarks passengers in the United States. It is a records regime as much as a safety one: a video surveillance system with footage retained for at least 20 days (and longer for footage the FBI identifies after a reported incident), an electronic record of the date, time and identity of each crew member who accesses a passenger stateroom, and a crime log. Certain crimes are reported to the FBI as soon as possible, with a written report to the website the Secretary of Transportation maintains. Those are IT systems with retention and access rules, so they belong in an IT compliance inventory.
• Passenger and crew manifests for US arrivals and departures go to CBP through APIS, on deadlines set in 19 CFR 4.7b and 4.64.

Payments, guest data and health records

• PCI DSS v4.0.1 has no maritime exemption and no maritime guidance. Onboard point-of-sale, folio and shore booking systems are in scope like any merchant environment, and so are the links that carry card data between ship and shore.
• Guest data. GDPR can reach a company with an EU establishment, one that offers services to people in the EU, and EU-flagged ships (Art. 3). In California, the CCPA applies above a revenue threshold that is adjusted for inflation; check the current figure with the California Privacy Protection Agency. Biometric laws such as Washington's RCW 19.375 (and, depending on the passenger, laws like Illinois BIPA, which you should confirm with counsel) matter if the line itself collects face or fingerprint data, for example for onboard photo ID or access. Who operates matching at embarkation is a separate question from what the line collects.
• The onboard medical centre. HIPAA covers a health care provider only if it conducts certain standard electronic transactions (45 CFR 160.103), and we found no authoritative source that decides this for ship medical centres. Decide it case by case and record the reasons. Medical confidentiality is a separate duty under the CVSSA for some examination information, and professional guidelines expect shipboard medical records to be confidential.

The EU

• NIS2 binds companies, not ships: the Annex I entry for water transport lists passenger and freight water transport companies "not including the individual vessels operated by those companies". Whether your company is in scope depends on establishment, size and the Member State's law. Port managing bodies and entities operating equipment within ports are also listed.
• Passenger registration. Directive 98/41/EC, as amended, requires persons on board passenger ships to and from EU ports to be counted and registered, with the data submitted through the maritime single window, and deleted when no longer needed.
• Accessibility. The European Accessibility Act applies from 28 June 2025 to the booking sites, apps and e-tickets of waterborne passenger transport services in the EU (Directive 2019/882, Articles 2 and 31). For US exposure under the ADA, ask counsel.

Easy to miss: regulated affiliates

A group can be covered by a financial regulator's cyber rule through an entity that does not look like part of the cruise business. For example, a group company that holds a New York Department of Financial Services licence, such as an insurance producer licence, can be a covered entity under 23 NYCRR part 500, with the rule's controls and notification duties. Check every legal entity in the group, not only the operating company.

A quick screen

The free maritime cyber applicability check screens a vessel against the ship-level regimes above in your browser and shows the source for each result. It is a screening aid, not legal advice, and it says "needs review" wherever the answer turns on something it cannot see.

Dated 1 November 2026. Primary sources include the IACS resolution pages, the IMO documents named above, 33 CFR part 101 subpart F, 46 U.S.C. 3507, 19 CFR 4.7b and 4.64, PCI DSS v4.0.1, Regulation (EU) 2016/679, Directive (EU) 2022/2555 and Directive 98/41/EC.