d) information processed by the systems is available to persons with an official needto-know. The King may issue regulations on the identification and protection of critical national information systems. In special cases, such regulations may grant exemptions from security requirements specified in or pursuant to this act. Section 6-3.Approval of critical national information systems Critical national information systems shall be approved by an approval authority. Information systems which are to process classified information shall be approved before being used. The King may issue regulations on approval of critical national information systems, the appointment of approval authorities and requirements applicable to suppliers. Section 6-4.Monitoring of critical national information systems Undertakings shall continuously monitor their critical national information systems to prevent, detect and counter incidents which may harm national security interests. Incidents relevant to such security work shall be registered. The sending of information to, from and within critical national information systems shall be registered, stored and analysed to the extent necessary for the purpose of the monitoring. Information systems which process personal data shall only be monitored using the methods and to the extent necessary for the purpose of the monitoring. Information pursuant to the first and second paragraphs may be stored for up to five years. Stored personal data may only be used to the extent necessary for the purpose of the monitoring. Where multiple undertakings are linked with the same information system, they may agree that one of the undertakings shall conduct monitoring pursuant to the first and second paragraphs on behalf of all of the undertakings. The undertaking which conducts the monitoring shall ensure that the information security requirements in section 5-2 are followed. The undertaking shall ensure that authorised users of monitored information systems are informed of the purpose of the processing of the personal data and what monitoring measures have been implemented. They shall also be informed if the personal data is released and, if so, to whom. The King may issue regulations on monitoring of critical national information systems, including provisions specifying 12/30