One ransomware attack on a mid-sized insurer can start three regulatory clocks at once: a four-hour one, a 24-hour one and a 72-hour one. Knowing which EU law owns which clock, and which one doesn’t apply to you at all, is the difference between a controlled response and a weekend of panicked calls to counsel.
This guide compares the NIS2 Directive, the Digital Operational Resilience Act (DORA) and the GDPR side by side. It explains how they overlap and shows how to run one security programme that satisfies all three.
The three laws in one paragraph each
NIS2: Directive (EU) 2022/2555
NIS2 is the EU’s horizontal cybersecurity law for essential and important entities across 18 sectors, from energy and health to manufacturing and digital providers. Because it is a directive, each Member State had to transpose it, by 17 October 2024 and applying from 18 October 2024. Italy did this with Legislative Decree no. 138 of 4 September 2024, supervised by the Agenzia per la Cybersicurezza Nazionale (ACN). For the details, see NIS2 Directive explained.
DORA: Regulation (EU) 2022/2554
DORA is a sector-specific regulation for financial entities and their ICT providers. It has applied directly in every Member State since 17 January 2025. It covers ICT risk management, incident reporting, resilience testing, third-party risk and information sharing. Our DORA explainer covers it in depth.
GDPR: Regulation (EU) 2016/679
GDPR protects personal data. It applies to any controller or processor established in the EU, and to non-EU organisations that offer goods or services to people in the EU or monitor their behaviour. Its security duty (Article 32) and its breach notification rules (Articles 33 and 34) are what bring it into the same room as NIS2 and DORA.
Side-by-side comparison
| NIS2 | DORA | GDPR | |
|---|---|---|---|
| Legal form | Directive, transposed into national law | Regulation, directly applicable, plus national rules on authorities and penalties | Regulation, directly applicable |
| Who is in scope | Medium and large entities in the sectors listed in Annexes I and II, plus some entities regardless of size (e.g. qualified trust service providers, DNS providers, TLD registries) | About 20 types of financial entities (banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers, etc.) and ICT third-party providers, with direct EU oversight of designated critical providers | Any organisation processing personal data within GDPR’s territorial scope (Article 3) |
| Regulator | National competent authorities and CSIRTs (in Italy: ACN and CSIRT Italia) | Financial supervisors (in Italy: Banca d’Italia, Consob, IVASS, COVIP; the ECB for significant banks); EBA, EIOPA and ESMA as Lead Overseers of critical ICT providers | National data protection authorities (in Italy: the Garante), coordinated through the EDPB |
| What triggers reporting | A “significant incident”: severe operational disruption or financial loss, or considerable damage to others | A “major ICT-related incident”, classified with set criteria (clients affected, duration, spread, data losses, criticality, economic impact) | A personal data breach, unless it is unlikely to result in a risk to individuals |
| Reporting timeline | Early warning within 24 h of awareness; incident notification within 72 h; final report within 1 month of the notification | Initial notification within 4 h of classification as major (max 24 h from awareness); intermediate report within 72 h of the initial one; final report within 1 month of the latest intermediate report | Notify the supervisory authority without undue delay and, where feasible, within 72 h of awareness; tell data subjects without undue delay if the risk is high |
| Maximum fines | Essential entities: at least €10m or 2% of worldwide annual turnover, whichever is higher. Important entities: at least €7m or 1.4% | Set by each Member State (no EU cap for financial entities). Critical ICT providers: periodic penalty of up to 1% of average daily worldwide turnover, for up to 6 months | Up to €10m or 2% (including breach notification failures under Articles 33–34); up to €20m or 4% for breaches of core principles, data subject rights and international transfers |
| Management duties | Management bodies approve and oversee risk measures, can be held liable, and must follow training (Article 20). Temporary bans on managers of essential entities are possible (Article 32(5)) | The management body bears “ultimate responsibility” for ICT risk, approves the strategy and plans, and must keep up to date through regular training (Article 5) | Controller accountability (Articles 5(2) and 24); a DPO where required (Articles 37–39). No explicit board training duty |
How DORA and NIS2 fit together: lex specialis
Banks and financial market infrastructures appear in NIS2’s Annex I. So why don’t they follow NIS2’s reporting rules? Because of Article 4 of NIS2.
Article 4(1) says that where a sector-specific EU act requires essential or important entities to adopt cybersecurity risk-management measures or notify significant incidents, and those requirements are at least equivalent in effect, the matching NIS2 provisions do not apply to those entities. Article 4(2) defines “equivalent” in two ways. The first is risk-management measures at least equivalent in effect to Article 21(1)–(2). The second is incident reporting rules at least equivalent to Article 23, combined with immediate access to those notifications for NIS2 CSIRTs, competent authorities or single points of contact.
NIS2 recital 28 names DORA as such a sector-specific act for financial entities. DORA recital 16 confirms it is lex specialis with regard to NIS2. In practice:
- A DORA financial entity follows DORA, not NIS2, for ICT risk management, incident reporting, testing, supervision and enforcement.
- NIS2 authorities still see the incidents. Under DORA Article 19(6), the financial supervisor forwards major incident reports to the national NIS2 CSIRT or single point of contact.
- Group entities outside DORA are not covered by the carve-out. If a non-financial group company is a NIS2 entity (an in-house data centre company, say), NIS2 applies to it in full.
- ICT providers can face both laws. A cloud or managed service provider is usually a NIS2 entity in its own right. It also feels DORA through its financial customers’ contracts, and directly if it is designated a critical ICT third-party provider.
Where GDPR fits: it always runs in parallel
Neither NIS2 nor DORA replaces GDPR. If a cyber incident compromises personal data, the GDPR breach notification duty applies alongside whichever cyber regime you fall under.
NIS2 makes the link explicit. Under Article 35, when a NIS2 authority finds that an infringement of Article 21 or 23 may involve a personal data breach, it must inform the data protection authority. If the data protection authority fines the same conduct under GDPR, the NIS2 authority cannot add a NIS2 fine for it. It can still use other enforcement measures.
Example: a regional bank in Milan suffers ransomware that encrypts its core systems and exfiltrates customer data. It files a DORA initial notification with the Banca d’Italia within four hours of classifying the incident as major. It also notifies the Garante under GDPR within 72 hours of becoming aware of the breach, and it informs affected customers if the risk to them is high. Two regulators, two forms, one incident. For the GDPR side, see GDPR breach notification: the 72-hour rule.
Which applies to you? A quick decision path
- Do you process personal data? Almost certainly yes, so GDPR applies.
- Are you a financial entity listed in DORA Article 2(1)? If yes, DORA applies and replaces NIS2’s cyber risk and reporting rules for you.
- If not, are you in a NIS2 Annex I or II sector, and medium-sized or larger (or covered regardless of size)? If yes, NIS2 applies through your national law. Check whether your national authority has registered or notified you.
- Do you provide ICT services to financial entities? Expect DORA contract clauses, audits and testing requests from your customers, on top of your own NIS2 duties if you are in scope.
Building one control set for all three
Running three separate compliance programmes wastes money and creates gaps where they disagree. The requirements overlap heavily, so design one control framework and map each law onto it.
1. Pick a backbone framework
ISO/IEC 27001:2022 is the most common choice. Its risk-based management system and Annex A controls cover most of NIS2 Article 21(2), DORA’s ICT risk management chapter and GDPR Article 32. It does not make you compliant by itself, but it gives you one place to keep policies, risks and evidence. See our ISO 27001:2022 implementation roadmap.
2. Keep one requirements map
Build a single matrix: control on the left, then columns for the NIS2 article, the DORA article (and technical standard), and the GDPR article. Where one law asks for more, the stricter rule wins. DORA’s annual testing and three-yearly TLPT, for example, go beyond anything in NIS2.
3. One incident process, three clocks
Use one detection, triage and response process (see what is incident response). Then add a classification step that answers three questions at the same time:
- Is it a major ICT-related incident under DORA, or a significant incident under NIS2?
- Is personal data affected, and what is the risk to individuals?
- Which authorities, customers and data subjects must be told, and by when?
Pre-approve templates for each report, and name one owner per clock. Then rehearse it. A cross-regime tabletop exercise exposes conflicts quickly. See our tabletop exercise guide.
4. One third-party inventory
Keep one supplier inventory that feeds the DORA register of information, NIS2 supply-chain security (Article 21(2)(d)) and GDPR processor management (Article 28). Tag each supplier with the functions it supports, the data it handles and its subcontractors. Cloud dependencies deserve particular care; see how to secure your cloud infrastructure.
5. One governance and training cycle
NIS2 Article 20 and DORA Article 5 both put the board in charge and require management training. DORA Article 13(6) and NIS2 Article 21(2)(g) both expect staff awareness. Run one board reporting cycle and one training programme with role-specific modules. See building a security awareness training program.
6. One evidence library
Store risk assessments, test results, incident records, breach logs (GDPR Article 33(5)) and board minutes once, tagged by regulation. Every audit and supervisory request then draws on the same evidence.
Watch this space: the Digital Omnibus
In November 2025 the European Commission proposed a “Digital Omnibus” package. Among other things, it would create a single entry point, run by ENISA, for incident reports under NIS2, GDPR, DORA and other acts. It would also change GDPR breach notification to a high-risk threshold with a 96-hour deadline. These are proposals, not law. Until they are adopted and in force, the current deadlines in the table above apply.
This is general guidance, not legal advice.
AceFortis runs practical training on NIS2, DORA and GDPR for security teams, compliance officers and boards, including cross-regime incident reporting drills. Get in touch to plan a session.
FAQ
Can an organisation be subject to NIS2 and DORA at the same time?
A single financial entity follows DORA rather than NIS2 for cyber risk management and incident reporting. A group can have both, though: DORA for its regulated financial companies and NIS2 for other in-scope companies. ICT providers can also face both.
If we report an incident under DORA, do we still notify the data protection authority?
Yes, if personal data is affected and the breach is likely to result in a risk to individuals. GDPR notification is a separate legal duty with its own authority and its own 72-hour clock.
Which fine regime is the highest?
GDPR’s ceiling of €20m or 4% of global turnover is the highest of the three. But breach notification failures fall in GDPR’s lower tier (€10m or 2%). NIS2 sets minimum maximums that national laws may exceed. DORA fines for financial entities depend on national law.
Does ISO 27001 certification make us NIS2 or DORA compliant?
No. It gives you a strong base, but each law adds specific duties that certification does not prove on its own: reporting deadlines, management liability, TLPT and the register of information.
