How long must we keep security incident records?

NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. sets no single retention period, so decide one yourself and write down why. Several rules point the same way. The GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). requires controllers to document every personal data breach (Article 33(5)) so that the authority can verify compliance, which implies keeping the record for as long as that check could reasonably come. NIS2 supervisors can ask for evidence of past incidents and reports, insurers may examine a claim long after the event, and limitation periods for contract and liability claims run for years in many countries. Sector rules and national laws may set their own periods. A common approach is to keep the incident register and reports for several years, and raw logs for a shorter time, deleting personal data that is no longer needed. NetSenX's alert history and audit-log retention depend on the plan; export what you must keep longer.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics