One incident, several reports: how do NIS2, the GDPR and DORA fit together?

Each law has its own report, recipient and clock, and one incident can trigger several. A significant incident at an entity in scope goes to the CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported. or competent authority under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. Article 23; if personal data is affected, the controller also notifies the data protection authority under GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). Article 33; a financial entity reports major ICT-related incidents under DORA Article 19 instead of NIS2 for those incidents; and a product manufacturer may have duties under the Cyber Resilience Act, see Regulation (EU) 2024/2847, Article 14. Some national systems offer a single portal, but do not assume one report covers all. Build one incident record and generate each report from it, so the facts match. NIS2 Article 35 also asks NIS2 authorities to inform data protection authorities of breaches they learn about. NetSenX tracks the NIS2 deadlines and prepares a GDPR Article 33 draft from the same incident data.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 35 questions on Incident reporting deadlinesAll topics