What are the DORA incident reporting deadlines?
They are set in the technical standards adopted under Article 20 of DORA, not in the regulation itself. Read those standards and your competent authority's guidance for the exact hours and days. Article 19(4) fixes the sequence: an initial notification, an intermediate report as soon as the status of the original incident has changed significantly or handling has changed based on new information, followed by updated notifications as relevant, and a final report when the root cause analysis has been completed. The standards also set the content and templates. Because the time limits are linked to when the incident is detected and classified as major, the speed of your classification matters as much as the speed of writing. If you are an ICT supplier to a financial entity, expect your contract to require you to notify the customer quickly enough for it to meet these deadlines.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Where are Cyber Resilience Act vulnerability reports submitted?
- Should we report a cyber incident to the police as well as the regulator?
- What information should an incident report to the authorities contain?
- Do we still have to report an incident that is already resolved?
- What reduces a GDPR fine after a data breach?
← All 35 questions on Incident reporting deadlinesAll topics