GDPR and NIS2: How the Two Regimes Fit Together
GDPR vs NIS2 for security teams: scope, security measures, 24h/72h/one-month reporting, authorities, fines and one incident process with two outputs.
If your organisation is an essential or important entity under NIS2, your security team now answers to two European regimes at once. The General Data Protection Regulation (Regulation (EU) 2016/679) protects people whose personal data you process. The NIS2 Directive (Directive (EU) 2022/2555) protects the network and information systems behind services that matter to the economy and society. They overlap heavily on security measures and incident handling, but they differ in scope, deadlines, recipients and sanctions. This guide sets them side by side so you can build one security programme and one incident-response process that produces the outputs both regimes require.
Two regimes, two objects of protection
The simplest way to keep GDPR and NIS2 apart is to ask what each one protects.
- GDPR protects natural persons with regard to the processing of their personal data. It applies to any controller or processor in scope, whatever its size or sector. A lost laptop holding a customer spreadsheet is a GDPR matter even if no service was disrupted.
- NIS2 protects the security of network and information systems and the continuity of the services they support. It applies to "essential" and "important" entities in the sectors listed in its Annexes I and II, generally medium and large organisations (with some exceptions regardless of size). A ransomware attack that shuts down a hospital's scheduling system is a NIS2 matter whether or not personal data was touched.
Many incidents are both. A NIS2 entity whose customer database is exfiltrated has a significant incident under NIS2 and a personal data breach under GDPR. Remember too that NIS2 is a directive: it applies through national transposition laws. The transposition deadline was 17 October 2024, with measures to apply from 18 October 2024, but several Member States transposed late. Check your national law for the exact thresholds, registration duties and authority names.
Scope compared
| Aspect | GDPR | NIS2 |
|---|---|---|
| Legal instrument | Regulation (EU) 2016/679, directly applicable | Directive (EU) 2022/2555, applies via national law |
| What is protected | Personal data and the rights and freedoms of natural persons | Network and information systems and the services they support |
| Who is covered | Any controller or processor processing personal data in scope | Essential and important entities in sectors listed in Annexes I and II |
| Size threshold | None | Generally medium and large entities, with exceptions |
| Trigger for incident duties | Personal data breach (Art. 4(12)) | Significant incident (Art. 23) |
| Governance | Controller accountability (Art. 5(2), Art. 24) | Management bodies approve and oversee measures, can be held liable, must follow training (Art. 20) |
Financial entities should also look at DORA (Regulation (EU) 2022/2554), which applies from 17 January 2025 as the specific regime for ICT risk management and incident reporting in the financial sector. GDPR continues to apply alongside it.
Security measures: Article 32 GDPR vs Article 21 NIS2
GDPR Article 32 requires controllers and processors to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risk to the rights and freedoms of natural persons. It lists four examples: pseudonymisation and encryption; ongoing confidentiality, integrity, availability and resilience; timely restoration after an incident; and regular testing of effectiveness.
NIS2 Article 21(2) is more prescriptive. It sets ten minimum areas every in-scope entity must cover. The table maps them to their nearest GDPR counterpart.
| NIS2 Art. 21(2) measure | Nearest GDPR anchor |
|---|---|
| (a) Risk analysis and information system security policies | Art. 32(1) and 32(2) risk-based approach, Art. 24 |
| (b) Incident handling | Art. 33 and 34 breach handling, Art. 33(5) register |
| (c) Business continuity, backup management, disaster recovery, crisis management | Art. 32(1)(b) resilience, 32(1)(c) timely restoration |
| (d) Supply chain security | Art. 28 processor guarantees and contracts |
| (e) Security in acquisition, development and maintenance, incl. vulnerability handling and disclosure | Art. 25 data protection by design and by default |
| (f) Policies to assess effectiveness of measures | Art. 32(1)(d) regular testing and evaluation |
| (g) Basic cyber hygiene and training | Art. 32(4), Art. 39 DPO awareness-raising tasks |
| (h) Cryptography and, where appropriate, encryption | Art. 32(1)(a) pseudonymisation and encryption |
| (i) HR security, access control, asset management | Art. 32(1)(b) confidentiality, Art. 30 records of processing |
| (j) MFA or continuous authentication, secured communications | Art. 32(1)(b) confidentiality and integrity |
The practical conclusion: one control framework can serve both regimes. The difference lies in the risk lens. NIS2 asks about risk to the service and its users; GDPR asks about risk to the individuals whose data you process. When you run a risk assessment, record both perspectives in the same register so each control can be justified twice.
Incident reporting timelines
This is where security teams most often get caught out, because the clocks, recipients and thresholds differ.
| Step | NIS2 (Art. 23) | GDPR (Art. 33 and 34) |
|---|---|---|
| Trigger | Significant incident | Personal data breach, unless unlikely to result in a risk to rights and freedoms |
| Clock starts | On becoming aware of the significant incident | On becoming aware of the breach |
| First output | Early warning without undue delay, in any event within 24 hours | Notification to the supervisory authority without undue delay and, where feasible, within 72 hours |
| Second output | Incident notification within 72 hours (initial assessment, severity, impact, indicators of compromise) | Information may be provided in phases (Art. 33(4)) |
| Interim | Intermediate report on request | Further phases without undue further delay |
| Final | Final report no later than one month after the incident notification | No fixed final report; document everything under Art. 33(5) |
| Communication to people | Recipients of services may need to be informed of significant incidents and threats | Data subjects informed without undue delay if high risk (Art. 34), unless an Art. 34(3) exception applies |
| Internal record | Per national implementation | Every breach documented, notified or not (Art. 33(5)) |
Two details matter. First, trust service providers have a shorter NIS2 deadline: the incident notification is due within 24 hours. Second, the GDPR 72-hour window is for the authority notification, and missing it requires reasons for the delay. Our breach notification guide covers the GDPR side hour by hour.
Authorities and cooperation
The recipients are different bodies and do not automatically share your report with each other.
| Aspect | GDPR | NIS2 |
|---|---|---|
| Recipient of reports | Data protection supervisory authority (e.g. CNIL in France) | CSIRT or competent authority (e.g. ANSSI in France) |
| EU coordination | European Data Protection Board (EDPB) | NIS Cooperation Group and CSIRTs network |
| Cross-regime link | Receives information from NIS2 authorities | Art. 35: informs the GDPR supervisory authority without undue delay when an infringement may entail a personal data breach to be notified under Art. 33 GDPR |
The NIS2 authority passing information to the data protection authority does not replace your own GDPR notification. Always file both where both are triggered.
Fines compared
| Regime | Maximum administrative fine |
|---|---|
| GDPR Art. 83(4) (incl. Arts 25, 28, 30, 32, 33, 34, 35) | Up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher |
| GDPR Art. 83(5) (principles incl. Art. 5, lawful basis, data subject rights, transfers) | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher |
| NIS2 Art. 34, essential entities | A maximum of at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher |
| NIS2 Art. 34, important entities | A maximum of at least EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher |
NIS2 sets a floor for the national maximum ("at least"), so check the figure in your national transposition law. On double penalties, NIS2 Article 35 provides that where a GDPR supervisory authority imposes an administrative fine under GDPR Article 58(2)(i), the NIS2 competent authority shall not impose an administrative fine under NIS2 Article 34 for an infringement arising from the same conduct. It can still use other enforcement measures, such as binding instructions or audits.
One incident-response process, two outputs
Do not run two parallel incident processes. Run one, and add two decision gates early: "Is this a significant incident under NIS2?" and "Is personal data affected?" A combined flow:
- Detect and triage. SOC raises an incident; the incident manager opens a single case record and notes the time of awareness.
- Classify in parallel (target: within the first few hours). Security assesses NIS2 significance using national criteria; the DPO is brought in to assess whether a personal data breach has occurred and the likely risk to individuals.
- NIS2 early warning (within 24 hours). If significant, send the early warning to the CSIRT or competent authority, stating whether unlawful or malicious action is suspected and whether there could be cross-border impact.
- Contain, eradicate, preserve evidence. Same technical work for both regimes. Keep logs and timelines; they feed both reports.
- GDPR notification (within 72 hours where feasible). If the breach is not unlikely to result in a risk, the controller notifies the supervisory authority with the Art. 33(3) content; phased notification is acceptable.
- NIS2 incident notification (within 72 hours). Update the early warning with initial assessment, severity, impact and indicators of compromise.
- Communicate to data subjects if high risk. Art. 34, unless an exception such as strong encryption applies.
- Final NIS2 report (within one month of the notification) and GDPR Art. 33(5) documentation, then lessons learned feeding both risk registers.
A single case record can carry both outputs. An illustrative structure:
incident_id: INC-2026-0142
awareness_time: "2026-09-28T09:40:00+02:00"
summary: "Unauthorised access to customer portal database"
nis2:
significant: true
early_warning_due: "2026-09-29T09:40:00+02:00"
early_warning_sent: "2026-09-28T18:05:00+02:00"
notification_due: "2026-10-01T09:40:00+02:00"
final_report_due: "one month after notification"
recipient: "national CSIRT / competent authority"
gdpr:
personal_data_breach: true
breach_type: [confidentiality]
risk_to_individuals: "high"
sa_notification_due: "2026-10-01T09:40:00+02:00"
recipient: "lead or competent supervisory authority"
data_subject_communication: "required - Art. 34(1)"
dpo_consulted: true
evidence:
- "SIEM export, retained under legal hold"
- "EDR timeline for affected hosts"
Keep the reports consistent. Authorities may compare them, and contradictions about scope or timing damage credibility.
Practical checklist
- Confirm whether you are an essential or important entity under your national NIS2 law, and register if required.
- Map Art. 21(2) measures to your control framework and tag each control with its GDPR Art. 32 relevance.
- Add the DPO to the incident-response on-call rota for classification decisions.
- Pre-draft templates for the NIS2 early warning, NIS2 notification and GDPR Art. 33 notification.
- Store authority contact details and portal access for both the CSIRT and the data protection supervisory authority.
- Brief management bodies on their NIS2 Art. 20 responsibilities and on GDPR accountability.
- Test the combined process with a tabletop exercise at least once a year.
For the NIS2 side in more depth, see our companion site on NIS2, cybernis2.com.
Scope of this guide
This article is technical guidance for security and IT teams on aligning GDPR and NIS2 practice. It is not legal advice, and NIS2 obligations depend on national transposition. Confirm classification, notification and reporting decisions with your DPO and legal counsel.