GDPR, DORA overlap
GDPR and DORA: aligning contracts, security and incidents
A financial entity applies both texts to the same providers, the same systems and often the same incidents. Handling them separately means reopening every contract twice and running two procedures that pull in different directions.
By Younes Lahrach, data protection specialist and external DPO, director of Sila International Advisory. First published on , last reviewed against the texts on .
Three areas of overlap
| Topic | GDPR | DORA | Source |
|---|---|---|---|
| Provider contracts | Article 28(3): processor terms | Article 30: mandatory ICT contract provisions | Regulation (EU) 2022/2554, Article 30 |
| Inventory | Article 30: records of processing | Article 28(3): register of information on ICT arrangements | Regulation (EU) 2016/679, Article 30 |
| Security | Article 32: technical and organisational measures | Articles 5 to 15: ICT risk management framework | Regulation (EU) 2016/679, Article 32 |
| Incidents | Articles 33 and 34: personal data breaches | Articles 17 to 19: major ICT-related incidents | Regulation (EU) 2022/2554, Article 19 |
The method: one amendment, two regulations
The DORA register and the records of processing usually list the same providers. Reconciling them shows, contract by contract, which clauses are missing under each text, so they can be negotiated in a single amendment.
On security, the DORA framework is more detailed than GDPR Article 32. An entity that meets it documents most of what Article 32 expects; what remains are measures specific to personal data, such as minimisation and pseudonymisation.
What this means for you
- Reconcile both registers before renegotiating.
- One amendment per provider.
- One incident procedure that triggers both reports.
Align your ICT contracts
A first call sizes how many contracts need reworking under both regulations.
Book a callFrequently asked questions
Are the DORA Article 30 clauses enough for the GDPR?
No. They do not cover every item in GDPR Article 28(3), such as processing only on documented instructions or assistance with data subject rights. Both sets of clauses are needed.
Does the DPO have a role under DORA?
DORA assigns no task to the DPO. In practice, the records of processing and processors feed the Article 28(3) register of information.
What this regime triggers elsewhere
Deadlines compared for a single incident.
Incident reporting: GDPR, NIS2 and DORAThe Article 28(3) register and Article 30 clauses.
DORAThe DPO already holds the inventory of data flows that DORA asks you to map.
Outsourced DPOAbout the author
Younes Lahrach is the founder and director of Sila International Advisory. A GDPR legal consultant and external data protection officer since July 2025, he holds a Master's degree (M2) in European Union law, specialising in data protection, from the University of Lille, and an MBA in International Finance from Middlesex University. He is a legal consultant, not a lawyer (avocat).
His background →Reference texts
The information on this page is general in nature and does not constitute legal advice on a specific situation. Sila is not a law firm and does not provide representation before the courts.