GDPR, NIS2, DORA overlap
Incident reporting: aligning GDPR, NIS2 and DORA deadlines
A ransomware attack on a financial entity can trigger, for a single event, a report to the data protection authority, a sectoral report under NIS2 or DORA, and notice to affected individuals. Deadlines, thresholds and recipients all differ. This page sets them side by side.
By Younes Lahrach, data protection specialist and external DPO, director of Sila International Advisory. First published on , last reviewed against the texts on .
The three regimes side by side
| Regulation | Trigger | First deadline | Follow-up | Recipient | Source |
|---|---|---|---|---|---|
| GDPR | Personal data breach | 72 hours after becoming aware, where feasible | Notice to individuals where risk is high (Article 34) | Supervisory authority | Regulation (EU) 2016/679, Articles 33 and 34 |
| NIS2 | Significant incident | Early warning within 24 hours | Notification within 72 hours, final report one month later | CSIRT or competent authority | Directive (EU) 2022/2555, Article 23(4) |
| DORA | ICT-related incident classified as major | 4 hours after classification, 24 hours at most after awareness | Intermediate report within 72 hours, final report one month later | Financial competent authority | Delegated Regulation (EU) 2025/301, Article 5 |
Checked on EUR-Lex on 4 November 2026. NIS2 deadlines apply as transposed in each Member State.
Who reports what: the priority rule
NIS2 and DORA do not stack. Article 1(2) of Regulation (EU) 2022/2554 makes DORA the sector-specific act under Article 4 of Directive (EU) 2022/2555: a financial entity reports under DORA, not NIS2.
The GDPR, however, does stack. If personal data is affected, the report to the data protection authority comes on top of the sectoral report, with its own threshold: risk to the rights and freedoms of individuals on one side, a significant or major incident on the other.
Building one procedure
One starting point
Timestamp awareness at detection. Every deadline runs from it.
Two assessments in parallel
Classify the incident under the sectoral text and the breach under the GDPR at the same time.
Templates ready
Prepare each authority's forms before an incident, not during one.
A breach log
GDPR Article 33(5) requires every breach to be documented, even when not reported.
What may change
On 19 November 2025 the Commission proposed a single entry point for these reports. At the review date of this page it has not been adopted. The Council adopted its position on 21 October 2026, replacing the EU-level entry point with national entry points; the European Parliament had not yet adopted its own at that date.
What this means for you
- The shortest deadline sets the pace of your procedure.
- A financial entity reports under DORA, not NIS2.
- The GDPR report always comes on top when personal data is hit.
Stress-test your incident procedure
A first call checks that your procedure covers every regime that applies to you.
Book a callFrequently asked questions
Do I report the same incident to both the data protection and financial authorities?
Yes, if it is both a major incident under DORA and a personal data breach posing a risk. The two reports are independent.
Does a financial entity also report under NIS2?
No. Article 1(2) of DORA makes it the sector-specific act referred to in Article 4 of NIS2, so NIS2 reporting obligations do not apply to the financial entities covered.
What if the GDPR 72-hour deadline cannot be met?
Article 33(1) allows a late notification with reasons for the delay, and Article 33(4) allows information to be provided in phases.
What this regime triggers elsewhere
About the author
Younes Lahrach is the founder and director of Sila International Advisory. A GDPR legal consultant and external data protection officer since July 2025, he holds a Master's degree (M2) in European Union law, specialising in data protection, from the University of Lille, and an MBA in International Finance from Middlesex University. He is a legal consultant, not a lawyer (avocat).
His background →Reference texts
- Regulation (EU) 2016/679 (GDPR)
- Directive (EU) 2022/2555 (NIS2)
- Regulation (EU) 2022/2554 (DORA)
- Delegated Regulation (EU) 2025/301
The information on this page is general in nature and does not constitute legal advice on a specific situation. Sila is not a law firm and does not provide representation before the courts.