NIS2 vs GDPR

How NIS2 and the GDPR differ on scope, duties and fines

This table sets NIS2 and the GDPR side by side on legal form, coverage, security duty, reporting, fines, supervision and certification. Read each row as a question you need answered for your own organization, since an entity covered by both laws answers each row twice.

How one incident triggers both regimes at once

Reporting clocks to run in parallel: 24 hours, 72 hours and one month

The sequence gives one incident record that feeds two notification regimes, each on its own clock. Each step names who sends what, to whom, and the check that shows the notice went out on time. Confirm the content and recipient rules for your entity with your national CSIRT or competent authority before the first incident.

1. Open one incident record and time-stamp awareness

   The incident lead opens a single record as soon as the organization becomes aware of an event that may be a significant incident or may involve personal data. The record captures the time of awareness, the systems and services affected, and who holds decision rights. Both the NIS2 clocks and the GDPR 72-hour clock in Article 33(1) run from awareness, so this timestamp is the reference point for every later deadline. Done when the record exists, the timestamp is fixed, and the on-call team has read access. Confirm with your national authority how it defines awareness for NIS2 purposes.

2. Classify the event under two separate tests

   Two people decide, and record separately, whether the event is a significant incident under NIS2 and whether it is a personal data breach notifiable under GDPR Article 33. One test does not settle the other. A NIS2 significant incident can involve no personal data, and a personal data breach can occur without meeting the significant incident criteria that apply to your sector. The output is a short written determination for each regime, signed by the incident lead and the data protection officer. Check that both determinations cite the time of awareness from the first step.

3. Send the NIS2 early warning within 24 hours

   Once the NIS2 assessment flags a significant incident, the designated contact sends the early warning to the CSIRT or competent authority named for your entity. Article 23 sets the deadline at 24 hours from awareness. Keep the early warning to what the national rules require, and do not hold it back to wait for a full analysis. Confirm the fields, the submission channel and whether cross-border impact must be flagged. Done when the submission receipt or reference number is filed on the incident record.

4. Notify the GDPR supervisory authority within 72 hours

   If the second step found a notifiable personal data breach, the data protection officer or a delegated lead notifies the competent supervisory authority under GDPR Article 33(1) within 72 hours of awareness. This clock is separate from NIS2 and runs to a different recipient, typically the national data protection authority. If the facts are not yet complete, the GDPR allows the information to follow in stages, so record the reasons for any gap. Done when the notice reference is on the incident record and the internal breach register entry is updated.

5. Send the NIS2 incident notification within 72 hours

   Within 72 hours of awareness, under Article 23, the entity sends the incident notification to the same CSIRT or competent authority that received the early warning. It updates the early warning with an initial assessment of severity, impact and indicators of compromise where available. This is the stage where the two regimes must agree on facts: the affected systems, the categories of data and the number of affected people if known. Done when the update is filed and the incident lead has reconciled it line by line with the GDPR notice from the previous step.

6. Coordinate with the data protection authority, where needed

   Under NIS2 Article 35(1), when an infringement of Article 21 or 23 can entail a personal data breach notifiable under Article 33, the competent authority must inform the GDPR supervisory authority without undue delay. Do not assume that this exchange removes your own duty to notify. Keep the GDPR notice on file and be ready to answer follow-up questions from either regulator on the same facts. Under Article 35(2), if the data protection authority fines the same conduct under GDPR Article 58(2)(i), the NIS2 authority may not impose an Article 34 fine for that conduct, though other enforcement measures remain possible. Done when one fact sheet is shared with both regulator contacts.

7. File the NIS2 final report within one month

   Within one month of the incident, the entity files the final report with the same authority under Article 23. It sets out a detailed description of the incident, its severity and impact, the likely root cause, and the mitigations applied and still under way. Confirm with your authority how an incident that remains open at that point is handled, including whether an interim update is expected. Done when the final report is filed, the root cause and corrective actions are logged, and the GDPR breach record points to the same timeline.

8. Check the single entry proposal before changing channels

   The Commission's Digital Omnibus proposal of 19 November 2025 would create an ENISA-run single entry point for incident reports under NIS2, the GDPR, DORA and other laws. The Commission says it would not modify existing reporting obligations, and it remains a proposal. Until any such change is adopted and applied, keep the two channels, the NIS2 24-hour, 72-hour and one-month stages, and the GDPR 72-hour notice fully separate. Done when the runbook names the current recipients for each regime, carries a scheduled review date, and is signed off by legal and the CISO.

Where NIS2 and GDPR work overlaps in practice

NIS2 and the GDPR apply to the same organization at the same time, and much of the work they require lands on the same people and systems. The cards below cover the places where one body of evidence can serve both regimes, and the places where a single control set still leaves gaps that a reviewer will ask about.

Who assesses each regime and what proof it produces

This table compares who supervises NIS2 and the GDPR, what tools each regulator uses and what written proof, if any, each regime produces. Read it to decide which evidence to build for each regulator, because neither regime issues a certificate of compliance.

What drives the cost of meeting both regimes

Which to do first and how to share evidence

This sequence gives a team in both scopes one incident process that meets both notification regimes and one body of control evidence that serves NIS2 and GDPR reviewers without duplicated work.

1. Confirm NIS2 scope, classification and registration

   Establish whether the organization or any group entity is an in-scope entity under NIS2, and whether it is classified as essential or important, since the classification sets the supervision regime that applies (ex ante for essential entities, ex post for important ones). Identify the national competent authority and the CSIRT in each Member State where you operate, and confirm the registration status with each. Ask counsel or the national authority to confirm sector mapping, because the Annex I and Annex II criteria and national transposition laws decide the outcome. Done when a written scope record names each in-scope entity, its classification, its authorities and its registration status.

2. Map personal data flows and the breach register

   Inventory the systems and processes that handle personal data, including third-party processors, and record which controller or processor roles apply to each. Stand up or confirm the GDPR breach register that documents every personal data breach, its facts, its effects and the remedial action taken, as the GDPR requires for all breaches whether or not they are notified. Identify which data protection authority is lead for each processing activity. Done when every system that holds personal data appears on a single map with an owner, and the breach register has a named custodian who can produce it on request.

3. Build one incident process with two clocks

   Write one incident procedure that classifies events by whether they are significant incidents under NIS2 Article 23, whether they involve a personal data breach under GDPR Article 33, or both. Set out the NIS2 reporting stages (24 hours, 72 hours and one month) and the GDPR 72-hour notice on separate timelines that start at the moment each obligation is triggered. Assign who decides on classification, who signs each notice and who contacts the CSIRT, the supervisory authority and affected individuals where required. Done when a tabletop walkthrough of one hypothetical incident produces a completed decision log showing both clocks and the named approver for each notice.

4. Align Article 21 and Article 32 controls on shared evidence

   Map the risk-management measures under NIS2 Article 21 and the security of processing controls under GDPR Article 32 to one control inventory, so that a single control such as access management, backup or vulnerability handling has one owner, one implementation record and one set of test results. Note where a control satisfies only one regime and where NIS2 duties, such as registration and management body accountability, need separate records. Use ENISA's non-binding technical guidance on Implementing Regulation 2024/2690 as a reference for evidence examples, and treat any mapping as a working aid rather than proof of equivalence. Done when each control has a single evidence pack that a NIS2 authority and a data protection authority could both review, and the gaps list is owned and dated.

5. Test the combined process with an exercise

   Run a scenario-based exercise in which one incident affects a network service and exposes personal data, so that participants must decide on both NIS2 and GDPR notices under time pressure. Include the management body, legal, data protection, security operations and the communications lead, since NIS2 places duties on management bodies. Record where the two clocks conflicted, where evidence was missing and where the approver chain was unclear. Done when the exercise report lists corrective actions with owners, and the incident procedure and control inventory are updated to reflect them.

6. Re-sequence when a regulator or contract sets a date

   Treat this order as a default, not a fixed plan. If a national authority, a supervisory authority or a customer contract sets a specific date for registration, a notice or evidence, move the affected step to the front and confirm the requirement in writing with the party that set it. Monitor the Commission's pending NIS2 amendment and the Digital Omnibus proposal, since either could change reporting channels, so ask counsel to confirm the status before each review cycle. Done when the scope record and the evidence register show the date source and the date owner for every externally set deadline.

NIS2 and GDPR questions buyers ask before hiring help

What to confirm with counsel and your regulators