NIS2 vs GDPR fines: which regime can hit you harder
If your entity is in NIS2 scope and also processes personal data, the short answer is that both regimes can apply to the same incident, and the higher ceiling depends on which infringement is at issue. NIS2 Article 34 requires maximum fines of at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important entities. Member States apply these figures through national law. GDPR Article 83 sets two tiers applied directly: EUR 10 million or 2% of total worldwide annual turnover for controller and processor obligations such as security of processing, and EUR 20 million or 4% for infringements of the core principles, lawful basis, data subject rights and transfer rules. In each GDPR tier, the higher of the two figures applies.
The answer therefore depends on four things: the infringement itself, the entity's NIS2 classification as essential or important (Article 3), how the relevant Member State transposed NIS2 into its national law, and the worldwide turnover of the preceding financial year. For the NIS2 side, the classification does not change the Article 21 risk-management measures or the Article 23 reporting duties. It changes the supervisory regime and the fine ceiling. Confirm with your national competent authority how it has set its own maximums, because the minimum amounts in the Directive are floors that Member States may exceed. For the GDPR side, confirm which supervisory authority is your lead authority, since the same incident can lead to separate proceedings.
Plan for the overlap rather than the single fine. A single incident involving a compromised system that holds personal data can trigger a NIS2 inspection or fine from the national authority and a GDPR investigation from a supervisory authority, with separate ceilings under each regime. Ask your legal and compliance team to map which infringements in your incident process fall under each regime, and to confirm how your national NIS2 law and the GDPR are applied to that overlap. Management body accountability under Article 20(1) also means that the board must approve the Article 21 measures, so document that approval alongside your GDPR accountability records.
How NIS2 and GDPR maximum fines compare, part by part
This table compares the legal source, fine ceilings, triggers, fine-imposing authorities and certification status of NIS2 and the GDPR. NIS2 amounts are minimum maximums that national law must set, so the figures shown are floors for Member State ceilings, not fixed penalties. Read each row against your own classification and processing activities to see which tiers you could face.
| Factor | NIS2 (essential and important entities) | GDPR (controllers and processors) |
|---|---|---|
| Legal source | Directive (EU) 2022/2555, applied through national transposition laws | Regulation (EU) 2016/679, binding and directly applicable in all Member States |
| Who sets the maximum | Member States, which must set maximums of at least the Article 34 floors | The Regulation itself (Article 83), enforced by national supervisory authorities |
| Top fine tier | Essential: at least EUR 10 million or 2% of worldwide annual turnover, whichever is higher (minimum maximum) | EUR 20 million or 4% of worldwide annual turnover, whichever is higher, for principles, lawful basis, rights and transfers |
| Second fine tier | Important: at least EUR 7 million or 1.4% of worldwide annual turnover, whichever is higher (minimum maximum) | EUR 10 million or 2% of worldwide annual turnover, whichever is higher, for security, breach notification and DPIA duties |
| Trigger for each tier | Infringement of Article 21 risk-management or Article 23 reporting duties, as set by national law | Infringement category in Article 83(4) or 83(5), including security of processing under Article 32 |
| Who imposes fines | National competent authorities, using inspections, audits, scans and information requests | Independent national supervisory authorities (Article 51); EDPB resolves disputes (Articles 65 and 70) |
| Management body role | Management bodies must approve Article 21 measures and oversee their implementation (Article 20(1)) | No separate management body duty; accountability sits with the controller or processor |
| Effect of classification | Essential entities face ex ante supervision, important entities ex post; fine ceilings differ by tier | No classification; the fine tier depends on the infringed provision and turnover |
| Certificate of compliance | None; NIS2 creates no certificate and authorities oversee compliance directly | None required; Article 42 certification is voluntary and does not reduce responsibility |
What triggers each NIS2 and GDPR fine tier
The GDPR fine tiers attach to categories of infringement, not to the size of an incident. Article 83(4) sets a ceiling of EUR 10 million or 2% of total worldwide annual turnover of the preceding financial year, whichever is higher, for controller and processor duties such as security of processing, breach notification, data protection impact assessments, data protection officers and records. Article 83(5) sets a ceiling of EUR 20 million or 4% on the same turnover basis for breaches of the processing principles and lawful basis, data subject rights, transfer rules and orders issued by a supervisory authority. The supervisory authority decides which category applies once it has investigated, so the question for your team is which of your processing duties the incident touches, not how severe the outage felt internally.
NIS2 works differently. Under Article 34, the maximum fine depends on whether the entity is classified as essential or important under Article 3, and the floors are set in national law: at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important entities. The classification does not change the Article 21 risk-management measures or the Article 23 reporting duties, which apply to both classes. Confirm your classification with your national competent authority and check how your Member State transposed the fine levels, because the national law sets the amounts you should plan around. Management body accountability under Article 20(1) is a separate route to personal exposure that the GDPR tiers do not carry.
One incident can trigger both regimes. A ransomware event that disables a service and exposes personal data may breach Article 21 measures under NIS2 and Article 32 security duties under the GDPR, with each regulator assessing its own provisions. Plan for two supervisors, two sets of evidence and two fine ceilings, and ask counsel to confirm how your national transposition and the GDPR interact for your entity before an incident, not during one.
Factors that change the fine exposure in practice
The maximum fine an entity faces depends on how NIS2 classifies it, how its turnover is measured, which GDPR tier a failure falls under and how the national authority supervises it. These cards cover the variables that decide the ceiling for an organization caught by both regimes.
Essential or important classification
Article 3 places each in-scope entity in one of two classes, and the class sets the NIS2 maximum: at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important entities. The same incident can produce a different NIS2 ceiling depending on that classification. Check your classification in writing with your national competent authority before you model exposure, because the label drives the cap.
Worldwide turnover of the preceding year
Both NIS2 and GDPR percentage caps are calculated on total worldwide annual turnover, and the GDPR uses the figure for the preceding financial year. A group with a large non-EU parent may see its cap driven by consolidated group revenue, not the local subsidiary. Ask legal and finance which turnover figure a regulator would use for your group structure, and keep that calculation documented for each fiscal year.
Which GDPR tier applies
The GDPR sets two tiers: EUR 10 million or 2% for controller and processor duties such as security of processing and breach notification, and EUR 20 million or 4% for principles, lawful basis, data subject rights and transfers. A security failure that exposes personal data usually falls in the lower tier, but an unlawful processing decision made in the same incident can move it up. Map each finding to the article it breaches before estimating the GDPR ceiling.
National transposition choices
NIS2 is a directive, so the fine ceilings, enforcement powers and penalty procedures reach entities through each Member State's transposition law. Article 5 also lets Member States adopt or keep rules that ensure a higher level of cybersecurity. Entities operating in several EU countries may face different national rules for the same group, so confirm the transposing law in each country where you have an establishment or a supervised service.
Ex ante or ex post supervision
Essential entities face ex ante supervision, meaning authorities can inspect and audit before an incident occurs. Important entities face ex post supervision, which generally starts once authorities have evidence of non-compliance. The regime affects how quickly a problem reaches an enforcement action, not the fine ceiling itself. Confirm with your authority how it will request evidence, since a prepared evidence file shortens the time between a request and a finding.
Proposed amendments in COM(2026) 13
On 20 January 2026 the Commission proposed targeted NIS2 amendments, including a new small mid-cap category. The proposal still needs approval by the European Parliament and the Council, and Commission pages describe it as a proposal. Until adoption and national transposition, plan against the current Directive. Track the procedure, and ask counsel whether any change would move your entity's classification or supervisory regime.
Who imposes fines and who carries management accountability
National competent authorities enforce NIS2 in each Member State, and independent national supervisory authorities enforce the GDPR. The two regimes do not share an enforcer, so one incident can produce a NIS2 proceeding before a national authority and a GDPR proceeding before a data protection authority. Where authorities in several Member States disagree on a cross-border GDPR case, the European Data Protection Board resolves the dispute through binding decisions under Articles 65 and 70. No equivalent body sits over NIS2 enforcement in the same way, so the entity should confirm which national authority supervises it and how that authority handles incidents that also touch personal data.
The clearest accountability difference is in governance. Under Article 20(1) of NIS2, Member States must ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken under Article 21 and oversee their implementation. This places a named duty on the board or executive team, not only on the security function. Before the next audit cycle, confirm in writing who on the management body approved the current measures, when, and what reporting the board receives on their implementation. Check the national transposition law too, because the personal liability and enforcement details for management are set there.
Neither regime issues a certificate that removes liability. NIS2 creates no certificate of compliance, and the GDPR requires no audit, attestation or certificate. Article 42 GDPR certification is voluntary, lasts for at most three years, and does not reduce the controller's or processor's responsibility for compliance. A certification or attestation from a third party can support evidence, but it does not answer an authority's inspection or a fine. Plan for the regulator's questions, not for a badge.
How to confirm your fine exposure under both regimes
This sequence turns the headline maximums into an exposure estimate you can defend, by fixing which NIS2 tier applies, which national law sets the fines, what turnover base is used, and which GDPR tier each likely failure falls under. It ends with a record that the management body approved the measures.
Confirm sector and classification under Article 3
Start by checking whether the entity operates in one of the 18 sectors covered by NIS2, in Annex I or Annex II, and whether it is classified as essential or important under Article 3. Legal or compliance leads should own this step, with the business owner for each service line. The output is a short classification memo that names the Annex, the sector, the entity type and the reasoning, signed off by the legal lead. Revisit it if group structure or service scope changes, and note that the Commission's February 2026 proposal to amend NIS2 is still pending and should be tracked.
Identify the national transposition law and fine provisions
Find the national law that transposes NIS2 in each Member State where the entity provides services, because NIS2 is a directive and the maximum fines are set through that law. Ask the national competent authority which fine provisions apply to your classification and whether any national rules go beyond the EU minimum maximums. The output is a table listing each Member State, the transposing law, the article that sets fines and the authority responsible. Confirm these figures in writing with the competent authority, not from secondary summaries.
Establish worldwide turnover of the preceding financial year
Gather the total worldwide annual turnover for the preceding financial year at group level, since both the NIS2 percentage caps and the GDPR percentage caps are calculated on turnover and not on profit or on a single subsidiary. Finance should own this step and reconcile the figure with the audited accounts. The output is a documented turnover figure, its source and the currency conversion used, which lets you calculate the EUR amount under each percentage cap for comparison. Ask counsel whether the relevant undertaking is the group or a narrower entity under the applicable national rules.
Map personal data processing to GDPR fine tiers
Inventory where the systems in scope process personal data and list the likely failure modes, such as a security gap leading to a breach, a late breach notification, a missing data processing agreement, or an unlawful transfer. Privacy and security teams should work through the list together. Each failure should then be assigned to the Article 83(4) tier (controller and processor duties such as security, breach notification and DPIAs) or the Article 83(5) tier (principles, lawful basis, data subject rights and transfers). The output is a register of scenarios mapped to tiers, with the EUR and percentage caps noted for each. Illustrative only: a single incident may trigger a NIS2 reporting failure and a GDPR security failure at the same time.
Document management body approval of risk measures
Confirm that the management body of the essential or important entity has approved the cybersecurity risk-management measures taken under Article 21 and oversees their implementation, as Article 20(1) requires. The governance lead should prepare the board or management paper, record the approval date and the named members, and log the oversight routine that follows. The output is signed minutes or a resolution that can be produced to the competent authority on request. Where NIS2 fines reach management, this record is often the first document an authority asks for, so store it with the classification memo and the fine register.
Confirm national fine levels with both authorities
Before relying on the exposure register, confirm the national fine levels and the procedures for imposing them with your NIS2 competent authority and with the data protection authority in each relevant country. Ask each authority how it applies its maximums, how it coordinates on a single incident, and what evidence it expects. Legal counsel should own the request and record the answers. The output is written confirmation or guidance that updates the register, and any figure you cannot confirm should be marked as unverified until it is.
Questions buyers ask about NIS2 and GDPR fines
Can one incident trigger both NIS2 and GDPR fines?
Yes, one incident can expose an entity to both regimes, but they are separate legal tracks with separate triggers. NIS2 fines follow failures in the Article 21 risk-management measures or the Article 23 reporting duties at an in-scope entity. GDPR fines follow infringements of controller and processor obligations involving personal data, such as security of processing or breach notification. A ransomware event that exposes personal data at a covered entity can therefore lead to a NIS2 inquiry by the national authority and a GDPR inquiry by the data protection authority. Each regulator decides on its own file, so the reader should plan for both from the start.
Who decides the NIS2 fine amount?
National competent authorities impose NIS2 administrative fines, because NIS2 is a directive applied through national transposition laws. The Directive sets the minimum maximums in Article 34: at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important entities. Member States set the actual ceilings and procedures in their own laws, so the reader should confirm the national rules that apply to each country where the entity operates. Essential entities face ex ante supervision and important entities face ex post supervision, which shapes how and when a fine case begins.
Does a certificate reduce our fine exposure?
No certificate reduces NIS2 or GDPR fine exposure, because neither regime issues one for compliance. NIS2 creates no certificate of compliance, and national authorities oversee it through inspections, security audits, security scans, information requests and fines. The GDPR requires no audit, attestation or certificate, and an Article 42 certification is voluntary, lasts for at most three years, and does not reduce the controller's or processor's responsibility. A third-party report or ISO certificate can still be useful evidence of control design and operation, but the reader should ask the authority or the auditor what weight it carries in a specific case.
What does a fine assessment cost and who pays for it?
Fines are paid by the entity, while the cost of preparing for an assessment is paid to whoever does the work. No supplied figure gives the cost of a fine assessment, so the reader should not assume one. The cost components usually include internal staff time, legal counsel, control evidence work, and any external assessor or implementation partner. Costs are typically one-time for a gap analysis and recurring for monitoring and evidence upkeep. DeployOpen works from a written scope, and most engagements are fixed-scope, so the reader should ask for deliverables, timelines and exclusions in writing before comparing quotes. DeployOpen does not publish a price list.
How much effort is it to align the NIS2 and GDPR programs?
Effort depends on how much of the security program already covers personal data and network systems, and on how many entities and countries are involved. Alignment is easier when one incident process, one control register and one evidence library serve both regimes. The NIS2 obligations include management body approval of risk-management measures under Article 20(1), which the GDPR does not require in the same form, so governance records need work. Effort drivers include the number of systems in scope, the state of the asset inventory, supplier contracts and the number of national regimes. The reader should ask for an effort estimate built from a scoped inventory, not from a generic template.
Can we map NIS2 and GDPR controls ourselves?
Yes, an in-house team can build a mapping, provided it has the legal and technical knowledge to read both texts and the time to keep the mapping current. Useful inputs include the EUR-Lex texts of NIS2 and the GDPR, and ENISA's non-binding technical guidance for Implementing Regulation (EU) 2024/2690, which includes mappings to ISO/IEC 27001:2022 and NIST CSF 2.0. ENISA states that its mapping is not a measure of equivalence, so a mapping supports planning but does not prove compliance. Teams that want outside help can ask DeployOpen for a fixed-scope review of their control set, with deliverables agreed in writing before work starts.
How DeployOpen helps you evaluate and implement
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, and prepares systems, controls and evidence for compliance assessments. For NIS2 vs GDPR fines, we start from a written scope that separates the NIS2 management body and supervision duties from the GDPR fine tiers, so decisions rest on your actual exposure.
How we scope
- Written scope agreed before work starts, covering which entities, systems and personal data flows fall under NIS2 and the GDPR.
- Confirmation of your NIS2 classification as essential or important and the national transposition law that applies to you.
- Documented mapping of which management body approvals and GDPR controller or processor roles each system and vendor touches.
How we build
- Incident response and reporting procedures designed to serve both NIS2 authority notices and GDPR supervisory authority notices from one process.
- Evidence collection for risk-management measures and governance decisions, such as management body approvals, so records exist before an inspection.
- Security testing of in-scope applications, APIs and infrastructure, with findings tracked against both regimes.
How we hand over
- Documentation of configurations, runbooks, control records and evidence locations, delivered to your team in a form they can maintain.
- Walkthrough sessions with security, legal and management stakeholders on how each fine tier could be triggered by one incident.
- Clear list of open items, owners and limits, including questions to confirm with your national authority or data protection lawyer.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, scoped in writing.
- Periodic review of evidence and documentation as national transposition rules and the proposed NIS2 amendments develop.
- Quote built from the written scope, with cost components and recurring items identified for your procurement team.
Sources and further reading
- Directive (EU) 2022/2555 (NIS2), EUR-Lex ↗
- NIS2 Article 20 Governance, EUR-Lex ↗
- Regulation (EU) 2016/679 (GDPR), EUR-Lex ↗
- NIS2 Directive: securing network and information systems, European Commission ↗
- Proposal for a Directive as regards simplification measures and alignment with the Cybersecurity Act, COM(2026) 13 ↗
- Regulation (EU) 2025/2518 on enforcement of Regulation (EU) 2016/679, EUR-Lex ↗
