Home › Compare laws side by side › NIS2 vs EU GDPR

NIS2 vs EU GDPR

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive) (European Union) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.

Topic	NIS2 European Union ✓ Confirmed by two sources	EU GDPR European Union (EEA) ✓ Confirmed by two sources
Status	In force since 16 Jan 2023; transposition deadline 17 Oct 2024 (NIS1 repealed 18 Oct 2024). Applies via national laws.✓	In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓
Who it applies to	Medium and large public/private entities in Annex I (high-criticality) and Annex II (other critical) sectors providing services in the EU; some (e.g. DNS, TLD registries, trust services, telecoms) regardless of size. Non-EU digital providers must appoint an EU representative.✓	Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓
Size thresholds	Size-cap rule: medium or large enterprises under Recommendation 2003/361/EC — 50+ staff, or annual turnover and balance-sheet total both above EUR 10m (partner and linked enterprises aggregated). Large entities in Annex I are usually 'essential'; others 'important'. Some sectors (e.g. DNS, trust services, public administration) are covered regardless of size.✓	None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓
Regulator	National competent authorities and CSIRTs in each Member State; ENISA and the NIS Cooperation Group at EU level✓	National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓
Breach or incident reporting	Significant incidents to CSIRT/authority: early warning within 24h, incident notification within 72h, final report within 1 month of the notification. Inform service recipients where relevant.✓	Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓
Deadline to answer personal data requests	N/A✓	1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓
Data protection officer	No named officer, but management bodies must approve and oversee cybersecurity measures, take training, and can be held personally liable.✓	DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓
Local representative	Certain non-EU digital providers (e.g. cloud, DNS, online marketplaces, search, social platforms) offering services in the EU must designate an EU representative by written mandate.✓	Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓
Sending data abroad	N/A✓	Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓
Cookies and consent	N/A✓	Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓
Maximum penalty	Essential entities: maximum of at least EUR 10m or 2% of worldwide turnover; important entities: at least EUR 7m or 1.4% (whichever higher). National caps may be higher.✓	Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓

= confirmed by two independent sources, at least one official.

Facts marked “Being verified” are still being confirmed and are not given as answers.

Who each law applies to

NIS2: Medium and large public/private entities in Annex I (high-criticality) and Annex II (other critical) sectors providing services in the EU; some (e.g. DNS, TLD registries, trust services, telecoms) regardless of size. Non-EU digital providers must appoint an EU representative.
EU GDPR: Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.

What you must do under NIS2

Check whether your sector (Annex I/II) and size bring you into scope; register with the national authority.
Have management approve cybersecurity risk measures and complete training.
Implement Art 21 measures: risk analysis, incident handling, backups, MFA, encryption, supply-chain security.
Set up a process to send 24h early warnings and 72h notifications of significant incidents.
Assess security of suppliers and service providers.
Follow the national transposition law in each country where you operate.

Full NIS2 page, sources and checklist

What you must do under EU GDPR

Identify a lawful basis for every processing purpose and record it.
Publish a clear privacy notice covering purposes, recipients, retention and rights.
Keep a record of processing activities and sign Art 28 contracts with processors.
Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
Answer access, erasure and other rights requests within one month.

Full EU GDPR page, sources and checklist

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.