2026-11-04 - NIS2, GDPR and DORA: first the applicable regime, then the coordination
Third article in the
series NIS2 in Italy, beyond the deadlines
, introduced in the
first article on the method for reading the sources
. Sources updated as of 24 October 2026.
Two ransomware attacks with exfiltration of personal data, on the same day. The first hits a large private nursing home, the second a bank. Both exceed the thresholds of a medium-sized enterprise and operate in sectors of Annex I of the NIS Decree, the nursing home as a healthcare provider and the bank as a credit institution, which is also subject to the DORA Regulation. For the nursing home, the exfiltration falls within the baseline incident types of the NIS Decree; for both, the risk to data subjects is not unlikely. The technical consequences are similar; the legal ones are not. The nursing home notifies CSIRT Italia under the NIS Decree and the Italian Data Protection Authority (Garante) under the GDPR. The bank does not notify CSIRT Italia under the NIS Decree: it reports the incident to the competent authority under the DORA Regulation, and notifies the Garante.
This article starts from a rule of sequence: first establish which regime applies, then coordinate authorities, deadlines and evidence. Coordination is a real problem, but it presupposes that the question of applicability has been resolved correctly. And it is precisely on this point that the Directive and the Decree provide precise rules.
The European rule on sector-specific acts
Article 4 of
provides that, where a sector-specific Union act imposes risk-management measures or notification obligations with effects at least equivalent to those of the Directive, the corresponding NIS provisions do not apply to the entities concerned, including those on supervision and enforcement. Equivalence concerns the measures of Article 21 and, for notification, also requires that the CSIRTs or the NIS authorities have immediate access to the notifications. The Commission clarified its application with the
guidelines of 14 September 2023
.
The GDPR is not a sector-specific act in this sense: it applies alongside NIS2. DORA is one by express provision.
DORA: a declared lex specialis
Article 1(2) of
provides that, for financial entities qualified as essential or important entities, DORA is considered a sector-specific act for the purposes of Article 4 of the Directive. Financial entities report major ICT-related incidents to the competent authority provided for by DORA (Article 19).
Legislative Decree No. 138 of 4 September 2024 (NIS Decree)
draws the consequences in Article 3:
- entities in the banking and financial market infrastructure sectors (Annex I, numbers 3 and 4) are not subject to Article 17 and Chapters IV and V, that is, the NIS obligations on security, notification, supervision and penalties (paragraph 14);
- the Decree does not apply to entities exempted from the scope of DORA (paragraph 15).
The registration obligations and some information requirements remain, with specific exemptions introduced by
(which replaced Determination 127437/2026 from 25 October 2026): financial entities subject to DORA are not required to designate the CSIRT contact person (Article 7(6)), to list the members of the management bodies (Article 16(13)) or to categorise activities and services (Article 20(6)), save for voluntary participation. The
records this in a footnote.
In the case of the bank, therefore, the correct question is not how to coordinate two security notifications, but which of the two applies: and the answer is DORA.
GDPR: full coexistence and cooperation between authorities
With
the relationship is different. The NIS Decree leaves the rules on the protection of personal data unaffected (Article 3(11)). The two notifications have distinct triggers and recipients.
- The NIS notification to CSIRT Italia is triggered by evidence of an incident falling within the baseline types; the loss of confidentiality towards the outside (IS-1) concerns digital data in general, not only personal data.
- The GDPR notification to the Garante concerns the personal data breach, within 72 hours, unless a risk to rights and freedoms is unlikely (Article 33), with communication to data subjects if the risk is high (Article 34).
The same event can therefore trigger both, with deadlines that overlap only in part: 24 hours for the NIS pre-notification, 72 hours for the NIS notification and for the GDPR notification.
An artificial intelligence system that processes personal data makes the sequence visible. The NIS rules concern the security of the entity’s systems, including the AI system where relevant; the GDPR concerns the processing and its breaches; the AI Act,
, concerns the requirements of the system according to its risk level, with Article 15 imposing cybersecurity on high-risk systems only. They are three distinct questions, with three answers that do not absorb one another: compliance with one set of rules does not demonstrate compliance with the others.
The Directive provides rules for coordination between authorities. The NIS authorities cooperate with the supervisory authorities for incidents involving personal data breaches (Article 31(3)). If, in the course of supervision, it emerges that the infringement of the obligations of Articles 21 or 23 may entail a personal data breach to be notified, the NIS authority informs the supervisory authority; if the latter imposes an administrative fine under the GDPR, the NIS authority does not penalise the same conduct (Article 35).
Article 14 of the Decree transposes these rules in paragraph 2, with a textual difference.
Open question. Article 14(2), points (b) and (c), of the Decree refers the information to the Garante and the ban on double penalties to the infringement of the obligations of Article 24, that is, the risk-management measures. Article 35 of the Directive refers instead to the obligations of Articles 21 and 23, hence also to incident notification. In my view, the Italian wording should be read in a manner consistent with the Directive, including infringements of Article 25 of the Decree. The consistent reading does not, however, resolve every case. A single incident may give rise to infringements of distinct obligations, the notification to CSIRT Italia under Article 25 of the Decree and the notification to the Garante under Article 33 of the GDPR, addressed to different authorities. The Directive excludes only the NIS administrative fine, and only where the Garante has already imposed one for the same conduct; enforcement measures remain possible (Article 35(2)). Establishing when the conduct is the same is an assessment to be made on the specific case, and it remains to be seen which reading the Agency and the Garante will adopt.
The national links
National cybersecurity perimeter
Article 33 of the Decree coordinates the NIS regime with that of the perimeter (Decree-Law 105/2019). The risk-management and notification obligations of the perimeter are considered at least equivalent to the NIS ones; the NIS Decree does not apply to ICT assets included in the perimeter lists, while it remains applicable to the entity’s other systems; for incidents already notified under the perimeter, the NIS notification is not duplicated.
assigns to the activities and services subject to the perimeter the relevance category “high impact” and removes them from the ordinary listing and categorisation (Article 5).
Law 90/2024 and public administrations
requires several administrations, many of which are also NIS entities, to report within 24 hours and notify within 72 hours to the Agency the incidents of the taxonomy identified by the Agency (Article 1(1)), and to identify a structure and a contact person for cybersecurity (Article 8).
An explicit link exists for the contact person: the designation of the NIS point of contact may satisfy the obligation to appoint and communicate the contact person provided for by Law 90/2024 (Determination 314287/2026, Article 4(8)).
For notifications, too, a link exists, of administrative origin.
of 9 February 2026, published in the
Official Gazette No. 39 of 17 February 2026
and applicable from publication (Article 2), identifies the taxonomy of Law 90/2024 in three cases, IS-1, IS-2 and IS-3, consistent with the baseline significant incidents provided for important entities by Annex 3 of
. In the preamble, the Agency considers, in order to simplify burdens, that the obligation under Law 90/2024 may be deemed fulfilled where the pre-notification and notification have been made under Article 25 of the NIS Decree. The operative part, in turn, provides that the taxonomy is also relevant for the purposes of the NIS obligation (Article 1(2)). For essential entities, the NIS taxonomy also includes the IS-4 case of Annex 4, which Annex A of the determination does not cover.
A legislative issue remains. Article 1(7) of Law 90/2024 excludes from the obligation the entities identified by reference to the categories of Legislative Decree 65/2018, that is, the previous NIS regime, and the perimeter entities. Legislative Decree 65/2018 was repealed by the NIS Decree, with its Chapters IV and V continuing to apply only to operators of essential services already identified, until the implementing measures are adopted (Article 41(2)). In my view, the reference should be updated: the coordination of notifications is today based on an assessment expressed in the preamble of an act of the Agency, while the statutory provision that delimits the scope of the obligation still refers to a repealed regime.
The other regimes: an annotated table
.tbl-wrap{overflow-x:auto;margin:1.5rem 0}table.compare{width:100%;border-collapse:collapse;font-size:.92rem}table.compare th{background:#26215c;color:#fff;padding:.6rem .7rem;text-align:left;vertical-align:top}table.compare td{padding:.55rem .7rem;border-bottom:1px solid #ddd;vertical-align:top}table.compare tr:nth-child(even) td{background:#f4f4f8}table.compare td:first-child{font-weight:600}.tbl-note{font-size:.85rem;font-style:italic;margin-top:.4rem}@media(prefers-color-scheme:dark){table.compare td{border-bottom:1px solid #444}table.compare tr:nth-child(even) td{background:#1e1e2a}}
RegimeSubject matter and addresseesRelationship with NISSource
GDPRProcessing of personal data; controllers and processorsApplies alongside NIS; cooperation between authorities and ban on double penalties for the same conductLegislative Decree 138/2024, Articles 3(11) and 14; Directive, Article 35
DORADigital operational resilience of financial entitiesSector-specific act: excludes the NIS obligations on security, notification, supervision and penalties for banks and financial market infrastructuresRegulation 2022/2554, Article 1(2); Legislative Decree 138/2024, Article 3(14) and (15)
CERPhysical resilience of critical entitiesCritical entities are essential NIS entities, regardless of sizeDirective 2022/2557; Legislative Decree 134/2024; Legislative Decree 138/2024, Articles 3(5) and 6(1)
Cyber Resilience ActSecurity of products with digital elements; manufacturersAutonomous obligation to report actively exploited vulnerabilities and severe incidents from 11 September 2026; compliant products facilitate supply chain securityRegulation 2024/2847, Articles 14 and 71
AI ActAI systems; cybersecurity requirements for high-risk systemsProduct requirements that are added to the NIS measures of the entity that uses or provides the systemRegulation 2024/1689, Article 15
National cybersecurity perimeterStrategic ICT assets of identified entitiesObligations considered at least equivalent; exclusion of the NIS Decree for assets included in the listsDecree-Law 105/2019; Legislative Decree 138/2024, Article 33
Law 90/2024Incident notification and cybersecurity contact person for certain administrationsLink on the contact person and, by administrative means, on notifications; legislative reference to Legislative Decree 65/2018 to be updatedLaw 90/2024, Articles 1 and 8; ACN Determination 314287/2026, Article 4(8); ACN Determination 28900/2026
Orientation table. For the application deadlines of the AI Act and the Cyber Resilience Act, see the
annotated calendar of digital deadlines
.
Final remarks
In my view, the relationship between NIS and other regimes is resolved with two questions in sequence. The first is one of applicability: is there a sector-specific act that excludes the NIS provisions, such as DORA, or a national link that makes them inapplicable to certain assets, such as the perimeter? The second, only afterwards, is one of coordination: when several regimes apply to the same event, such as NIS and the GDPR, which authorities must be informed, within what time limits and with what content?
The Italian transposition answers the first question well for DORA and for the perimeter. On the second, two points remain that require attention: the wording of Article 14 on the ban on double penalties and the reference in Law 90/2024 to the repealed regime, against a coordination of notifications that today relies on a determination of the Agency.
Practical guidance. A mistake to avoid is coordinating notifications that are not due, or neglecting the one that is; the point to watch is establishing for each regime, before the incident, whether it applies and to which authority it refers.
Reference documents
European Union
- Directive (EU) 2022/2555 (NIS2), Articles 4, 31 and 35:
http://data.europa.eu/eli/dir/2022/2555/oj
- Regulation (EU) 2016/679 (GDPR), Articles 33 and 34:
http://data.europa.eu/eli/reg/2016/679/oj
- Regulation (EU) 2022/2554 (DORA), Articles 1 and 19:
http://data.europa.eu/eli/reg/2022/2554/oj
- Directive (EU) 2022/2557 (CER):
http://data.europa.eu/eli/dir/2022/2557/oj
- Regulation (EU) 2024/2847 (Cyber Resilience Act):
http://data.europa.eu/eli/reg/2024/2847/oj
- Regulation (EU) 2024/1689 (AI Act):
http://data.europa.eu/eli/reg/2024/1689/oj
- European Commission, guidelines on Article 4 of the NIS2 Directive:
Italy
- Legislative Decree No. 138 of 4 September 2024, Article 3:
- Legislative Decree No. 138 of 4 September 2024, Article 14:
- Legislative Decree No. 138 of 4 September 2024, Article 33:
- Legislative Decree No. 134 of 4 September 2024 (transposition of the CER Directive):
- Decree-Law No. 105 of 21 September 2019:
- Law No. 90 of 28 June 2024:
- ACN Determination 28900/2026, incident taxonomy under Law 90/2024:
; published in the Official Gazette No. 39 of 17 February 2026:
- ACN Determination 379907/2025:
- ACN Determination 314287/2026:
- ACN Determination 155238/2026:
- ACN, NIS Vademecum:
This article is for general information purposes and does not constitute legal advice. The framework is updated as of 24 October 2026; the regime applicable to an incident depends on the qualification of the entity and on the nature of the data and systems involved.
New to Gemini? This capsule is best read with a Gemini client, such as Lagrange.