The GDPR and cybersecurity law overlap wherever information systems process personal data. The GDPR protects the people the data is about; NIS2 and national laws that transpose it protect the continuity of services. A single event, such as a ransomware attack that encrypts a customer database, can trigger obligations under both at the same time.
Quick Overview
What you will learn:
- Which GDPR provisions are, in substance, IT security requirements
- How a personal data breach notification differs from a significant incident report
- What Poland’s amended cybersecurity act adds to the picture
- How to divide work between the data protection officer and the CISO
Who this article is for:
- Data protection officers and compliance teams
- CISOs, administrators and incident response teams
- Boards of entities covered by NIS2
Reading time: 7 minutes
The GDPR as a security law
Regulation (EU) 2016/679, the GDPR, published on eur-lex.europa.eu, uses the vocabulary of information security in several places:
- Article 5(1)(f) — integrity and confidentiality: protection against unauthorised processing, accidental loss, destruction or damage;
- Article 5(2) — accountability: the controller must be able to demonstrate compliance;
- Article 25 — data protection by design and by default;
- Article 32 — security of processing, including pseudonymisation and encryption, the ongoing confidentiality, integrity, availability and resilience of systems, timely restoration of access after an incident and regular testing of the measures.
The European Data Protection Board’s Guidelines 01/2021 on www.edpb.europa.eu make the link explicit by classifying breaches along the classic security triad: confidentiality, integrity and availability breaches. Their first worked case, ransomware with a proper backup and no data exfiltration, shows how much depends on security engineering: being able to restore systems to a clean state quickly is what keeps the impact on individuals low.
NIS2: risk measures and reporting
Directive (EU) 2022/2555 (NIS2) on eur-lex.europa.eu sets a minimum list of measures in Article 21(2), including incident handling, business continuity and backup management, supply chain security, cryptography and encryption, access control, cyber hygiene and training, and multi-factor authentication. Under Article 20, management bodies approve these measures and oversee their implementation, and their members are required to follow training.
The overlap is sharpest in reporting. Comparing the two regimes on eur-lex.europa.eu:
GDPR (eur-lex.europa.eu) | NIS2 (eur-lex.europa.eu) | |
|---|---|---|
| What is reported | personal data breach (Article 33) | significant incident (Article 23) |
| To whom | data protection supervisory authority | CSIRT or competent authority |
| Deadlines | without undue delay and, where feasible, within 72 hours | early warning within 24 hours, notification within 72 hours, final report within a month |
| Individuals | communication when the risk is high (Article 34) | informing service recipients where appropriate |
Article 35 of NIS2 connects the two: when a cybersecurity authority finds that a breach of Article 21 or 23 may entail a notifiable personal data breach, it informs the GDPR supervisory authority. If that authority imposes an administrative fine, the NIS2 authority does not fine the same conduct.
The Polish angle: an amended cybersecurity act
Poland transposed NIS2 through the Act of 23 January 2026 amending the National Cybersecurity System Act (Journal of Laws 2026, item 252). According to the act’s metadata on api.sejm.gov.pl, it was published on 2 March 2026 and entered into force on 3 April 2026. Three provisions matter for data protection teams:
- essential and important entities send an early warning about a serious incident to the competent sector CSIRT within 24 hours of detection and a full notification within 72 hours;
- the national ICT system under Article 46 of the act is also meant to carry GDPR Article 33 breach notifications from these entities, and the President of the Polish data protection authority (UODO) uses it too;
- the head of an essential or important entity takes decisions on the information security management system (Article 8d) and completes training once every calendar year (Article 8e).
DPO and CISO: who does what
The data protection officer (GDPR Article 39 on eur-lex.europa.eu) informs and advises, monitors compliance including staff training, advises on data protection impact assessments and cooperates with the supervisory authority. The CISO owns the security measures, monitoring and incident handling. Both look at the same incident from different angles, so a joint procedure should provide a shared intake point, a parallel assessment (is this a personal data breach, and is it a significant incident?) and a shared register of incidents and breaches with separate deadlines.
Read Also
- What is the NIS2 directive? — scope and core requirements
- ISO 27001: implementing an ISMS — a common foundation for GDPR and NIS2 work
- Ransomware: preparing your company — the incident that most often triggers both regimes
Build Your Skills
Two trainings cover this: Cyber Security and RODO — Technical and Process Requirements and NIS2 — Directive and the KSC Act: Compliance for Management and IT. The first maps GDPR duties onto system safeguards, the second walks through NIS2 and Polish KSC obligations. Get in touch to tailor the scope to your team.
Frequently Asked Questions (FAQ)
Who is a data protection officer and what is their role in cybersecurity?
A DPO is designated by a controller or processor to advise on data protection, monitor compliance and cooperate with the supervisory authority. In a security incident, the DPO assesses whether it is a personal data breach and whether it must be notified or communicated to individuals. The DPO does not replace the CISO, who is responsible for the safeguards themselves.
How should incidents be reported under NIS2 and the GDPR?
Under the acts on eur-lex.europa.eu, these are two separate reports. A personal data breach goes to the supervisory authority without undue delay and, where feasible, within 72 hours. A significant incident at an entity covered by NIS2 needs an early warning within 24 hours and a notification within 72 hours. One event may require both.
Who does NIS2 apply to?
The directive covers essential and important entities in the sectors listed in its annexes, generally starting from the medium-sized enterprise threshold. In Poland, classification follows the amended cybersecurity act and its annexes; an entity assesses for itself whether it qualifies and applies for entry in the national register.
What is the GDPR and how does it relate to IT security?
The GDPR is the EU regulation on personal data protection, directly applicable in every member state. Its links to IT security are the integrity and confidentiality principle, data protection by design, the duty to apply security measures proportionate to risk and the obligation to notify breaches.