GDPR and NIS2: where they overlap and where they differ

GDPR and NIS2 are often mentioned in one breath, and it is easy to confuse them. Both are about “something with security and rules”. But they protect different things, and you may well face both at once. This article makes the distinction clear.

What the GDPR protects: personal data

The GDPR (General Data Protection Regulation) is about protecting personal data, data about identifiable people. It is about privacy: may you collect data, do you handle it carefully, and do you respect the rights of the individuals? The GDPR applies to virtually every organisation that processes personal data.

What NIS2 protects: the continuity of services

NIS2 is not primarily about privacy, but about digital resilience and continuity. The aim is that important services keep running and that organisations can withstand cyber incidents. NIS2 applies to specific sectors and organisations above a certain size, see our overview of NIS2.

The overlap

The two meet at the point of security. Both expect you to take appropriate technical and organisational measures, think of MFA, access management, and backups. If you work on one, you often automatically work on the other. Good basic hygiene serves both aims.

The most important difference in practice: reporting

Here you must be sharp. Both have a reporting duty, but to different authorities and with different criteria:

• GDPR: a data breach with a risk to people you report within 72 hours to the data protection authority. See our data breach action plan.
• NIS2: a significant incident you report (in phases, from 24 hours) to the NIS2 supervisory authority. See the NIS2 reporting duty.

So with a single incident involving personal data and impact on your services, you may face both reporting duties. They do not replace each other.

What does this mean for you?

Do not see them as two separate projects, but as two lenses on the same foundation. Set up your information security well, and in one move you meet a large part of both. The difference is mainly in the reporting routes and the focus, privacy versus continuity.

Help with the overview?

We help you map which obligations your business faces, and how to cover them efficiently in one approach. See our NIS2 approach or book a conversation.