NIS2 vs GDPR
NIS2 vs GDPR: one protects the resilience of services, the other protects personal data. Many companies must follow both.
NIS2 vs GDPR is a question of what each law protects. GDPR protects the personal data of individuals and applies to almost any organisation handling it. NIS2 protects the security and continuity of network and information systems and applies to organisations in listed sectors above a size threshold.
They overlap, but one does not replace the other. A company in a covered sector can face both rules at once, and one incident, such as a breach involving personal data, can trigger reports under each. This page is general information, not legal advice.
Side by side
| Capability | NIS2 | GDPR |
|---|---|---|
| Full name | Directive (EU) 2022/2555 on measures for a high common level of cybersecurity | Regulation (EU) 2016/679, the General Data Protection Regulation |
| What it protects | Security and continuity of network and information systems and services | Personal data and the rights of individuals |
| Legal form | Directive, each member state passes its own national law | Regulation, applies directly in all member states |
| Who is covered | Essential and important entities in listed sectors, generally medium and large | Any organisation that handles personal data of people in the EU, any size |
| Core duties | Risk management measures, supply chain security, management accountability | Lawful basis, data minimisation, security, data subject rights |
| Incident reporting | Early warning within 24 hours, notification within 72 hours, final report within one month | Notify the data protection authority within 72 hours of a personal data breach |
| Who is told | National cybersecurity authority or CSIRT | Data protection authority, and affected individuals when risk is high |
| Maximum fines | Up to EUR 10 million or 2% of turnover for essential entities, EUR 7 million or 1.4% for important entities | Up to EUR 20 million or 4% of worldwide turnover |
| Management liability | Explicit, management must approve and oversee measures | Organisation is accountable, no specific management clause |
What each one is good at
NIS2
- Raises the security baseline across whole sectors
- Puts security responsibility on management
- Covers supply chain risk
- Sets clear, fast incident reporting steps
- Scope and details differ between member states
- Applies only to certain sectors and sizes
- Needs security measures to be planned and documented
GDPR
- Gives individuals strong, clear rights
- Applies the same way across the EU
- Well established, with years of guidance
- Covers organisations of every size
- Focuses on personal data, not all systems
- Security rules are broad rather than specific
- Heavy documentation and consent duties
Focus on NIS2 when
- You operate in a sector the directive lists, such as energy, transport, health, digital infrastructure or manufacturing of key goods
- You are a medium or large business, or supply one
- Your service going down would affect customers or the public
- A client asks for supply chain security proof
- Your board needs to show it oversees cyber risk
Focus on GDPR when
- You collect or store customer, employee or user data
- You run a website, shop or app with accounts or tracking
- You use processors or cloud services for personal data
- People ask to see, correct or delete their data
- You are a small business outside the NIS2 sectors
Questions people ask
What is the main difference between NIS2 and GDPR?
Does NIS2 replace GDPR?
Do small businesses need to follow NIS2 vs GDPR?
When did NIS2 start to apply?
Not sure how this applies to you?
A senior engineer walks your site, your search presence and the way enquiries reach you, then writes down the three things worth fixing first. You keep the document either way.