If you live in the EU, three laws shape how quickly a company has to admit it has been hacked. A 2026 comparison of NIS2, DORA and GDPR looks at scope, 24-hour and 72-hour incident clocks, fines in a band from €10M to €20M, and which member states had acted by November 2026. This post translates that into plain language. The short version of NIS2 DORA GDPR breach reporting: the clocks are tight, the penalties are large, and the rules do not apply the same way in every country.
What NIS2, DORA and GDPR breach reporting clocks actually mean
The two numbers that stand out in the comparison are 24 hours and 72 hours. They are deadlines that start running once an organization becomes aware of a serious incident. They are not promises that you will be told within a day or three.
In practice, these clocks are mainly about the company reporting to a regulator or supervisory authority. That early report lets officials see whether an attack is hitting several organizations at once. A shorter first deadline (24 hours) generally means an early heads-up, while a longer one (72 hours) leaves time for a fuller picture of what happened. The source comparison does not spell out every detail of how each law assigns its clocks, so check the official text of each regulation or your national authority for the exact wording.
The three laws also cover different ground:
- GDPR is about personal data, and applies to organizations handling the data of people in the EU.
- NIS2 is about the security of network and information systems in sectors considered important to society.
- DORA is about digital operational resilience in the financial sector.
Because of this overlap, one incident can trigger more than one law at the same time. A cyberattack on a financial firm that exposes customer data could raise questions under all three.
When a company has to tell you about a breach: what this means for you
This is where expectations need adjusting. A 24-hour or 72-hour clock does not mean your inbox will light up the next day. The first report usually goes to authorities, and notification of affected individuals is a separate step with its own conditions. Those conditions depend on the law involved and on how serious the risk to you is.
What you can reasonably take from the framework:
- Regulators hear first. Expect the formal clock to apply to the report to the authority, not to a public announcement.
- Early notices can be incomplete. A short first report may leave out the cause, the scale, or whether your data was involved.
- Your rights come mainly from GDPR. It is the law centered on personal data, so it is the one to look at when you want to know what you are entitled to hear.
- Sector matters. If your bank, a payment provider, or an essential service is hit, NIS2 or DORA obligations may apply on top of GDPR.
None of this replaces your own caution. Even a well-run reporting system leaves a gap between an incident and your notification, so it helps to change passwords, enable multi-factor authentication, and watch your accounts for unusual activity as soon as you hear about a breach.
How NIS2, DORA and GDPR fines compare
The comparison frames penalties as a band running from €10M to €20M. That range signals how seriously lawmakers treat missed deadlines and weak security. Failing to report on time is itself a compliance failure, separate from the breach.
One caveat on precision. The source summary gives the overall band but not a line-by-line split showing which law sets which figure. We are not going to guess at the per-law amounts, because penalty structures can include different caps, percentages of turnover, and national implementation choices. For DORA in particular, details can depend on how each member state sets its penalties. If you need exact numbers for a particular law, read the regulation itself or your national authority's guidance.
What the band does tell you is that regulators have real leverage. For companies that have to meet several overlapping obligations, an incident handled badly can create more than one compliance problem at once.
How to check if your EU country has enacted NIS2 and DORA
The comparison also tracks which EU states had acted by November 2026, which is a reminder that EU rules do not always take effect everywhere at once. NIS2 is a directive, so each member state has to turn it into national law, and progress can differ from country to country. Practical ways to check where yours stands:
- Search your national government's cybersecurity authority. It usually publishes the status of national NIS2 legislation and lists who must register or report.
- Look at your financial regulator. For DORA, the national financial supervisor is the best source on how the rules apply to banks, insurers, and payment firms.
- Check your data protection authority. For GDPR, it explains how to file a complaint and what notification rights you have.
- Read the official EU texts. The regulations and directives themselves are the final word on deadlines and scope.
If your country has been slow, that does not remove GDPR. It has applied across the EU for years, and it remains your most direct tool when personal data is exposed.
Key takeaways
Understanding NIS2 DORA GDPR breach reporting comes down to a few points: the 24-hour and 72-hour clocks mostly govern reports to regulators, fines are substantial, and national adoption varies. Take a few minutes this week to look up your own country's NIS2 and DORA status, and review your GDPR rights to be informed and to complain to your data protection authority.
If you want to see how a non-EU regime handles similar questions, read our coverage of the UK Cyber Security Resilience Bill, which pulls critical infrastructure into a formal national framework and tackles incident-reporting duties of its own. Comparing it with the EU approach shows how different governments are converging on faster, more structured breach disclosure.
