DORA, NIS2 and GDPR incident reporting deadlines compared

One incident at a European financial entity can trigger three sets of reporting deadlines. Under DORA, a major ICT-related incident needs an initial notification within four hours of classification. That notification must also be sent no later than 24 hours from awareness. An intermediate report is due within 72 hours of the initial notification, and a final report within one month. Under NIS2, an essential or important entity sends an early warning within 24 hours. It then sends a notification within 72 hours and a final report within one month. Under GDPR, a personal data breach must be notified to the supervisory authority within 72 hours of awareness. For financial entities' ICT incidents, DORA is lex specialis to NIS2. The GDPR deadline still applies in every case.

The order of the deadlines is important. The DORA deadline starts first, at classification. The NIS2 early warning is due next. The GDPR notification comes last but needs the most detail about affected individuals. Teams that complete three separate forms after the event are likely to miss at least one deadline. Some teams record classification time, awareness time, scope, affected data and actions as fields on the incident record. Those teams can produce each report from that single record.

Prepare the following before an incident happens. Set up the classification criteria for each regulation as steps in a workflow. Set up countdown timers that start at classification. Add the notification templates as fields on the incident record. File each submission against the incident as evidence. If the regulator asks why notification took as long as it did, the recorded timestamps provide the answer.

Reviewed September 2026.