NIS2 and GDPR breach notification: one incident, two reports
Last updated:
A ransomware attack on a server that holds customer data is two problems at once for the law. For NIS2 it may be a significant incident, to report to the CSIRT or the competent authority. For the GDPR it is a personal data breach, to report to the data protection authority. Two laws, two authorities, two clocks.
This page compares the two obligations, explains when one incident triggers both, and ends with a practical checklist.
Draft: not legal advice. It summarises Directive (EU) 2022/2555 (NIS2) and Regulation (EU) 2016/679 (GDPR) for information, as of November 2026. National laws and authorities add their own rules and forms: for your obligations, refer to the official texts, the competent authorities and your lawyer or data protection officer.
The two obligations side by side
| NIS2 (Article 23) | GDPR (Articles 33 and 34) | |
|---|---|---|
| What triggers it | A significant incident: severe operational disruption or financial loss for you, or considerable damage to others. Any data, any service. | A personal data breach: a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Article 4(12)). |
| Who must notify | The essential or important entity. | The controller. A processor tells the controller without undue delay (Article 33(2)). |
| Who receives it | The CSIRT or, where applicable, the competent authority. | The competent data protection authority; for cross-border processing, the lead authority (Articles 55 and 56). |
| Deadlines | Early warning within 24 hours of awareness, notification within 72 hours, final report one month after the notification. | Without undue delay and, where feasible, within 72 hours of awareness. Later than that, with the reasons for the delay. Information can be provided in phases (Article 33(4)). |
| When you can skip it | When the incident is not significant. | When the breach is unlikely to result in a risk to people's rights and freedoms. You still record it (Article 33(5)). |
| Who else to tell | Where appropriate, the recipients of your services affected by the incident (Article 23(1)). | The people concerned, without undue delay, when the risk to them is high (Article 34). |
The 72 hours of the two laws look the same but do not always start together: NIS2 counts from when you become aware of a significant incident, the GDPR from when you become aware of a personal data breach. You may find out about the second one later, when the analysis shows that the attacker reached a database.
When one incident triggers both
The two assessments are separate, and each can be yes or no. Some typical cases, for an organisation within NIS2:
| Case | NIS2 | GDPR |
|---|---|---|
| Ransomware encrypts the server with the customer database, and the data was copied out | Probably significant: severe disruption and damage to others. | Personal data breach (confidentiality and availability); notification likely. |
| Ransomware encrypts a server with personal data, restored from backup in a few hours, no sign of exfiltration | Depends on the disruption. | Still a breach (availability) to record; whether to notify depends on the risk, see the EDPB guidelines. |
| A DDoS takes the online shop down for a day, no access to data | May be significant, depending on the disruption. | Usually no notification: no data accessed or lost, though a loss of availability of personal data can be a breach. |
| An employee's mailbox is accessed with a stolen password | Depends on the impact on your services. | Personal data breach if the mailbox holds personal data, which it usually does. |
| SSH brute force blocked by the firewall | Not an incident in itself: at most a near miss. | No breach: nothing was accessed. |
The EDPB Guidelines 9/2022 explain, with examples, how to assess the risk of a breach, including ransomware and loss of availability.
The directive connects the two systems: when a NIS2 authority finds that an infringement may entail a personal data breach, it informs the data protection authority; and if the data protection authority fines that conduct under the GDPR, the NIS2 authority does not fine it again (Article 35). This does not replace your notification to either one. Recital 106 encourages member states to offer a single entry point for both notifications; in November 2025 the Commission proposed an EU single entry point and, for the GDPR, notification only for high-risk breaches within 96 hours (Digital Omnibus proposal, COM(2025) 837). As of November 2026 it is still a proposal: the rules on this page apply.
Where the two notifications go
| Country | NIS2 | GDPR |
|---|---|---|
| Italy | CSIRT Italia | The Garante per la protezione dei dati personali, with its online procedure. |
| Germany | The BSI and BBK joint reporting office, through the BSI portal. | The data protection authority of the federal state (Land), or the federal commissioner for the bodies it supervises. |
| France | ANSSI, once the transposition law is passed. | The CNIL. |
| Spain | Under the 2018 rules: INCIBE-CERT or CCN-CERT. | The AEPD, or a regional authority for the bodies it supervises. |
| Portugal | The CNCS platform; the law provides for notifying the CNPD and other authorities through the same platform, under a protocol between them (Decree-Law 125/2025, Article 40 of the regime). | The CNPD. |
The EDPB keeps the list of every national data protection authority. The NIS2 page on the early warning has the status of the transposition in each of these countries.
Outside the EU: the GDPR also applies to companies outside the Union that offer goods or services to people in the EU (Article 3(2)), and some local laws have their own deadlines. In Brazil, for example, the LGPD and the ANPD's regulation require notifying the ANPD within three business days when an incident may bring relevant risk or damage to the data subjects.
Checklist: one incident, two reports
- Contain and preserve: isolate what is compromised, keep logs and copies before cleaning, and start an incident log with times in UTC.
- Write down the moment of awareness, separately for the significant incident and for the personal data breach: they set the two clocks.
- Make two decisions, in writing: is it a significant incident (NIS2)? Is it a personal data breach, and with what risk for people (GDPR)? Note who decided and why.
- One set of facts, two reports: the same timeline feeds both, so the two authorities don't receive versions that contradict each other.
- Within 24 hours: the NIS2 early warning, if the incident is significant.
- Within 72 hours: the NIS2 incident notification and, if there is a risk for people, the GDPR notification, with the data protection officer involved. If you are late on the GDPR side, say why.
- Tell the people concerned when the risk is high (GDPR Article 34), and the recipients of your services where appropriate (NIS2).
- If you are a processor (for example, an agency hosting a client's site), tell the controller without undue delay: the notification is theirs to make.
- Within one month of the NIS2 notification: the final report, with root cause and measures.
- Record the breach in your register even when you did not notify it (GDPR Article 33(5)), and review what to change.
Where InfraFence helps, and where it doesn't
Under Compliance (Pro and AutoMode), InfraFence drafts, from the timeline of your servers, both the NIS2 reports (early warning, incident notification, final report) and a GDPR Art. 33 breach assessment. The GDPR draft weighs whether personal data was or may have been affected, with the evidence for and against, assesses the risk and whether notifying the authority and the people concerned seems required, and prepares the content of Article 33(3) and the record of Article 33(5).
The facts come from the same timeline for every draft: attacks, bans, SSH logins, modified files, malware findings and the actions taken. What the agent cannot know, such as which personal data your applications hold, how many people are concerned and who your data protection officer is, is left as a placeholder to complete. Drafts are versioned and can be downloaded as Markdown or printed to PDF. To write them, the timeline and your notes are sent to an external text-generation provider, and the page says so. See Monthly and NIS2 reports.
It does not decide whether there is a breach or a significant incident, and it sends nothing to any authority. The drafts are not legal advice.
Sources
- Regulation (EU) 2016/679 (GDPR), on EUR-Lex: Articles 3, 4(12), 33, 34, 55 and 56.
- Directive (EU) 2022/2555 (NIS2), on EUR-Lex: Articles 23 and 35, recital 106.
- EDPB Guidelines 9/2022 on personal data breach notification.
- EDPB members: the national data protection authorities.
- Digital Omnibus proposal, COM(2025) 837, on EUR-Lex.
Questions
- If I notify the CSIRT, do I still have to notify the data protection authority?
- Yes, if the incident is also a personal data breach with a risk for people. They are separate obligations. The NIS2 authority may inform the data protection authority, but that does not replace your notification.
- Are the 72 hours the same in both laws?
- The length is the same, but each clock starts when you become aware of what that law covers: the significant incident for NIS2, the personal data breach for the GDPR. The GDPR allows a later notification with the reasons for the delay; NIS2 has the early warning at 24 hours first.
- Does the GDPR apply if my company is not subject to NIS2?
- Yes. The GDPR applies to organisations established in the EU that process personal data, and to those outside the EU that offer goods or services to people in the EU, whatever their size or sector.
- I host my clients' websites. Who notifies?
- For the GDPR, the controller, usually your client; as a processor you tell them without undue delay. For NIS2, it depends on whether you or your client are NIS2 entities.
- Will the deadlines change?
- The Commission's Digital Omnibus proposal of November 2025 would move the GDPR notification to 96 hours, only for high-risk breaches, through a single EU entry point. As of November 2026 it is a proposal, not law.
Try it free on 1 server
Starter gives one server full protection, free and with no credit card.
- 01
Create a free account, then open Servers › Add server to get your install token. It is valid for one hour.
Create the token - 02
Then run this as root on the server:
curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --token <TOKEN>