When one incident triggers NIS2, DORA and GDPR at once, which clock runs first?

Start

One incident may be reportable under several regimes

A ransomware attack on systems holding customer records can be a significant incident, a major ICT-related incident for a financial entity and a personal data breach at the same time. Each regime has its own test, its own recipient and its own clock. None waits for another. The pack answers them separately, in one screen.

• Then: Fix one time of awareness for every clock

Step

Fix one time of awareness for every clock

The NIS2 and GDPR clocks, and DORA's 24-hour limit, all run from awareness. In the pack that is the time the incident is declared, as recorded in the case log, unless the record shows reasonable certainty earlier. It does not wait for the reportability decision. Clocks run on calendar hours, through nights, weekends and public holidays. Where a regime becomes reportable later because a new fact meets its test, its clocks start when the record shows that fact was known.

• Then: Finish the reporting screen within 4 hours

Step

Finish the reporting screen within 4 hours

The screen is your own deadline, set so the legal clocks can still be met. It asks the NIS2, GDPR and DORA questions, then the contract and insurance ones, and records each answer with its reasons. The 4 hours is the pack's default; the pack warns never to set a time that leaves too little of a legal clock. Where awareness came before declaration, the legal clocks started before the screen's, so check them first.

• Then: Open one fact base that every report is drafted from

Step

Open one fact base that every report is drafted from

Authorities share what they receive, and reports that give different start times, customer numbers or causes invite questions at the worst moment. Keep one record of the incident's facts, owned by the incident manager, and draft every report from it. Date each change rather than overwriting it, and mark unknowns and estimates. Where figures differ because the regimes count differently, say what each figure counts: DORA counts clients and transactions, GDPR people and records.

• Then: Are we a financial entity under DORA?

Decision

Are we a financial entity under DORA?

DORA applies to financial entities only. For a financial entity that is also an essential or important entity, the pack reads DORA's reports as taking the place of NIS2's, and DORA's initial notification can fall due earliest of the legal clocks. If your status is not settled, take this branch and settle it with counsel at once. If the answer turns out to be no, answer the NIS2 question: its early warning has the same 24 hours from awareness.

• Yes, or not known: Is it, or may it be, a major ICT-related incident?
• No: Are we in NIS2 scope, and is the incident significant?

Decision

Is it, or may it be, a major ICT-related incident?

Major needs critical services affected, and either a successful, malicious and unauthorised access that may result in data losses, or two or more of the other thresholds, such as duration and downtime, clients and transactions, or economic impact. Classify promptly and record the time you do. If you have not yet classified it, take the yes branch: the 24-hour limit from awareness runs whether or not you have classified.

• Yes, or not known: DORA runs first: 4 hours from classifying as major
• No: Is personal data affected, with a risk to individuals?

Step

DORA runs first: 4 hours from classifying as major

The initial notification goes to the financial competent authority within 4 hours of classifying the incident as major, and no later than 24 hours after awareness, whichever comes first. If the incident is classified as major more than 24 hours after awareness, it is due within 4 hours of that classification. The intermediate report follows within 72 hours of the initial notification. Classify as soon as the facts allow.

• Then: Check whether DORA's weekend rule is open to you

Step

Check whether DORA's weekend rule is open to you

DORA alone lets a report whose deadline falls on a weekend or a bank holiday in your Member State go by noon of the next working day. It never applies to the initial notification or intermediate report of credit institutions, central counterparties, trading venue operators, or financial entities that are also essential or important entities under NIS2, and the authority may withdraw it from other significant or systemic entities. The final report may always use it. Settle this before an incident, and meet a weekend deadline before the weekend where the facts allow.

• Then: Is personal data affected, with a risk to individuals?

Decision

Are we in NIS2 scope, and is the incident significant?

In scope means an essential or important entity. Significant means the incident has caused, or could cause, severe operational disruption or financial loss to you, or considerable damage to others. If either answer is unclear, take the yes branch and watch the 24-hour clock.

• Yes, or not known: NIS2 runs first: early warning within 24 hours
• No: Is personal data affected, with a risk to individuals?

Step

NIS2 runs first: early warning within 24 hours

The early warning goes to the CSIRT or competent authority within 24 hours of awareness. The incident notification follows within 72 hours of awareness; a trust service provider sends it within 24 hours for an incident affecting its trust services. Neither needs the full picture: send what is known and follow up.

• Then: Is personal data affected, with a risk to individuals?

Decision

Is personal data affected, with a risk to individuals?

A breach unlikely to result in a risk to individuals is recorded, not notified. A risk or a high risk is notified. The Data Protection Officer's assessment can take longer than the screen, but never past the notification deadline. If the risk is not yet known, plan to notify and take the yes branch.

• Yes, or not known: GDPR: the supervisory authority within 72 hours
• No: Run the 'without undue delay' notices alongside

Step

GDPR: the supervisory authority within 72 hours

Notify the lead supervisory authority without undue delay and, where feasible, within 72 hours of awareness; later only with reasons for the delay. 'Without undue delay' comes first; the 72 hours is the outer limit. Where personal data comes into question only later, the clock starts when the record shows that fact was known. Where facts are missing, notify with what is known and add the rest in phases. The decision not to notify is also made, and recorded, inside the 72 hours.

• Then: Run the 'without undue delay' notices alongside

Step

Run the 'without undue delay' notices alongside

Some duties have no hour count. Where a breach is a high risk, the people concerned are told without undue delay. NIS2 notice to recipients of your services, where appropriate, and DORA notice to clients whose financial interests are affected are also without undue delay. Contract notices follow each contract, and the insurer and a crime report follow the policy and the police; the pack's placeholder notes insurers often ask within 48 hours.

• Then: Then the later reports, each from its own start

Step

Then the later reports, each from its own start

The later clocks start from reports, not from awareness. The NIS2 final report is due within one month of the incident notification; if the incident is still being handled then, a progress report goes instead and the final report follows within one month of handling ending. The DORA intermediate report is due within 72 hours of the initial notification and again when regular activities are recovered, and the final report no later than one month after the latest intermediate report, so each update moves it. Hold the post-incident review in time to feed the final report.

• Then: Track every deadline in one table, earliest first

Outcome

Track every deadline in one table, earliest first

Put the time of awareness and each regime's answer in one place and let every deadline calculate from it, as the pack's clock calculator does. Add the time of classification and each report's time as you make them, because later deadlines count from them, and put each next due time in the calendars of whoever drafts and submits it. Each report goes to its own recipient, approved by the executive incident lead, and none is held back to avoid a deadline.