NIS2 vs GDPR: What Is the Difference and How They Overlap

The difference in one sentence: GDPR protects personal data and applies to almost every organization; NIS2 protects the network and information systems of medium-sized and large organizations in 18 critical sectors. Both require security measures and incident reporting, so one cyber incident can trigger both.

NIS2 and GDPR are both EU laws that deal with security, but they protect different things in different ways. One difference in form matters in practice: the GDPR is a regulation that applies directly in every member state, while NIS2 is a directive that applies through each country's national law, so details such as registration and fine levels differ by country. Organisations subject to both need to understand how they overlap, where they diverge, and how to comply with both without duplicating effort.

Topic	GDPR	NIS2
Legal form	Regulation (EU) 2016/679, directly applicable	Directive (EU) 2022/2555, applied through national law
Protects	Personal data and the people it relates to	Network and information systems of essential and important entities
Who it applies to	Anyone processing personal data in an EU establishment, or targeting or monitoring people in the EU (Art. 3)	Medium-sized and larger entities in 18 sectors, plus some entities regardless of size (Art. 2)
Security duty	Measures appropriate to the risk to people (Art. 32)	Risk-management measures, at least the ten areas in Art. 21(2)
Incident reporting	Personal data breaches: authority within 72 hours unless unlikely to result in a risk; people without undue delay if high risk (Art. 33, 34)	Significant incidents: early warning in 24 hours, notification in 72 hours, final report within one month (Art. 23)
Reported to	Data protection authority	CSIRT or competent authority
Maximum fines	€20M or 4% of worldwide turnover; €10M or 2% for some infringements (Art. 83)	At least €10M or 2% (essential), at least €7M or 1.4% (important) (Art. 34)
Management	Controller accountability; DPO in some cases (Art. 5(2), 37)	Management bodies approve and oversee measures, must be trained and can be held liable (Art. 20)

The fundamental difference

GDPR protects personal data. It governs the processing of information relating to identified or identifiable natural persons. Its primary concern is the privacy and rights of individuals.

NIS2 protects network and information systems. It governs the cybersecurity of organizations providing essential and important services. Its primary concern is the operational resilience and security of systems that society depends on.

A helpful analogy: GDPR cares about what data you hold and how you handle it. NIS2 cares about the systems that hold the data and whether they are secure. Both care about security, but from different perspectives and for different reasons.

Scope comparison

GDPR applies to almost everyone. It covers any organization that processes personal data in the context of an establishment in the EU, and organizations outside the EU that offer goods or services to people in the EU or monitor their behaviour there (Article 3). Size, sector and nationality don't matter: a five-person startup collecting email addresses is subject to GDPR.

NIS2 is selective. It applies to medium-sized and large organizations in 18 specified sectors that are medium-sized or larger under Commission Recommendation 2003/361/EC (in short: 50 or more employees, or annual turnover and balance sheet total both above €10 million), plus certain entities regardless of size, such as public electronic communications providers, trust service providers, TLD registries and DNS service providers. A five-person startup is unlikely to be subject to NIS2 unless it falls into one of those size-independent categories or its member state designates it.

This means many organizations are subject to GDPR but not NIS2. Fewer are subject to both. And virtually no organization is subject to NIS2 without also being subject to GDPR (since NIS2 entities almost always process some personal data).

Incident reporting — the critical overlap

This is where the two regulations most directly intersect, and where confusion is most common.

GDPR Article 33: Personal data breaches likely to result in risk must be notified to the supervisory authority (DPA) within 72 hours of becoming aware. If there is high risk to individuals, affected data subjects must also be notified without undue delay (Article 34).

NIS2 Article 23: Significant incidents must be reported to the CSIRT or competent authority: an early warning within 24 hours of becoming aware, an incident notification within 72 hours of becoming aware, and a final report no later than one month after the incident notification.

A single cybersecurity incident can trigger both obligations simultaneously. A ransomware attack that encrypts a hospital's patient database is both a personal data breach (GDPR) and a significant incident affecting an essential service (NIS2). The hospital would need to notify the DPA within 72 hours and the CSIRT within 24 hours — plus notify patients if there is high risk.

The key practical implication: your incident response plan must address both timelines. The NIS2 24-hour early warning is the tighter deadline, so your processes should be designed to meet that first, with the GDPR 72-hour notification following as part of the same workflow.

Need to build an incident response plan that covers both? Our Security Policy Generator creates a customized Incident Response Policy, and our IRP guide walks through the full process.

Security measures — overlap and complement

Both regulations require "appropriate" security measures, but they frame the requirement differently.

GDPR Article 32 requires "appropriate technical and organisational measures" to ensure a level of security appropriate to the risk. It specifically mentions pseudonymization, encryption, confidentiality, integrity, availability, resilience, regular testing, and a process for restoring access to data.

NIS2 Article 21(2) lists ten areas the measures must at least include: (a) risk analysis and information system security policies; (b) incident handling; (c) business continuity, backups, disaster recovery and crisis management; (d) supply chain security; (e) security in acquisition, development and maintenance, including vulnerability handling and disclosure; (f) assessing the effectiveness of the measures; (g) basic cyber hygiene and training; (h) cryptography and, where appropriate, encryption; (i) human resources security, access control and asset management; (j) multi-factor or continuous authentication and secured communications, where appropriate.

There is substantial overlap, and the same controls can serve both. But they are measured against different risks: NIS2 against the risk to the service and its systems, GDPR Article 32 against the risk to the people whose data you process. A NIS2 programme therefore covers much of Article 32, but you still need to check that personal data gets the protection its sensitivity requires. NIS2 is also more prescriptive (it names the areas to cover), while GDPR is risk-based (it asks for measures appropriate to the risk without listing which ones).

Governance and accountability

GDPR requires a Data Protection Officer (DPO) in certain cases (public authorities, large-scale monitoring, large-scale special category processing). The controller must be able to demonstrate compliance (accountability principle). Data Protection Impact Assessments are required for high-risk processing.

NIS2 requires management body approval and oversight of cybersecurity measures. Member states must ensure management bodies can be held liable for infringements of Article 21, and members must follow training (Article 20). NIS2 does not create a role like the DPO, but entities give the authority their contact details when they register (Articles 3 and 27). See NIS2 and the board.

For organizations subject to both, you may need both a DPO (GDPR) and a CISO or equivalent (NIS2), though these can be the same person in smaller organizations. The management body's obligations under NIS2 are more explicit and personally consequential than under GDPR.

Penalties compared

GDPR: Up to €20M or 4% of global turnover (for the most serious violations). Up to €10M or 2% for less severe violations. Enforced by national Data Protection Authorities.

NIS2: member states must set maximum fines of at least €10M or 2% of worldwide turnover for essential entities, and at least €7M or 1.4% for important entities, whichever is higher (Article 34(4) and (5)); national laws can go higher. For essential entities, authorities can also temporarily suspend certifications and temporarily ban individuals from management functions. Enforced by the national competent authorities designated under NIS2 (CSIRTs handle incident reports, but don't impose fines).

A single incident can breach both laws, and both authorities can investigate. But NIS2 prevents double fines for the same conduct: if a data protection authority fines you under GDPR, the NIS2 authority may not also fine you under NIS2 for an infringement arising from the same conduct (NIS2 Article 35(2)). It can still use its other supervisory and enforcement powers, such as binding instructions or audits. NIS2 authorities must also inform the data protection authority when an infringement may involve a personal data breach (Article 35(1)).

How to comply with both efficiently

Unified risk management. Do not maintain separate risk registers for "data protection risks" and "cybersecurity risks." Use a single risk management framework that covers both domains. Our Cybersecurity Maturity Assessment evaluates capabilities across both areas.

Integrated incident response. One incident response plan that addresses both NIS2 timelines (24h/72h/1 month) and GDPR timelines (72h to DPA, without undue delay to data subjects). One process, parallel notification tracks.

Combined security measures. Implement NIS2's ten measures and check them against the risk to personal data for GDPR Article 32. Document everything once and reference it from both compliance frameworks.

Single vendor management process. NIS2 supply chain requirements and GDPR processor requirements both need vendor assessment and contractual controls. Use one vendor risk assessment process that satisfies both. Our Vendor Risk Assessment tool covers both angles.

Coordinated documentation. Your information security policy can address both GDPR Article 32 and NIS2 Article 21 requirements. Your data flow maps serve both GDPR's Record of Processing Activities and NIS2's asset inventory. Do not create parallel documentation — unify and cross-reference.

The bottom line

NIS2 and GDPR are complementary, not competing. GDPR tells you to protect personal data. NIS2 tells you to secure the systems that process it. Organizations that approach both as part of a single, integrated security and compliance programme will be more efficient, more resilient, and better prepared for enforcement under either regulation.

Frequently asked questions

What is the difference between NIS2 and GDPR?

GDPR protects personal data and the people it belongs to, and applies to almost every organization. NIS2 protects the network and information systems of medium-sized and large organizations in 18 critical sectors, so that the services society depends on keep running. GDPR is a regulation that applies directly; NIS2 is a directive that applies through each country's national law.

Can one incident fall under both NIS2 and GDPR?

Yes. A ransomware attack on an in-scope entity that also affects personal data is a personal data breach under GDPR (supervisory authority within 72 hours unless the breach is unlikely to result in a risk) and, if it meets the significance thresholds, a significant incident under NIS2 (early warning to the CSIRT or authority within 24 hours, notification within 72 hours, final report within one month). The two notifications go to different authorities and have different content.

If NIS2 applies to us, do we still need to comply with GDPR?

Almost always. NIS2 entities process personal data of staff, customers or users, so GDPR applies to them as well. The reverse is not true: most organizations subject to GDPR are outside NIS2's scope because of their size or sector. Where both apply, one set of security measures and one incident process can serve both laws if they are designed for the stricter requirement.