Organisations operating in Ireland that experience a data or security incident must navigate three overlapping notification regimes simultaneously: the General Data Protection Regulation (GDPR), the Network and Information Security Directive (NIS2) as transposed into Irish law, and the Digital Operational Resilience Act (DORA) for financial entities supervised by the Central Bank of Ireland. Each regime carries distinct timelines, thresholds and liability exposures, and a single incident can trigger all three, requiring carefully coordinated responses to the Data Protection Commission and other competent authorities to avoid compounding regulatory risk.
Three Regimes, One Incident: The Structural Problem in Ireland
Ireland occupies an unusual position in the EU regulatory landscape. As the lead supervisory authority under GDPR's one-stop-shop mechanism for a substantial number of large technology companies with their EU establishments in Dublin, the Data Protection Commission (DPC) receives more cross-border breach notifications than virtually any other supervisory authority in the Union. This concentration of regulatory activity means that the DPC has developed detailed operational practice around breach handling – practice that does not always translate neatly when NIS2 or DORA obligations are layered on top.
The core structural difficulty is that GDPR, NIS2 and DORA were designed with different primary objectives, different supervisory chains and different notification architectures. GDPR centres on the rights of natural persons whose personal data is affected. NIS2 focuses on the resilience of essential and important entities, with Ireland's competent NIS2 authority operating separately from the DPC. DORA addresses operational resilience in financial services, placing the Central Bank of Ireland in a central supervisory role for Irish-authorised entities. When a ransomware attack encrypts customer financial data at an Irish-regulated payment institution, all three regimes are potentially engaged from the moment the incident is detected.
GDPR Notification: The 72-Hour Obligation and the DPC's Approach
Under GDPR, a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons must be notified to the DPC within 72 hours of the controller becoming aware of it. Where the breach is likely to result in a high risk to affected individuals, those individuals must also be notified without undue delay. The 72-hour clock is among the most demanding in global privacy law, and the DPC's published guidance makes clear that partial notifications submitted within the window – indicating that investigation is ongoing – are acceptable, provided the controller follows up with required additional information as it becomes available.
For multinational groups, the one-stop-shop mechanism means that a breach affecting data subjects across multiple EU member states should generally be notified to the DPC as lead supervisory authority, which then coordinates with concerned supervisory authorities. In practice, this has produced significant complexity: the DPC may take the lead on the GDPR dimension while national NIS2 competent authorities in other member states independently assess the network and systems angle. Organisations with Irish establishments should not assume that a DPC notification resolves their obligations in other jurisdictions.
Liability under GDPR for failure to notify within the 72-hour window, or for late individual notification, exposes controllers to administrative fines of up to €10 million or 2% of total worldwide annual turnover, whichever is higher, for the notification breach itself – with higher caps applicable if the underlying processing infringement is treated as a more serious violation. Enforcement action by the DPC can also lead to reputational consequences and, in High Court Ireland proceedings, to claims by data subjects under Article 82 GDPR for material and non-material damage.
If you are assessing your organisation's GDPR compliance posture or reviewing your incident response procedures in Ireland, our data protection team can assist. Please visit our data protection services page for Ireland or contact us at info@ferrazwhitmore.com.
NIS2: Tiered Timelines and the Irish Transposition
The NIS2 Directive introduced a tiered notification structure that differs materially from the GDPR regime. Essential and important entities are required to submit an early warning to the competent national authority – without undue delay and in any event within 24 hours of becoming aware of a significant incident. A fuller incident notification follows within 72 hours. A final report is due within one month. The objective is to enable rapid national and cross-border response, not primarily to protect individual data subjects.
The definition of a "significant incident" under NIS2 is tied to operational impact thresholds – disruption to service provision, impact on other entities, affected persons – rather than solely to the nature of the data involved. This means an incident may cross the NIS2 notification threshold without involving personal data in any meaningful sense, and conversely a personal data breach may be notifiable under GDPR without reaching the NIS2 significance threshold. Irish entities that fall within NIS2's scope as essential entities in sectors such as energy, transport, banking, health or digital infrastructure must maintain separate processes for each regime.
The interaction between NIS2 notifications and GDPR notifications in Ireland raises a practical question of sequencing: the NIS2 early warning (24 hours) precedes the GDPR notification deadline (72 hours), but the two go to different authorities and carry different content requirements. An internal incident response framework that conflates them risks both under-reporting to one authority and over-reporting – potentially disclosing legally privileged analysis – to the other.
DORA: Financial Sector Incident Reporting and the Central Bank of Ireland
For financial entities within DORA's scope – including credit institutions, investment firms, insurance undertakings, payment institutions and crypto-asset service providers authorised in Ireland – the Digital Operational Resilience Act imposes a further, parallel notification regime for major ICT-related incidents. The Central Bank of Ireland is the competent authority for DORA oversight in respect of Irish-authorised entities, and the European Supervisory Authorities (EBA, ESMA and EIOPA) coordinate at Union level.
DORA's incident classification and reporting timelines use a distinct framework. An initial notification must be submitted to the competent authority following detection of a major incident, with an intermediate report and a final report thereafter. The exact durations are defined in regulatory technical standards developed by the ESAs. Critically, DORA also requires financial entities to inform clients that may be affected by major incidents, adding a client-facing dimension alongside the regulatory notification chain.
Where an Irish-authorised financial entity experiences an incident that involves personal data, constitutes a significant NIS2 event and qualifies as a major DORA incident simultaneously, it faces three notification tracks running in parallel to the DPC, the NIS2 competent authority and the Central Bank of Ireland respectively. Coordinating those tracks – ensuring consistency of factual statements, managing privilege, and meeting the earliest deadline without prejudicing later, more detailed submissions – is one of the most technically complex aspects of incident response for the Irish financial sector.
Our banking and finance team advises regulated entities on DORA compliance and incident response coordination with the Central Bank of Ireland. Further information is available on our banking and finance services page for Ireland. For time-sensitive queries, please write to info@ferrazwhitmore.com.
The Digital Omnibus Proposal: What Changes May Come
In November 2025, the European Commission published the Digital Omnibus (COM(2025) 837, 19 November 2025), a package proposing targeted amendments to GDPR, the ePrivacy Directive, the Data Act, NIS2 and the CER Directive. As of the date of this analysis, the Digital Omnibus is a proposal under the ordinary legislative procedure and has not been adopted. Nothing in it applies, and the final text may differ materially from the proposal.
The proposals most relevant to breach notification include: raising the GDPR notification threshold from "likely to result in a risk" to "high risk" for notifications to supervisory authorities; extending the GDPR deadline from 72 to 96 hours; and establishing a single entry point for incident reporting across GDPR, NIS2 and DORA to reduce the multi-track burden described above. The EDPB-EDPS Joint Opinion 2/2026 (published 10 February 2026) supported some of these changes – notably the single entry point concept and the 72-to-96-hour extension – while opposing others, including a proposed narrower definition of personal data and softer rules on automated decision-making.
Organisations should monitor the legislative process carefully but should not adjust their current compliance programmes in anticipation of the Omnibus. Current GDPR, NIS2 and DORA obligations remain fully applicable. Any reductions in notification burden will only take effect once an amended regulation is adopted, enters into force, and any applicable transitional periods expire. Building flexibility into incident response procedures now – so that they can accommodate either a continuation of the current regime or a future single-entry-point model – is preferable to deferring investment pending legislative clarity.
A separate instrument, Regulation (EU) 2026/1744 on AI (the Digital Omnibus on AI), was adopted and entered into force on 27 July 2026. That regulation addresses AI governance rather than breach notification timelines directly, but its interaction with DORA's operational resilience requirements for AI-driven financial systems is an emerging area of analysis for Irish financial entities.
Overlapping Liability: Where the Risks Compound
The liability architecture across the three regimes differs in ways that matter for risk quantification. Under GDPR, fines are calculated against worldwide annual turnover and are imposed by the DPC, with appeal routes to the Irish courts including ultimately the High Court Ireland. Under NIS2, the liability framework is set partly at national level through Ireland's implementing legislation, with supervisory powers vested in the competent NIS2 authority. Under DORA, the Central Bank of Ireland exercises supervisory and sanctioning powers in respect of Irish-authorised financial entities, with a liability framework grounded in financial services regulation rather than data protection law.
Three distinct points of compounding risk are worth noting. First, parallel investigations: a single incident can trigger simultaneous investigations by three authorities, each with its own information-gathering powers. Responses provided to one authority may be disclosed to or sought by another, and inconsistencies – even those arising from evolving factual understanding rather than bad faith – can damage an organisation's position across all three proceedings.
Second, data transfer complications: where an incident involves personal data transferred from other EU member states to Ireland under standard contractual clauses or another transfer mechanism, the incident may reactivate scrutiny of the underlying transfer arrangement. This is particularly acute for groups using Ireland as a data hub for EU operations.
Third, civil liability: Article 82 GDPR provides data subjects with a right to compensation for material and non-material damage resulting from a breach. Irish courts have jurisdiction over such claims brought by data subjects in Ireland, and the volume of GDPR-related civil litigation in Ireland has grown as awareness of the right increases. An incident that produces a DPC enforcement outcome can serve as a factual foundation for subsequent civil proceedings.
Strategic Recommendations for Organisations in Ireland
The following practical steps are drawn from the regulatory framework and the Irish supervisory context. They are not exhaustive and should be adapted to the specific profile of each organisation.
- Map your notification obligations before an incident occurs. Determine which of GDPR, NIS2 and DORA apply to your Irish operations and document the applicable thresholds, deadlines and competent authorities for each. Organisations that discover which regimes apply only after an incident has been detected consistently experience avoidable delays.
- Establish a single internal incident commander with cross-regime authority. Fragmented decision-making across data protection, IT security and financial compliance teams is one of the most common causes of missed deadlines. A designated incident lead who can commit the organisation to a notification should be identified and empowered in advance.
- Prepare and test partial-notification templates for the DPC. The DPC accepts initial GDPR notifications that acknowledge the incident without complete information, provided updates follow promptly. Having pre-approved template language reduces the time required to make the first submission within the 72-hour window.
- Coordinate NIS2 and GDPR notifications with legal privilege in mind. Root cause analysis, legal advice obtained during incident response and certain forensic reports may attract legal professional privilege under Irish law. Advice on what to disclose and when – and in what form – should be obtained before notifications are submitted, not after.
- Brief the Central Bank of Ireland relationships team if DORA applies. For regulated financial entities, a practice of early, proactive engagement with the Central Bank – consistent with DORA notification obligations – is generally received more favourably than reactive disclosure. This should be discussed with legal counsel in advance to ensure it does not prejudice DPC or NIS2 notification timing.
- Monitor the Digital Omnibus legislative process but do not delay compliance investment. Build flexibility into your incident response procedures so they can accommodate a potential future single-entry-point model without requiring a wholesale redesign.
Cross-Border Considerations for International Clients
For international clients with Irish establishments or Irish-authorised entities within a larger group, the notification obligations described above interact with group-level incident response governance in important ways. A parent company outside the EU that experiences an incident at group level may trigger notification obligations through its Irish subsidiary even if the Irish entity was not directly affected, depending on the data flows and processing arrangements involved.
Groups structured with an Irish entity as EU data controller for group-wide data processing should ensure that their group incident response policy allocates clear responsibility to the Irish entity for DPC notification and does not inadvertently subordinate that obligation to a group timeline driven by non-EU legal requirements. Conflicts of this kind – where a US or UK parent's incident response timeline does not accommodate the DPC's 72-hour window – are a recurring source of regulatory difficulty for international groups with Irish establishments.
Further analysis of the practical interaction between these regimes, including worked examples of incident classification and notification sequencing, is available in our detailed guide at Incident Reporting: NIS2, DORA and GDPR in Ireland.
If your organisation is reviewing its incident response framework, or if you have experienced or are anticipating a regulatory inquiry in Ireland, our team is available to discuss the position in confidence. Please write to info@ferrazwhitmore.com or visit our contacts page to arrange a consultation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.