Incident Reporting Under NIS2, DORA and GDPR in Ireland: Current Deadlines and the Proposed Single Entry Point

Businesses operating in Ireland currently face three overlapping incident-reporting regimes – GDPR, NIS2 and DORA – each with distinct deadlines, competent authorities and documentation requirements. A legislative proposal, the Digital Omnibus (COM(2025) 837), would introduce a single entry point and modify certain thresholds, but it has not been adopted as of October 2026 and the existing rules remain fully in force. This guide sets out the current obligations, the step-by-step procedure, and the practical changes that may follow once the proposal moves through the ordinary legislative procedure.

The Three Regimes and Their Legal Basis in Ireland

Ireland sits at the intersection of three EU frameworks that impose mandatory incident notification. Understanding which regime applies – and when multiple regimes apply simultaneously – is the first task for any organisation responding to a security or data incident.

GDPR is implemented in Ireland through the Data Protection Acts 1988–2018 and enforced by the Data Protection Commission (DPC), which is also the lead supervisory authority for many EU-wide data controllers given the volume of large technology companies headquartered in Dublin. Under Article 33 GDPR, a controller must notify the DPC without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to individuals' rights and freedoms. Where the breach is unlikely to result in such risk, notification is not required, but the controller must document its reasoning.

NIS2 (Directive (EU) 2022/2555), transposed into Irish law, imposes obligations on essential and important entities across sectors such as energy, transport, health, digital infrastructure and ICT service management. The regime operates in a three-stage notification structure: an early warning to the competent national authority or CSIRT within 24 hours of becoming aware of a significant incident; a fuller incident notification within 72 hours updating the initial report; and a final report within one month after submission of the incident notification. Ireland's national competent authorities for NIS2 purposes vary by sector.

DORA (Regulation (EU) 2022/2554), directly applicable across the EU since 17 January 2025, governs ICT-related incident reporting for financial entities. In Ireland, the primary competent authority under DORA is the Central Bank of Ireland. DORA introduces its own three-stage structure: an initial notification, an intermediate report and a final report. The precise timeframes for each stage were further detailed in the relevant implementing technical standards issued by the European Supervisory Authorities.

For more detail on the data protection obligations applicable in Ireland, including lawful bases, data transfer mechanisms and DPC engagement, see our dedicated page on data protection services in Ireland.

When Two or More Regimes Apply at the Same Time

The most challenging scenarios arise when a single incident triggers obligations under more than one framework. A ransomware attack on a financial entity, for example, may simultaneously constitute:

• a personal data breach under GDPR requiring DPC notification within 72 hours;
• a significant ICT-related incident under DORA requiring Central Bank of Ireland notification on the DORA timeline; and
• a significant incident under NIS2, if the entity also qualifies as an essential or important entity, requiring CSIRT notification within 24 hours.

These reporting obligations run concurrently and independently. Notifying one authority does not satisfy the obligation to notify another. Organisations must maintain parallel notification workflows and, critically, ensure that the factual content reported to each authority is consistent, even though the format and emphasis may differ.

If your organisation is uncertain which regimes apply to its activities in Ireland, our team can assist with a structured assessment. Write to us at info@ferrazwhitmore.com or visit our contacts page.

Step-by-Step Notification Procedure Under Each Regime

GDPR: Notifying the Data Protection Commission

The GDPR notification process in Ireland involves the following steps:

• Step 1 – Internal detection and escalation. The moment a processor or internal team becomes aware of a potential breach, the clock begins for the controller. Document the time of awareness precisely.
• Step 2 – Preliminary assessment. Assess whether the breach is likely to result in a risk to individuals. If yes, proceed immediately. If the risk assessment takes time, submit an initial notification to the DPC indicating that information is still being gathered – the DPC accepts phased submissions.
• Step 3 – DPC notification. Submit via the DPC's online breach notification portal. The notification must cover: the nature of the breach, categories and approximate number of data subjects affected, categories and approximate number of records affected, likely consequences, and measures taken or proposed.
• Step 4 – Communication to data subjects. Where the breach is likely to result in a high risk to individuals, communication to affected data subjects is also required without undue delay under Article 34 GDPR.
• Step 5 – Documentation. Regardless of whether notification is made, record the breach, its effects and the remedial action taken in your internal breach register.

NIS2: Three-Stage Reporting

• Stage 1 (24 hours) – Early warning. Notify the relevant national competent authority or CSIRT that a significant incident has occurred or is suspected. This is a brief, preliminary alert; detailed information is not yet required.
• Stage 2 (72 hours) – Incident notification. Provide an update including an initial assessment of the incident, its severity and impact, and any indicators of compromise if available.
• Stage 3 (1 month) – Final report. Submit a detailed report covering a description of the incident, the type of threat or root cause, applied and ongoing mitigation measures, and cross-border impact where relevant.

DORA: ICT Incident Reporting to the Central Bank of Ireland

Under DORA, financial entities must classify ICT incidents in accordance with the criteria set out in the regulation and the accompanying technical standards. Only incidents classified as major trigger the mandatory three-stage reporting obligation. The Central Bank of Ireland, as competent authority, is the recipient of these notifications. DORA also requires financial entities to maintain a register of all ICT incidents and to report aggregated statistical data on a periodic basis.

For questions specific to financial sector compliance and the Central Bank of Ireland's supervisory expectations, our banking and finance practice in Ireland can provide more targeted guidance.

Documents to Prepare Before an Incident Occurs

Regulatory experience suggests that organisations which respond most effectively to incidents are those that have documented their processes in advance. Recommended baseline documentation includes:

• An incident response plan designating roles, escalation paths and authority contacts for each applicable regime;
• A breach register template meeting GDPR Article 33(5) requirements;
• Pre-drafted notification templates for the DPC, the relevant NIS2 authority and the Central Bank of Ireland;
• A classification matrix distinguishing personal data breaches, NIS2 significant incidents and DORA major ICT incidents;
• Documented agreements with processors and ICT third-party providers specifying the timeframe within which they must notify the controller or financial entity of a discovered incident;
• Records of staff training on the notification obligations.

Common Errors Made by Foreign Clients Operating in Ireland

Organisations headquartered outside Ireland, whether in the EU or in third countries, frequently encounter the same difficulties when navigating Irish incident-reporting requirements:

• Treating the 72-hour GDPR deadline as beginning when legal counsel is engaged, rather than when the organisation first became aware. Awareness is attributed to the controller even if only lower-level staff initially identified the incident.
• Conflating the DPC's role as lead supervisory authority with sole competency. Where a breach affects individuals in multiple EU member states, the one-stop-shop mechanism applies, but other concerned supervisory authorities remain involved. Notification to the DPC does not eliminate obligations in other jurisdictions.
• Failing to report to the Central Bank of Ireland under DORA on the assumption that a GDPR notification to the DPC is sufficient for financial entities.
• Underestimating the NIS2 24-hour early warning timeline. Many organisations' internal approval processes are not designed to move at this speed. The early warning requires only limited information and should be filed promptly, with a follow-up submitted once more information is available.
• Omitting the internal breach register entry for incidents assessed as low-risk and therefore not notified to the DPC. GDPR requires documentation of all breaches, not only those that are reported.
• Overlooking data transfer implications. Where a breach involves personal data that was transferred from another jurisdiction to Ireland, or from Ireland to a third country, the applicable cross-border rules and any obligations under the originating jurisdiction's law must also be considered.

The Digital Omnibus Proposal: What May Change and When

On 19 November 2025, the European Commission published the Digital Omnibus (COM(2025) 837), a package of targeted amendments to GDPR, ePrivacy, the Data Act, NIS2 and the CER Directive. The most discussed changes for incident-reporting purposes are:

• A proposed shift in the GDPR breach notification threshold from "likely to result in a risk" to "likely to result in a high risk" to individuals' rights and freedoms – which would reduce the volume of notifications required;
• Extension of the GDPR notification deadline from 72 hours to 96 hours;
• Creation of a single entry point for incident reporting, so that a financial entity subject to both DORA and GDPR could file one notification that satisfies both regimes.

The EDPB-EDPS Joint Opinion 2/2026, published on 10 February 2026, expressed support for the single entry point concept and the shift to a high-risk threshold, but opposed other elements of the package, notably the proposed narrowing of the definition of personal data and adjustments to automated decision-making rules.

Critically, the Digital Omnibus is a proposal under the ordinary legislative procedure and has not been adopted as of October 2026. The final text may differ materially from the Commission's proposal. All current obligations under GDPR, NIS2 and DORA remain in full force. Organisations should not adjust their notification workflows or thresholds in anticipation of changes that have not yet been enacted.

A separate instrument, Regulation (EU) 2026/1744 (the Digital Omnibus on AI), was adopted and entered into force on 27 July 2026. That regulation addresses AI-specific matters and does not alter the incident-reporting deadlines discussed in this guide.

For a comparative perspective on how other EU jurisdictions are approaching the same issues, our analysis of breach notification under NIS2, DORA and GDPR in Spain provides a useful reference point for groups operating across multiple markets.

Decision Checklist for Organisations Operating in Ireland

When an incident is detected, the following checklist provides a structured starting point:

• Record the date and time the organisation first became aware of the incident.
• Determine whether personal data is involved and, if so, assess the risk level to individuals.
• Determine whether the entity qualifies as essential or important under NIS2 and, if so, whether the incident meets the significance threshold.
• Determine whether the entity is a financial entity under DORA and, if so, whether the incident qualifies as a major ICT incident.
• File the NIS2 early warning within 24 hours if applicable.
• File the GDPR notification to the DPC within 72 hours if the risk threshold is met.
• File the DORA initial notification to the Central Bank of Ireland in accordance with the applicable technical standards.
• Communicate to affected data subjects if the breach poses a high risk to them under GDPR.
• Document all steps taken, assessments made and notifications filed in the internal breach register.
• Prepare follow-up reports under NIS2 (72-hour update and one-month final report) and DORA (intermediate and final reports).
• Monitor the Digital Omnibus legislative process for any changes to deadlines or thresholds once adopted.

How Ferraz & Whitmore Can Assist

Navigating parallel incident-reporting obligations across GDPR, NIS2 and DORA requires both technical legal knowledge and practical process design. Our team assists organisations with readiness assessments, documentation frameworks, live incident response support, regulatory correspondence with the Data Protection Commission and the Central Bank of Ireland, and cross-border coordination where incidents span multiple EU jurisdictions.

If you would like to discuss your organisation's current compliance posture or receive guidance on a specific incident, please contact us at info@ferrazwhitmore.com or use our contacts page to arrange a consultation.

Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.