DORA vs GDPR
How the financial sector's digital resilience framework meets EU data protection obligations
Confronto rapido
Panoramica affiancata delle principali dimensioni normative
| Dimensione | DORA | GDPR |
|---|---|---|
| Primary objective | Make sure financial entities can withstand, respond to and recover from ICT disruptions and cyber threats | Protect the fundamental right to personal data protection and ensure the free movement of personal data in the EU |
| Scope | Financial entities (banks, insurers, investment firms, payment institutions, crypto-asset service providers) and their ICT third-party service providers, with direct oversight of the critical ones | Any organisation, anywhere, that processes personal data of individuals in the EU, in every sector |
| Data handling | Covers the security and resilience of ICT systems processing all types of data, personal and non-personal, with a focus on availability, integrity and continuity | Governs the processing of personal data: lawful bases and the principles of minimisation, purpose limitation, accuracy and storage limitation |
| Incident reporting | Major ICT incidents go to financial supervisors: initial notification within 4 hours of classification, intermediate report within 72 hours, final report within 1 month | Personal data breaches go to the supervisory authority within 72 hours of becoming aware; affected individuals must be told without undue delay if the breach poses a high risk |
| Third-party management | Full ICT third-party risk framework: a mandatory register of providers, specific contractual clauses, concentration risk management and EU-level oversight of critical ICT providers | Controller-processor framework: data processing agreements under Article 28, sub-processor controls, international transfer rules and joint controllership arrangements |
| Governance | The management body must approve the ICT risk strategy, allocate budget, take regular ICT training and remain accountable for DORA compliance | A Data Protection Officer (DPO) is mandatory for certain organisations; the controller must demonstrate compliance through records, DPIAs and data protection by design and by default |
| Penalties | Set by Member States; for critical ICT third-party providers, a periodic penalty of up to 1% of average daily worldwide turnover per day of non-compliance (max 6 months) | Up to EUR 20 million or 4% of global annual turnover for the most serious infringements; up to EUR 10 million or 2% for less severe ones |
Differenze principali
Che cosa distingue queste normative
- DORA
DORA is sector-specific; the GDPR is universal
DORA applies only to financial entities and their ICT providers, with requirements tailored to the financial system. The GDPR applies to any organisation processing personal data, whatever its industry. A bank must comply with both; a retailer processing customer data needs only the GDPR.
- GDPR
The GDPR protects personal data; DORA protects ICT systems
The GDPR focuses on the rights of the people whose data is processed: consent, access, erasure, portability. DORA focuses on the resilience of the technology itself: uptime, recovery, resistance to threats. A DORA incident may involve no personal data at all, and a GDPR breach may involve no ICT disruption.
- DORA
DORA requires operational resilience testing
DORA mandates specific testing programmes, including threat-led penetration testing (TLPT) every three years for significant entities. The GDPR requires appropriate security measures but does not prescribe testing methods or frequencies.
- GDPR
The GDPR grants extensive individual rights
The GDPR gives data subjects enforceable rights to access, rectify, erase and port their data, plus the right to object to processing. DORA creates no equivalent individual rights; it focuses on the resilience of the system rather than on individuals.
- DORA
DORA creates EU-level oversight of ICT providers
DORA introduces the Lead Overseer mechanism for critical ICT third-party providers, allowing direct supervision at EU level. The GDPR relies on national data protection authorities, which cooperate across borders through the one-stop-shop mechanism and the European Data Protection Board.
Dove si sovrappongono
Ambiti in cui le due normative hanno punti in comune
- Both require incident reporting to authorities within set deadlines: DORA for ICT incidents to financial supervisors, the GDPR for data breaches to data protection authorities
- Both set contractual requirements for third parties: DORA for ICT service providers, the GDPR for data processors
- Both require appropriate technical and organisational security measures to protect the data and systems an organisation manages
- Both require senior management to take responsibility for compliance and allocate enough resources to it
Quale si applica al Suo caso?
Scenari comuni e quale normativa prevale
You are a bank operating in the EU that processes customer personal data
Both DORA and the GDPR apply in full. DORA governs your ICT risk management, resilience testing and oversight of ICT third parties. The GDPR governs how you process customer data, breach notifications and data subject rights. An ICT incident that also involves personal data triggers duties under both at once.
You are a cloud provider serving EU financial institutions
DORA applies to you as an ICT third-party service provider, and possibly as a critical one under the Lead Overseer. The GDPR applies to you as a processor handling personal data for your financial clients. You must meet both DORA's contractual and resilience requirements and the GDPR's data processing agreement obligations.
You are an e-commerce company outside financial services
DORA does not apply to you. Focus on the GDPR for your customer data: privacy notices, consent management, data subject rights and breach notification procedures.
Domande frequenti
Domande comuni su queste normative
Legga le guide complete
Altri confronti
Bring DORA and GDPR compliance together with Reversa
Financial entities answer to both digital resilience and data protection rules. Reversa carries both sets of obligations to the same controls and the same team.
- 01Riunione iniziale
- 02Dimostrazione sul Suo caso
- 03Implementazione in poche settimane