In a nutshell

The digital transformation of the financial sector has brought myriad benefits to consumers, businesses and regulators. This includes increased efficiency, innovation and competition. On the other hand, this transformation also exposes the financial sector to new and evolving risks –cyberattacks, data breaches, operational disruptions, not to mention third-party dependencies. When you consider that financial markets are increasingly digital-dependent and grounded on communication technologies (“ICT”), those risks can have a significant impact on the financial stability, market integrity and level of consumer protection in the European Union.

To address these challenges, the European Commission has proposed a new general legislative framework for digital operational resilience in the financial sector – Regulation (UE) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector¹, also known as the Digital Operational Resilience Act (DORA) – which was formally adopted on January 16, 2023, with entry into force in January 2025.

DORA will apply to both financial entities, such as credit institutions, investment firms, payment service providers, insurance and reinsurance undertakings, asset managers, crypto-asset service providers and market infrastructures, (“FE(s)”)² and companies that provide ICT services to such entities (ICT service providers) establishing a common set of rules and standards for:

1. Management of ICT risks
2. Oversight of critical ICT third-party providers
3. Reporting and information sharing of ICT incidents
4. Testing and auditing of ICT systems and processes in the context of an FEs’ business

A framework approach similar to the GDPR’s

The rules and standards established by DORA will be then implemented through several EU Commission–delegated regulations, which will “bring to life” the general principles and high-level requirements set forth by DORA. Indeed, while drafting the act, the EU legislator appears to have adopted a similar approach to the one underlying Regulation (UE) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data³, also known as General Data Protection Regulation (GDPR). In both cases, the EU legislator – rather than defining precise rules of conduct – sets forth the general principles that should drive FEs (or data controllers/processors) in ensuring, on one side, the resilience of their ICT systems and, on the other side, the protection of personal data.

Even if DORA does not specifically set out precise rules, it was not intended to replace existing EU data protection and privacy rules, but rather to complement them. DORA and the GDPR share the same goals: ensuring the security, confidentiality and integrity of (personal and non-personal) data and the rights and freedoms of data subjects in the digital environment. However, they provide for specific scopes, roles and responsibilities, and these will need to be aligned and coordinated.

DORA will soon have a significant impact on FEs and ICT service providers as it will introduce – or, at the very least, strengthen – ICT requirements and security standards. To clearly understand the actual impact DORA will have on them, FEs and ICT service providers should start their compliance programs by mapping the obligations DORA will impose on them. Such entities should then design and start a gap analysis and remediation plan, adopting a holistic approach that also considers other laws and regulations providing for security requirements and/or data protection obligations⁴.

In this article we’ve summarized for you the key features of DORA and address some of the interplays between DORA and the GDPR that may need to be considered for a sound compliance program.

DORA: Five pillars to ensure FE’s ICT resilience

DORA covers five core pillars that involve several aspects of ICT and cybersecurity, providing a comprehensive digital resiliency framework. The key features of each pillar can be summarized as follows:

1. ICT risk management

1. Setting up resilient ICT systems and tools that minimize the impact of ICT risk.
2. Adopting extensive business continuity policies and disaster and recovery plans.
3. Implementing mechanisms to gather information from both external events as well as the FE’s own ICT incidents, to improve the ICT risk management framework.

2. ICT-related incident reporting

1. Implementing a management process to monitor and log ICT-related incidents.
2. Classifying ICT incidents in accordance with the criteria that will be specified by the applicable supervisory authority (e.g., depending on the business industry, EBA, EIOPA, etc.).
3. Reporting ICT incidents to the relevant authorities (and/or to the FEs’ users) using a common template and harmonized procedure.

3. Digital operational resilience testing

1. Periodic testing of the ICT risk-management framework to detect any weakness or deficiency. Such criticalities must be promptly resolved or mitigated by the implementation of additional security measures.
2. Adopting digital operational resilience requirements proportionate to the entities’ size, business and risk profiles⁵. 

4. ICT third-party risk

1. Sound monitoring of risks deriving from the ICT services outsourced to ICT third-party service providers.
2. Ensuring that the agreements with the ICT third-party providers contain all necessary monitoring and accessibility arrangements, such as a full-service level description, indication of locations where data is being processed, etc.
3. Developing a consistent regulatory approach by the different supervisory authorities.

5. Information sharing

1. Sharing relevant information within the context of other trusted FEs to (i) enhance FEs’ digital operational resilience, (ii) raise individual and collective awareness on ICT risks and threats, (iii) minimize ICT threats’ ability to spread.
2. Enhancing FEs’ defensive and detection techniques, mitigation strategies or response and recovery stages, including developing an effective training program for FE staff and management.
3. Entering into information-sharing arrangements to disclose to FEs’ trusted communities (e.g., sectorial cyber-response teams, etc.) cyber-threat information and intelligence.

The interplay between DORA and GDPR: Four steps to optimize financial entities ICT and privacy compliance

When taking into account the obligations under the GDPR, there are some remarkable points of intersection with DORA. Among others:

a) Conduct an ICT and privacy risk assessment

Under DORA, FEs must conduct a comprehensive and regular assessment of their ICT risk profile, which includes the identification, classification, and mitigation of potential cyberattacks, ICT disruptions and other digital threats. From a privacy standpoint, this assessment should also cover data protection and privacy risks and, more precisely, the actual business scenarios where a data breach may occur (unauthorized access of an unfaithful employee, loss of data caused by insufficient technical measures, etc.)⁶.

b) Implement and maintain appropriate and proportionate ICT policies and procedures to ensure the security and resilience of FE’s ICT systems and functions

While adopting ICT policies, procedures, and controls relevant for DORA, FEs should also ensure compliance with GDPR principles and obligations (e.g., data minimization, purpose limitation, data security, privacy by design and by default, etc.). A fitting example could be the policy to conduct a DPIA. Indeed, where the risk threshold for conducting a DPIA must be met, it is likely that the FE also needs to reassess the security levels of its ICT systems. Likewise, the policy relating to data-breach management should also deal with the reporting obligations set forth by DORA (and the delegated regulation soon to be adopted). In other words, policies and procedures should be consistent among each other and should function as “gears of the same mechanism,” aimed at ensuring ICT and privacy security.

c) Implement an ICT privacy oversight mechanism

According to DORA, FEs should implement an effective oversight mechanism on their ICT service providers, especially when they outsource critical or important ICT functions or services (e.g., cloud computing, data analytics, artificial intelligence, etc.). In this regard, FEs might want to review their data protection agreements under art. 28 GDPR, to insure they include the mandatory contractual provisions required by Chapter V of DORA⁷, as well as any additional security, resilience, and data protection requirements.

d) Ensure ICT and staff maintain privacy risk awareness

Indeed, under both the GDPR and DORA, companies are required to provide adequate and regular training and instructions to their staff on both ICT risks and challenges, as well as on data protection obligations. Such trainings should also consider the wider catalogue of ICT risks relevant under DORA (e.g., cyber threats that can undermine the ICT security and eventually lead to a data breach).

Conclusion

DORA and the GDPR are essential and complementary legal instruments for enhancing the privacy and cybersecurity of the digital financial sector in the EU. They also pose significant challenges and complexities for the FEs and their ICT third-party providers, who will have to navigate and comply with two different but interrelated legal frameworks.

FEs (and ICT service providers subject to DORA) should consider integrating their ICT risk management and data protection principles into one comprehensive decision-making process. An integrated approach may result in an easier way to comply with both the GDPR and DORA, and ultimately reduce risks.

This article is based on the contribution published in Italian on Diritto Bancario

1. Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011.
2. For further details, article 2 sets forth the scope of DORA.
3. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
4. Indeed, this matter is two-faceted as, for example, article 32 of GDPR requires data controllers and data processors to “implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk”.
5. For example, for higher levels of risk exposure, a full Threat Led Penetration Testing (TLTP) should be conducted.
6. In this regard, by way of example, the ICT risk profile assessment may consider the results of the DPIAs (data protection impact assessments) conducted by the company, so that the information gathering process would be more effective, and the set of security measures adopted would be functional for compliance with both DORA and the GDPR.
7. According to art. 30 of DORA, the agreements entered into by FEs to use outsourced ICT services must include inter alia, the following: “a clear and complete description of all functions and ICT services to be provided by the ICT third-party service provider,” “the locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are provided and where data is to be processed,” “provisions on availability, authenticity, integrity and confidentiality in relation to the protection of data, including personal data,” “service level descriptions, including updates and revisions thereof,” obligations “of the ICT third-party service provider to provide assistance to the FE at no additional cost, or at a cost that is determined ex-ante,” “termination rights and related minimum notice periods for the termination of the contractual arrangements.” Please note that the above is not exhaustive.