GDPR vs NIS2 Directive

Why they differ

GDPR protects people's personal data; NIS2 protects the services society depends on.

Compliance & regulation

The EU law that protects personal data and gives people rights over how it is used.

Formal

Regulation (EU) 2016/679, applying directly in every member state since 25 May 2018, which sets principles, legal grounds, rights and security duties for processing data about identifiable people, with fines of up to 20 million euro or 4% of global turnover.

In plain English

Information about you is treated as yours - others may borrow it only for a fair reason, must look after it and must tell you what they do with it.

In practice

When a laptop holding customer lists is stolen from the owner's car, a Danish web shop has 72 hours to report the breach to Datatilsynet and must decide whether the customers themselves need to be told.

Why it matters

Before it, data protection rules differed from country to country and were weakly enforced; GDPR gave people the same rights across the EU and made breaking them costly.

NIS2 Directive

Compliance & regulation

The EU cybersecurity law that sets shared security duties for organisations in important and critical sectors.

Formal

Directive (EU) 2022/2555, to be written into national law by 17 October 2024, which obliges essential and important entities in 18 sectors to manage cyber risk, report significant incidents in stages and make their management body answerable.

In plain English

Like common building safety rules for the whole EU - every country must write them into its own law, and those who keep society running must build by them.

In practice

The board of a mid-sized Danish shipping company learns it falls under NIS2, so it approves a risk assessment, a routine for reporting incidents within 24 hours and security terms for its suppliers.

Why it matters

The first NIS rules covered too few sectors and were applied unevenly; NIS2 brings in thousands more organisations, fines of up to 10 million euro or 2% of turnover, and personal liability for leaders.

Shared connections

Compliance Incident response