Regulations that reach the European Union

Report to: Your competent supervisory authority under Art. 55(1) — in Ireland the Data Protection Commission, and a different authority in each other member state

• within 72 hoursNotify the supervisory authorityGDPR Art. 33(1)Owed only if this incident is a personal-data breach, and not owed where the breach is "unlikely to result in a risk to the rights and freedoms of natural persons" (Art. 33(1)). Many incidents are neither. This stage is shown on every incident because nothing here can tell which yours is — decide it on the facts, and document the decision either way, because Art. 33(5) requires you to.

Also owed under the same instrument, with no fixed deadline: Telling the people whose data it was (GDPR Art. 34); Documenting every breach, including the ones you do not report (GDPR Art. 33(5)); If you are a processor, your clock is different (GDPR Art. 33(2)).

A personal-data breach duty runs ALONGSIDE any sectoral incident-reporting duty, never instead of it. Where an incident is both a personal-data breach and a reportable security incident, you owe both notifications, to two different authorities, and filing one does not discharge the other. The 72-hour figure is a coincidence of drafting: the two clocks have different triggers, different recipients and different content requirements.

Report to: Your CSIRT or, where applicable, your competent authority (Art. 23(1)) — and if you notify the authority, it must forward your notification to the CSIRT on receipt

• within 24 hoursEarly warningNIS2 Art. 23(4)(a)
• within 72 hoursIncident notificationNIS2 Art. 23(4)(b)
• within one monthFinal reportNIS2 Art. 23(4)(d)
• within one monthFinal report, where the incident was still ongoingNIS2 Art. 23(4)(e)Arises ONLY where the incident was still ongoing at the time you submitted the Art. 23(4)(d) final report. In that case what you submitted then was a PROGRESS report, and this is the final one. Record that it was ongoing, and the date your handling of it concluded, for this clock to start.

Also owed under the same instrument, with no fixed deadline: Warning your service recipients about a threat you have not suffered (NIS2 Art. 23(2)).

NIS2 is a Directive: it binds Member States, and you owe these windows under your own country's transposing law rather than under NIS2 itself. Transposition is uneven — several Member States, Ireland among them, had not transposed as at 26 September 2026 — so the recipient, the portal and any national variation are set by that law. The stages below are the Directive's own.

Report to: Your relevant competent authority under Art. 46 — in Ireland the Central Bank of Ireland, and a different authority in each other member state and for each financial sector. A significant credit institution reports to its national competent authority, which transmits to the ECB (Art. 19(1)).

• within four hours from the classification of the ICT-related incident as a major ICT-related incident (RTS Art. 5(1)(a)), and no later than 24 hoursInitial notificationDORA Art. 19(4)(a); RTS Art. 5(1)(a)
• within 72 hoursIntermediate reportDORA Art. 19(4)(b); RTS Art. 5(1)(b)
• within one monthFinal reportDORA Art. 19(4)(c); RTS Art. 5(1)(c)

Also owed under the same instrument, with no fixed deadline: Protection measures against a threat you have not suffered (DORA Art. 19(3), second sentence); Updated intermediate reports, and on request (DORA Art. 19(4)(b)); Voluntary notification of a significant cyber threat (DORA Art. 19(2)).

The 24-hour limit shown on the initial notification is the OUTER limit, and it assumes you classified the incident as major within those 24 hours. RTS Art. 5(2) says that if you classify it as major later than that, your deadline is four hours from the classification instead — which falls after the 24-hour mark. This register shows the earlier of the two readings, so an entity in that position has longer than it appears, never less.

DORA is a Regulation and has applied directly since 17 January 2025 — there is no transposing measure and no member-state variation in whether the duty exists. What does vary is which authority you report to, and whether you are a financial entity at all: Art. 2(1) lists the types, and this register runs the clock only because you told us you are one.

Article 19 and NIS2 Article 23 are separate obligations with different recipients, and an incident can be reportable under both. Recording one here does not discharge the other. Art. 19(1) also lets a member state require the same notification to its CSIRT under NIS2 as well; this register does not know whether yours has.

Whether an incident is "major" — and so reportable at all — is your own determination under Art. 18, against the criteria and materiality thresholds in Commission Delegated Regulation (EU) 2024/1772. That Regulation is not encoded here and nothing on this screen applies it: the severity you set on an incident is not a DORA classification, and this register cannot tell you whether an incident is reportable.

RTS Art. 5(4) may let you submit by noon of the next working day where a deadline falls on a weekend or a bank holiday in your member state. Art. 5(5) withdraws that for credit institutions, central counterparties, operators of trading venues and entities identified as essential or important under NIS2, and Art. 5(6) lets your competent authority withdraw it from other significant entities — but BOTH of those reach only the initial notification and the intermediate report. Neither names the final report, so the extension on that one cannot be withdrawn from anybody. This register does not know which kind of entity you are, or your bank-holiday calendar, so every deadline it shows is the unextended one.

Report to: The CSIRT designated as coordinator of the Member State of your main establishment in the Union — or, if you have none, the one Article 14(7) reaches by its four-step order — simultaneously accessible to ENISA, via the single reporting platform (Art. 14(7), Art. 16)

• within 24 hoursEarly warning notificationCRA Art. 14(2)(a)
• within 72 hoursVulnerability notificationCRA Art. 14(2)(b)
• within 14 daysFinal reportCRA Art. 14(2)(c)

Report to: The CSIRT designated as coordinator of the Member State of your main establishment in the Union — or, if you have none, the one Article 14(7) reaches by its four-step order — simultaneously accessible to ENISA, via the single reporting platform (Art. 14(7), Art. 16)

• within 24 hoursEarly warning notificationCRA Art. 14(4)(a)
• within 72 hoursIncident notificationCRA Art. 14(4)(b)
• within one monthFinal reportCRA Art. 14(4)(c)

Report to: The competent authority designated under the CER Directive by the Member State that identified you as a critical entity (Art. 15(1))

• within 24 hoursInitial notificationCER Art. 15(1)
• within one monthDetailed reportCER Art. 15(1)Article 15(1) makes the detailed report due "where relevant" and does not define further what makes it relevant. It is shown here on every incident because we cannot tell; decide with your competent authority whether it is owed.

Article 15(1) says the detailed report is due "no later than one month thereafter" without naming the event the month runs from. We run it from when you became aware, which is the earlier of the two readings — on the other reading, that the month runs from your initial notification, the deadline falls up to 24 hours later. Read the Article and take your own view before relying on either.

NIS2 Article 23 and CER Article 15 are separate obligations arising from separate Directives, and the authority designated under each need not be the same body. An incident can be reportable under both. Recording an incident here does not file anything with anyone, and satisfying one obligation does not discharge the other.