Regulations that reach Ireland

Report to: Your competent supervisory authority under Art. 55(1) — in Ireland the Data Protection Commission, and a different authority in each other member state

• within 72 hoursNotify the supervisory authorityGDPR Art. 33(1)Owed only if this incident is a personal-data breach, and not owed where the breach is "unlikely to result in a risk to the rights and freedoms of natural persons" (Art. 33(1)). Many incidents are neither. This stage is shown on every incident because nothing here can tell which yours is — decide it on the facts, and document the decision either way, because Art. 33(5) requires you to.

Also owed under the same instrument, with no fixed deadline: Telling the people whose data it was (GDPR Art. 34); Documenting every breach, including the ones you do not report (GDPR Art. 33(5)); If you are a processor, your clock is different (GDPR Art. 33(2)).

A personal-data breach duty runs ALONGSIDE any sectoral incident-reporting duty, never instead of it. Where an incident is both a personal-data breach and a reportable security incident, you owe both notifications, to two different authorities, and filing one does not discharge the other. The 72-hour figure is a coincidence of drafting: the two clocks have different triggers, different recipients and different content requirements.

Report to: The CSIRT (reg. 10(1)), which without delay furnishes a copy to the single point of contact and to your competent authority — the Minister (reg. 7(1)), with a second copy to the Central Bank of Ireland if you are in banking or financial market infrastructures (reg. 7(2)) — under reg. 18(5)

• within 72 hoursIncident notificationS.I. No. 360/2018, reg. 18(2)
• within 72 hoursResolution notificationS.I. No. 360/2018, reg. 18(10)

This is the regime in force in Ireland today. NIS2 has not been transposed — NCSC Ireland says so itself, and that its predecessor remains in full effect — so your incident notification duty runs under these Regulations and not under Article 23. When the National Cyber Security Bill is enacted this schedule is what changes.

Whether you owe this at all is not something this register can tell you. An operator of essential services is DESIGNATED by a competent authority under reg. 15 — it proposes the designation in writing, gives you 15 working days to make representations, and notifies you of its decision — and a relevant digital service provider is defined by reg. 20 on the service you provide and where your main establishment is. Most organisations in Ireland are under neither.

Failing to notify is an OFFENCE under these Regulations (reg. 18(14) for an operator of essential services, reg. 22(14) for a relevant digital service provider) — not an administrative penalty. It is a defence to show you took all reasonable steps, or that notifying was not reasonably possible (reg. 18(15) for an operator of essential services, reg. 22(15) for a relevant digital service provider). Reg. 34 sets what a conviction costs:a class A fine on summary conviction, or on indictment a fine of up to €50,000 for an individual and €500,000 for anyone else. And reg. 34 lists reg. 33 alongside regs. 18 and 22, so under reg. 33(1) a director, manager or secretary who consented to or connived in the failure — or whose wilful neglect it is attributable to — is guilty in their own person and liable to the same fines. Of the instruments behind the obligations tracked here, this is the only instrument whose own text makes an INDIVIDUAL guilty of an offence — a criminal record rather than an administrative consequence. Other provisions in this register do reach a natural person, in ways that are not a conviction; they are compared on this page from the provisions themselves rather than listed here.

The second notification is the one to diarise: its 72 hours starts when the incident is RESOLVED, which is the same moment the incident drops out of the open-incident view above. Nothing here will keep counting it down in front of you.

Report to: The CSIRT (reg. 10(1)), which forwards your notification to the single point of contact and to the competent authority (reg. 22(6))

• within 72 hoursIncident notificationS.I. No. 360/2018, reg. 22(3)Reg. 22(2): this duty "shall not apply where a relevant digital service provider does not have access to the information required to assess the impact of an incident". The register cannot tell whether you have that access, so the stage is shown on every incident.
• within 72 hoursResolution notificationS.I. No. 360/2018, reg. 22(11)

This is the regime in force in Ireland today. NIS2 has not been transposed — NCSC Ireland says so itself, and that its predecessor remains in full effect — so your incident notification duty runs under these Regulations and not under Article 23. When the National Cyber Security Bill is enacted this schedule is what changes.

Whether you owe this at all is not something this register can tell you. An operator of essential services is DESIGNATED by a competent authority under reg. 15 — it proposes the designation in writing, gives you 15 working days to make representations, and notifies you of its decision — and a relevant digital service provider is defined by reg. 20 on the service you provide and where your main establishment is. Most organisations in Ireland are under neither.

Failing to notify is an OFFENCE under these Regulations (reg. 18(14) for an operator of essential services, reg. 22(14) for a relevant digital service provider) — not an administrative penalty. It is a defence to show you took all reasonable steps, or that notifying was not reasonably possible (reg. 18(15) for an operator of essential services, reg. 22(15) for a relevant digital service provider). Reg. 34 sets what a conviction costs:a class A fine on summary conviction, or on indictment a fine of up to €50,000 for an individual and €500,000 for anyone else. And reg. 34 lists reg. 33 alongside regs. 18 and 22, so under reg. 33(1) a director, manager or secretary who consented to or connived in the failure — or whose wilful neglect it is attributable to — is guilty in their own person and liable to the same fines. Of the instruments behind the obligations tracked here, this is the only instrument whose own text makes an INDIVIDUAL guilty of an offence — a criminal record rather than an administrative consequence. Other provisions in this register do reach a natural person, in ways that are not a conviction; they are compared on this page from the provisions themselves rather than listed here.

The second notification is the one to diarise: its 72 hours starts when the incident is RESOLVED, which is the same moment the incident drops out of the open-incident view above. Nothing here will keep counting it down in front of you.

Report to: Your relevant competent authority under Art. 46 — in Ireland the Central Bank of Ireland, and a different authority in each other member state and for each financial sector. A significant credit institution reports to its national competent authority, which transmits to the ECB (Art. 19(1)).

• within four hours from the classification of the ICT-related incident as a major ICT-related incident (RTS Art. 5(1)(a)), and no later than 24 hoursInitial notificationDORA Art. 19(4)(a); RTS Art. 5(1)(a)
• within 72 hoursIntermediate reportDORA Art. 19(4)(b); RTS Art. 5(1)(b)
• within one monthFinal reportDORA Art. 19(4)(c); RTS Art. 5(1)(c)

Also owed under the same instrument, with no fixed deadline: Protection measures against a threat you have not suffered (DORA Art. 19(3), second sentence); Updated intermediate reports, and on request (DORA Art. 19(4)(b)); Voluntary notification of a significant cyber threat (DORA Art. 19(2)).

The 24-hour limit shown on the initial notification is the OUTER limit, and it assumes you classified the incident as major within those 24 hours. RTS Art. 5(2) says that if you classify it as major later than that, your deadline is four hours from the classification instead — which falls after the 24-hour mark. This register shows the earlier of the two readings, so an entity in that position has longer than it appears, never less.

DORA is a Regulation and has applied directly since 17 January 2025 — there is no transposing measure and no member-state variation in whether the duty exists. What does vary is which authority you report to, and whether you are a financial entity at all: Art. 2(1) lists the types, and this register runs the clock only because you told us you are one.

Article 19 and NIS2 Article 23 are separate obligations with different recipients, and an incident can be reportable under both. Recording one here does not discharge the other. Art. 19(1) also lets a member state require the same notification to its CSIRT under NIS2 as well; this register does not know whether yours has.

Whether an incident is "major" — and so reportable at all — is your own determination under Art. 18, against the criteria and materiality thresholds in Commission Delegated Regulation (EU) 2024/1772. That Regulation is not encoded here and nothing on this screen applies it: the severity you set on an incident is not a DORA classification, and this register cannot tell you whether an incident is reportable.

RTS Art. 5(4) may let you submit by noon of the next working day where a deadline falls on a weekend or a bank holiday in your member state. Art. 5(5) withdraws that for credit institutions, central counterparties, operators of trading venues and entities identified as essential or important under NIS2, and Art. 5(6) lets your competent authority withdraw it from other significant entities — but BOTH of those reach only the initial notification and the intermediate report. Neither names the final report, so the extension on that one cannot be withdrawn from anybody. This register does not know which kind of entity you are, or your bank-holiday calendar, so every deadline it shows is the unextended one.

Report to: The CSIRT designated as coordinator of the Member State of your main establishment in the Union — or, if you have none, the one Article 14(7) reaches by its four-step order — simultaneously accessible to ENISA, via the single reporting platform (Art. 14(7), Art. 16)

• within 24 hoursEarly warning notificationCRA Art. 14(2)(a)
• within 72 hoursVulnerability notificationCRA Art. 14(2)(b)
• within 14 daysFinal reportCRA Art. 14(2)(c)

Report to: The CSIRT designated as coordinator of the Member State of your main establishment in the Union — or, if you have none, the one Article 14(7) reaches by its four-step order — simultaneously accessible to ENISA, via the single reporting platform (Art. 14(7), Art. 16)

• within 24 hoursEarly warning notificationCRA Art. 14(4)(a)
• within 72 hoursIncident notificationCRA Art. 14(4)(b)
• within one monthFinal reportCRA Art. 14(4)(c)

Report to: The competent authority designated under the CER Directive by the Member State that identified you as a critical entity (Art. 15(1))

• within 24 hoursInitial notificationCER Art. 15(1)
• within one monthDetailed reportCER Art. 15(1)Article 15(1) makes the detailed report due "where relevant" and does not define further what makes it relevant. It is shown here on every incident because we cannot tell; decide with your competent authority whether it is owed.

Article 15(1) says the detailed report is due "no later than one month thereafter" without naming the event the month runs from. We run it from when you became aware, which is the earlier of the two readings — on the other reading, that the month runs from your initial notification, the deadline falls up to 24 hours later. Read the Article and take your own view before relying on either.

NIS2 Article 23 and CER Article 15 are separate obligations arising from separate Directives, and the authority designated under each need not be the same body. An incident can be reportable under both. Recording an incident here does not file anything with anyone, and satisfying one obligation does not discharge the other.