Skip to content
Scope test

Which rules reach you?

NIS2, DORA, the GDPR and the UK's Network and Information Systems Regulations 2018 each define their own scope, in their own words, and the answers differ. This reads them against the figures you give us and shows you the text each answer rests on.

No account, no email address, nothing written down. The answer is not saved and neither are the figures.

Directive (EU) 2022/2555 — NIS2

Your sector, and your size

Art. 2(1) reaches an entity of a listed type that is medium-sized or above and provides services in the Union. Art. 2(2) to 2(5) reach several kinds of entity whatever their size, and Art. 2(7) and 2(10) take some back out.

One person working full-time for the whole year is 1. Part-time, seasonal and part-year work count as fractions, so half-time all year is 0.5. Owner-managers and working partners are included. Annex Art. 5 excludes apprentices and vocational trainees outright and does not count maternity or parental leave — which is why this is not a headcount.

Digits only — no symbols, separators or units.

One of the two financial figures is enough. Give whichever you have.

Does any of these describe you? — Art. 2(2) to 2(4)

Each one reaches an entity whatever its size, so ticking any of them makes the figures above irrelevant.

Express exclusions — Art. 2(7) and 2(10)
Regulation (EU) 2022/2554 — DORA

Are you one of the twenty-one entity types?

DORA has no size test at all, which is the thing a NIS2 reader most often assumes wrongly. Art. 2(1) is a list of entity types and Art. 2(3)'s exclusions are type-based too.

Art. 2(1) entity types

Point (u), ICT third-party service providers, is in scope and is deliberately not one of the "financial entities" Art. 2(2) defines — the Regulation reaches it by a different route.

Art. 2(3) exclusions
Regulation (EU) 2016/679 — GDPR

Material scope, and the territorial one that actually discriminates

Art. 2(1) reaches any processing of personal data by automated means, and the Art. 2(2) exclusions are narrow — so a positive answer on material scope is not a finding. The question that separates organisations is Art. 3.

Art. 2(2) exclusions
The United Kingdom

The Network and Information Systems Regulations 2018

The UK is not under NIS2 — it left the Union before that Directive, and its operators are under S.I. 2018/506 instead. Two separate populations, with different duties and different recipients. Skip this section if you have no UK presence.

Reg. 1(2) lists exactly three, and the definition reaches no others — a UK software company that is none of them is outside reg. 1(3)(e) however large it is.

  • An online marketplace: "online marketplace" means a digital service that allows consumers and/or traders as respectively defined in point (a) and in point (b) of Article 4(1) of Directive 2013/11 to conclude online sales or service contracts with traders either on the online marketplace's website or on a trader's website that uses computing services provided by the online marketplace.
  • An online search engine: "online search engine" means a digital service that allows users to perform searches of, in principle, all websites or websites in a particular language on the basis of a query on any subject in the form of a keyword, phrase or other input, and returns links in which information related to the requested content can be found.
  • A cloud computing service: "cloud computing service" means a digital service that enables access to a scalable and elastic pool of shareable computing resources.

This page cannot finish that test for you.Reg. 8(1) deems you designated if you meet a threshold requirement, and Schedule 2 sets those per subsector — customers supplied, generating capacity, traffic volume, which licence is held. Answer this and we will point you at your own paragraph.

This reads the statutory scope tests against the facts you give us. It is not legal advice and it is not a determination: for NIS2 in particular, whether an entity is in scope is settled by the Member State that lists it, and several limbs of the test turn on judgements only a national authority makes.

What this cannot tell you

This page cannot tell you that you are "not in scope"

Only one negative rests on the text alone: an express exclusion. Everything else this page can say is that the test it ran did not reach you — and several limbs of NIS2 Art. 2 reach an entity on a judgement no form can make. Those are listed under every answer, positive ones included.

Your Member State has the last word on NIS2

Art. 3(3) has Member States establish the list of essential and important entities. Being in scope is settled by that list, not by this test and not by us.

The size ceilings this page applies are250 annual work units, EUR 50 million turnover and EUR 43 million balance sheet total, from the Annex to Recommendation 2003/361/EC. Seewhat we do once you are in scope.