Skip to content
Cyber Compliance

GDPR → NIS2 crosswalk

A control-by-control mapping between General Data Protection Regulation (EU 2016/679) and NIS2 Directive (EU 2022/2555). 4 mappings.

GDPRNIS2RelationshipNotes
Art. 25
Data protection by design and by default
Art. 21(2)(a)
Risk analysis and information system security policies
RelatedCurated
Governance & security policy
Art. 32
Security of processing
Art. 21(2)(h)
Cryptography and encryption
PartialCurated
Cryptography & data protection
Art. 33
Notification of a personal data breach to the supervisory authority
Art. 21(2)(b)
Incident handling
RelatedCurated
Incident response & breach notification
Art. 33
Notification of a personal data breach to the supervisory authority
Art. 23
Reporting obligations
RelatedCurated
Incident response & breach notification

Mappings marked “Official” derive from standards-body informative references; “Curated” mappings are authored by Cyber Compliance and provided for guidance only.