NIS2 · GDPR · DORA
Incident notification deadlines for NIS2, GDPR and DORA
Enter when the incident became known and which regimes apply. The tool lines up the clocks to watch: 24 hours, 72 hours and the final report.
An indicative aid for compliance work. It is not legal advice, a filing with an authority, or a certification.
Which clocks actually start
Under NIS2 the early warning to the CSIRT is due within 24 hours of becoming aware of a significant incident. The fuller notification follows within 72 hours. The final report is due within one month: the tool shows an operational date at 30 days, to confirm against the civil calendar.
GDPR article 33 asks for notice to the supervisory authority within 72 hours of becoming aware of a personal data breach, unless the risk to people is unlikely. Article 34 adds notice to the people themselves without undue delay when the risk is high. That is not a third fixed hour.
For major ICT incidents, DORA expects an early submission (shown here as 4 hours from classification), an update at 72 hours and a final report at one month. The RTS remain the text to follow in a live case.
What must already be in place
A deadline is useless if nobody knows who classifies the incident, which systems are involved and where the logs are. You need a test for “significant” or “major”, a path to the CSIRT, the financial supervisor and the privacy authority, and a record of the decisions.
If the same event includes personal data and an essential service, the NIS2 and GDPR clocks run together. Do not pick the more convenient regime: document both.
After the calculation
Download the .ics reminder for the response team, then name an owner for each deadline. The file sends nothing to an authority. The real notification remains an act of the organisation.
FAQ
Do the NIS2 24 hours start at detection or classification?
The early warning runs from awareness of a significant incident. The tool uses the time you enter. If that time is only a suspicion, use the moment the suspicion becomes knowledge.
Is a GDPR breach always 72 hours?
Notice to the authority is due within 72 hours when risk to people is not unlikely. If risk is unlikely, the breach still belongs in the internal register.
Why does DORA show 4 hours?
Major incidents need an early submission close to classification. Four hours is an operational reference in this tool, to be read with the regulation and the applicable RTS.
Is the .ics file a CSIRT notification?
No. It is an internal reminder. It does not contain the notification text and it is not sent to any authority.