The NIS Directive (and NIS 2)
The NIS Directive (Cybersecurity Directive) advances EU cybersecurity; it is not about personal data as such but complements the GDPR. It has three focuses: national cyber strategies and structures (including ); raising security of operators of essential services and digital service providers; and cross-border cooperation (the NIS Cooperation Group). Essential services (Annex II): energy, water, transport, health, banking, digital infrastructure. Digital service providers (Annex III): online marketplaces, search engines, cloud services (eBay, Google, Amazon). Incidents are notified to CSIRTs/regulators without undue delay. NIS 2 (proposed 2020) widens scope and adds penalties of up to €10 million or 2% of turnover.
The NIS Directive advances the EU's cybersecurity agenda first legislated in 2009. It is not concerned with personal data security as such, but it complements the GDPR and indirectly bolsters the security of personal data held by regulated organisations.
- Compel national cybersecurity strategies and structures - establishing national , appointing cybersecurity regulators, and identifying operators of essential services
- Improve security of operators of essential services and digital service providers via member-state laws setting security and incident-notification requirements
- Enhance cooperation between member states via the NIS Cooperation Group coordinating the CSIRTs and developing best practice
| Category | Examples / sectors | Enforcement model |
|---|---|---|
| Operators of essential services (Annex II) | Energy, water, transport, health, banking, digital infrastructure | Regulators can step in ex ante (before being alerted) as well as ex post |
| Digital service providers (Annex III) | Online marketplaces, search engines, cloud computing (e.g. eBay, Google, Amazon) | Regulators can step in only ex post (after being alerted to a breach) |
Security/notification duties: take appropriate, proportionate technical and organisational measures with regard to the state of the art; prevent and minimise incident impacts to maintain continuity; and notify CSIRTs/regulators of incidents with a significant impact without undue delay. Member states set their own penalties (effective, proportionate, dissuasive). NIS 2 (proposed December 2020) would widen scope (postal/courier, waste, food supply, critical manufacturing), add prescriptive risk-management rules, EU-coordinated risk assessments, ICT certifications, and harmonised penalties of up to €10 million or 2% of annual worldwide turnover.
Regulators may act ex ante (before being alerted) for operators of essential services, but only ex post (after being alerted) for digital service providers. A neat distinction to remember.