DORA vs NIS2 vs GDPR — What's the Difference?

Updated 2026-08-257 min readCopy link

If you run a website that serves users in the European Union, you have probably heard three acronyms: GDPR, NIS2 and DORA. They all impose obligations on digital operations — but they apply to different entities, cover different risks, and require different things from your website.

This guide explains the differences in plain language, with a focus on what each regulation means for your website's compliance posture — and how to check all three with a single scan.

Quick references

• GDPR (General Data Protection Regulation, EU 2016/679) — In effect since May 2018. Applies to every organisation that processes personal data of EU residents.
• NIS2 (Network and Information Security Directive, EU 2022/2555) — In effect since October 2024. Applies to operators in critical and important sectors (energy, transport, health, digital infrastructure, and others).
• DORA (Digital Operational Resilience Act, EU 2022/2554) — In effect since January 2025. Applies to financial entities (banks, fintechs, investment firms) and their ICT third-party providers.

Comparison at a glance

1. GDPR — Everyone's data protection baseline

GDPR is the broadest of the three. It applies to any organisation that collects or processes personal data from individuals in the EU — regardless of where the organisation is based. This means a single-person blog in Canada with EU readers, a Shopify store in Australia, and a SaaS company in the US all need GDPR-compliant websites.

What GDPR requires on your website

• Privacy policy (Art. 13–14): Visible link on every page that collects data, explaining what data you collect, why, and with whom you share it.
• Cookie consent (ePrivacy + GDPR): Prior consent for non-essential cookies and trackers, with a clear opt-in mechanism.
• Data processing agreements (Art. 28): Required if you use third-party services that process personal data on your behalf (hosting, analytics, email marketing).
• Security measures (Art. 32): Appropriate technical and organisational measures — including HTTPS and security headers.
• Data breach notification (Art. 33–34): 72-hour notification window to supervisory authority and, in high-risk cases, to affected individuals.

Who enforces GDPR

Each EU member state's data protection authority (DPA). Examples: the Irish DPC, the French CNIL, the German DSK. Fines can reach €20 million or 4 % of global annual turnover — whichever is higher.

2. NIS2 — Security for critical sectors

NIS2 is narrower than GDPR. It targets essential and important entities in sectors such as energy, transport, banking, health, water, digital infrastructure, and public administration. If you operate a small e-commerce site, NIS2 likely does not apply to you directly — but if you provide ICT services to a NIS2-regulated entity, you may be covered.

What NIS2 requires

• Risk management measures (Art. 21): Including cybersecurity policies, incident handling, business continuity, supply chain security, and encryption.
• Incident reporting (Art. 23): Significant incidents must be reported within 24 hours (early warning), 72 hours (notification), and 1 month (final report).
• Supply chain security: NIS2 entities must assess the security of their ICT suppliers — which means if you sell SaaS to a bank, energy company, or hospital, you will face security questionnaires.
• Penalties: Up to €10M or 2 % of annual turnover for essential entities; lower thresholds for important entities.

How NIS2 affects your website

Even if you are not a NIS2 entity, if your customers are, your website and service become part of their supply chain. NIS2 pushes compliance requirements down the chain — so a compliance badge, documented security headers, and a published privacy policy are increasingly expected.

3. DORA — Financial-sector resilience

DORA is the most specific. It applies to financial entities — banks, investment firms, payment processors, insurance companies, and their ICT third-party providers. If your SaaS product serves a financial institution, DORA compliance will be in your contracts.

What DORA requires

• ICT risk management (Art. 5–16): A comprehensive framework covering identification, protection, detection, response, and recovery of ICT systems.
• Incident reporting (Art. 17–23): Major ICT-related incidents must be reported to competent authorities within deadlines comparable to NIS2's.
• Resilience testing (Art. 24–27): Regular threat-led penetration testing (TLPT) and vulnerability assessments.
• Third-party risk (Art. 28–32): Financial entities must monitor and assess ICT third-party providers — which includes cloud hosting, SaaS, and any outsourced ICT function.
• Business continuity (Art. 11): Plans, procedures, and backup arrangements for severe operational disruptions.

DORA on your website

Financial-sector websites should demonstrate operational resilience at minimum: published security headers, HTTPS enforcement, a documented incident-reporting channel (security.txt recommended), and a business-continuity or resilience statement available on the site.

Where they overlap

In practice, if you are compliant with GDPR Article 32 (security measures) and Article 28 (data processing agreements), you already meet a significant portion of NIS2 and DORA's baseline expectations for website security. The main additional areas are incident-reporting procedures, resilience testing, and published operational documentation.

What your website needs — across all three

Regardless of which regulation applies to your organisation, the following checks cover the common ground across GDPR, NIS2 and DORA's website-related expectations:

1. HTTPS with HSTS — TLS encryption and Strict-Transport-Security headers. Required by GDPR Art. 32 and recommended by NIS2 and DORA baseline security measures.
2. Cookie consent mechanism — A visible banner or widget that obtains prior consent for non-essential cookies and trackers. Required under GDPR and the ePrivacy Directive.
3. Privacy policy link — Clear and accessible privacy notice linked from your homepage and data-collection points. Required by GDPR Art. 13.
4. Legal pages — Imprint (impressum), terms of service, and where applicable an EAA accessibility statement. Required varies by jurisdiction, but increasingly expected under NIS2's transparency obligations.
5. Security headers — Content-Security-Policy (CSP), X-Content-Type-Options, Referrer-Policy, frame protection. OWASP baseline and recommended by all three frameworks.
6. Operational resilience signals — For entities under DORA or supplying to financial-sector clients: security.txt, business-continuity or ICT risk-management disclosure on your site.

Summary: Which regulation matters to you?

• Have a website with EU visitors? → GDPR applies. Start with the free scan.
• Run an energy, health, transport, or digital-infrastructure company? → NIS2 applies on top of GDPR.
• Run a bank, fintech, payment processor, or serve one? → DORA applies on top of both.
• Provide SaaS or ICT services to any of the above? → Compliance requirements will arrive in your procurement contracts, even if the regulation does not apply to you directly.

The most practical starting point for any organisation is to get the technical basics right: HTTPS, cookie consent, privacy policy, security headers. The free EUComply scan tells you exactly where you stand, and the current Pro license provides editable WordPress HTML document starters plus an HTML report from the latest scan.

How does EUComply compare with the established tools? See our head-to-head comparison — pricing, features and where each one falls short.