Mission: reportable – A guide to the (many) cyber reporting deadlines

EU NIS2 Directive

The NIS2 Directive applies to 'essential' and 'important' entities across sectors including energy, transport, health, digital infrastructure, ICT service management, and public administration. Member States were required to transpose NIS2 by October 2024 (though phased national implementation remains ongoing in several jurisdictions).

The reporting structure follows a three-stage model:

• An early warning must be filed with the national CSIRT or competent authority within 24 hours of becoming aware of a significant incident.
• An incident notification containing an initial assessment, severity rating, indicators of compromise, and impact details must follow within 72 hours.
• A final report is due one month after the incident notification, or one month after resolution if the incident is still ongoing.
• Maximum penalties reach €10 million or 2% of global turnover for essential entities, and €7 million or 1.4% for important entities.

Back to top >

EU and UK GDPR

The GDPR's 72-hour notification requirement remains familiar to most practitioners, but it is worth restating alongside the newer regimes. Where a personal data breach is likely to result in a risk to individuals' rights and freedoms, controllers must notify the competent supervisory authority within 72 hours of becoming aware of the breach. Where notification is delayed beyond 72 hours, reasons for the delay must accompany it.

There is no formal final report deadline under the GDPR, although all breaches must be documented internally under Article 33(5). Where the breach poses a high risk to individuals, they must be informed without undue delay under Article 34.

Maximum fines under the EU GDPR stand at €20 million or 4% of global turnover; the UK GDPR equivalent is £17.5 million or 4%.

EU Medical Device Regulation (MDR)

Manufacturers of medical devices placed on the EU market face distinct reporting obligations under the MDR for serious incidents, being those that directly or indirectly led, might have led, or might lead to death, serious deterioration in health, or a serious public health threat.

The initial notification deadline depends on the severity:

• two days for incidents involving a serious public health threat;
• ten days for death or unanticipated serious deterioration in health; and
• 15 days for other serious incidents.

Reports must be made to the relevant national competent authority (for example, BfArM in Germany or the HPRA in Ireland). EUDAMED’s vigilance module is not yet mandatory, so national reporting channels continue to apply for now. Ongoing investigation and follow-up reports are required as directed by the competent authority under Article 89. Note that the EU MDR does not apply in Great Britain (where the UK Medical Devices Regulations 2002 apply, overseen by the MHRA), although it does apply in Northern Ireland.

Back to top >

EU Cyber Resilience Act (CRA)

The CRA applies to manufacturers of products with digital elements placed on the EU market, a broad category encompassing hardware and software, including mobile apps, firmware, sensors, consumer devices, and industrial IoT products.

Reporting is triggered when a manufacturer becomes aware of either an actively exploited vulnerability or a severe incident having an impact on the security of the product. An early warning must be submitted to ENISA and the designated national CSIRT simultaneously, via the new Single Reporting Platform, within 24 hours. A fuller notification with general information, initial assessment, and corrective/mitigating measures follows at 72 hours. For actively exploited vulnerabilities, a final report is due 14 days after a corrective measure becomes available; for severe incidents, the deadline is one month after the 72-hour notification.

The scope of ‘manufacturer’ is wider than it might first appear: importers and distributors who market a product under their own name or trademark, or who make a substantial modification to it, become manufacturers for CRA purposes and are subject to reporting obligations.

Penalties for failing to meet reporting duties are significant: up to €15 million or 2.5% of global annual turnover for the most serious infringements.

Back to top >

EU Digital Operational Resilience Act (DORA)

DORA imposes the tightest initial reporting window of any current regime. Financial entities (i.e., credit institutions, payment institutions, investment firms, insurance undertakings, crypto-asset service providers, and many others defined in Article 2(1)) must file an initial notification with their national competent authority within four hours of classifying an ICT-related incident as 'major', and in any event no later than 24 hours from first becoming aware. An intermediate report updating the classification, status, and impact must follow within 72 hours, with further intermediate reports required where significant developments occur. A final report including root cause analysis and remedial measures is due one month after the last intermediate report.

Practitioners should note that, where a financial entity falls within DORA's scope, DORA's ICT incident reporting obligations apply in place of (not in addition to) NIS2's incident reporting requirements, as DORA is treated as a sector-specific act under Article 4 of NIS2. All other regimes (GDPR, MDR, CRA) apply independently and may be triggered concurrently by the same event.

Back to top >

EU ePrivacy Directive and UK PECR

Both the EU ePrivacy Directive and the UK's Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) impose sector-specific breach notification duties on providers of publicly available electronic communications services. Under both regimes, a ‘personal data breach’ is a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data processed in connection with such a service.

All breaches must be notified; providers have no discretion to withhold notification. However, the timing differs: in the EU, notification is required within 24 hours of detection where feasible, with fuller details to follow within three days. In the UK, the Data (Use and Access) Act 2025 aligned the PECR deadline with UK GDPR, specifying 72 hours from becoming aware of the breach (previously, the position was 24 hours where feasible under Commission Regulation 611/2013, which no longer applies in the UK).

Where a breach is likely to harm individuals' personal data or privacy, both regimes require prompt notification to affected individuals, describing the breach, providing contact points, and recommending mitigation measures. This obligation is waived if the provider shows the relevant authority that technological protections (e.g., encryption) rendered the data unintelligible. The ICO (in the UK) may compel subscriber notification if the provider fails to act. Providers must also maintain a breach log recording facts, effects, and remedial action.

Penalty regimes differ. The Data (Use and Access) Act 2025 raised the general PECR cap from £500,000 to £17.5 million or 4% of global turnover. The ePrivacy Directive prescribes no specific penalty; Article 15a requires each Member State to set its own, so exposure varies by jurisdiction (e.g., in Ireland, an indictable offence carries a maximum €250,000 fine).

A single breach can engage both ePrivacy/PECR notification obligations and GDPR security and documentation requirements, each with separate penalty tracks. The ePrivacy Directive is lex specialis for notification, displacing GDPR Article 33 for in-scope providers. However, the underlying security failure may independently breach GDPR Article 32, and failures to document internally (Article 33(5)) or notify high-risk individuals (Article 34) may constitute further GDPR infringements.

Back to top >

UK NIS Regulations 2018

The NIS Regulations 2018 are the UK's current framework for network and information systems security, implementing the original EU NIS Directive. They apply to operators of essential services in sectors such as energy, transport, health, water, and digital infrastructure, as well as relevant digital service providers (online marketplaces, search engines, and cloud computing services).

Incidents that have a significant impact on continuity of service must be reported to the relevant competent authority (such as Ofgem, Ofcom, or the ICO, depending on sector) without undue delay and in any event no later than 72 hours after becoming aware of the incident. Operators of essential services report to their sector competent authority, while relevant digital service providers report to the ICO, which also recommends notifying the NCSC at the same time.

Failure to comply can result in fines of up to £17 million, though the maximum penalty is rarely imposed in practice.

Back to top >

On the horizon: The UK Cyber Security and Resilience Bill

The UK Cyber Security and Resilience Bill was introduced to Parliament on 12 November 2025 and represents an evolution of UK cyber legislation following the NIS Regulations 2018. The Bill cleared the House of Commons in June 2026 and is now progressing through the House of Lords, with Royal Assent expected imminently.

The Bill will expand the scope of the UK's NIS framework to cover managed service providers, data centres, and designated critical suppliers, and it introduces a two-stage incident reporting structure closely aligned with NIS2:

• an initial notification to the regulator within 24 hours of awareness, with a copy to the NCSC (as the UK CSIRT), followed by;
• a full report within 72 hours.

Notably, the Bill expands the definition of ‘incident’ to cover events ‘capable of having’ an adverse effect (a lower threshold than the current NIS Regulations), which will significantly increase reporting duties if maintained. Thresholds may yet be calibrated in secondary legislation following industry consultation. Whether that happens remains to be seen, and we will continue to monitor developments as the Bill progresses.

Organisations operating across both the UK and EU will need to assess reporting obligations separately under each regime.

Back to top >

Practical matters

The direction of travel appears to be that reporting windows are compressing, thresholds are broadening, and the number of bodies that must be notified is multiplying.

A single cyber incident could simultaneously trigger obligations under NIS2 (or DORA), GDPR, the MDR, and potentially the CRA, each with its own clock, recipient authority, and content requirements.

Organisations should ensure at a minimum that:

• Incident response plans map each applicable regime to a specific notification pathways and timelines;
• There are pre-built reporting templates aligned to each framework (these can save critical time in the midst of an incident); and
• Cross-functional tabletop exercises are carried out to simulate the full reporting sequence.

Finally, organisations should always be mindful of cyber insurance, and check whether policies impose any additional obligations.

If you would like help mapping your reporting obligations or stress-testing your incident response plan, please get in touch with our Data, Privacy & Cyber team.