GDPR vs DORA
GDPR · DORA (Regulation (EU) 2022/2554) · data 2026-10-27
Requirement-level comparison of GDPR and DORA (Regulation (EU) 2022/2554), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 22 DORA (Regulation (EU) 2022/2554) requirements, 19 map to something in GDPR, 1 are only loosely related, and 2 have no mapping in our data.
DORA here means the articles that bind financial entities, mapped editorially at paragraph level. The technical standards that add detail, such as Delegated Regulation (EU) 2024/1774, are not mapped, so technical topics they cover show no link.
Likely new work: DORA requirements with no mapping to GDPR (2)
| DORA | Requirement | Match | GDPR | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 2 | ||||
| Art.7 | ICT systems, protocols and tools | No mapping in our data | — | No mapping to GDPR in our data. |
| Art.14 | Communication | No mapping in our data | — | No mapping to GDPR in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (1)
| DORA | Requirement | Match | GDPR | Evidence |
|---|---|---|---|---|
| Chapter VI: Information sharing · 1 | ||||
| Art.45 | Information-sharing arrangements on cyber threat information and intelligence | Art.35(1)Art.35(7) | Only shares CSF ID.RA-03: related, not a mapping | |
Mapped (19)
| DORA | Requirement | Match | GDPR | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 9 | ||||
| Art.5 | Governance and organisation | Editorial | Art.24(1)Art.32(2)Art.24(2)+4 | Same topic: Risk Management, Governance Policy (editorial pick) |
| Art.6 | ICT risk management framework | Editorial | Art.24(1)Art.32(2)Art.37(1)+3 | Same topic: Risk Management, Roles & Responsibilities (editorial pick) |
| Art.8 | Identification | Editorial | Art.30(1)Art.32(1)(d)Art.35(1)+1 | Same topic: Asset Management, Vulnerability Mgmt, Risk Assessment (editorial pick) |
| Art.9 | Protection and prevention | Editorial | Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)+2 | Same topic: Data Protection (editorial pick) |
| Art.10 | Detection | Editorial | Art.29Art.32(4) | Same topic: Insider Threat (editorial pick) |
| Art.11 | Response and recovery | Editorial | Art.32(1)(b)Art.33(1)Art.33(5)+1 | Same topic: Business Continuity, Incident Response (editorial pick) |
| Art.12 | Backup policies and procedures, restoration and recovery procedures and methods | Editorial | Art.32(1)(c) | Same topic: Backup & Recovery (editorial pick) |
| Art.13 | Learning and evolving | Editorial | Art.39(1)(b) | Same topic: Awareness & Training (editorial pick) |
| Art.16 | Simplified ICT risk management framework | Editorial | Art.24(1)Art.32(2) | Same topic: Risk Management (editorial pick) |
| Chapter III: ICT-related incidents · 3 | ||||
| Art.17 | ICT-related incident management process | Editorial | Art.33(1)Art.33(5) | Same topic: Incident Response (editorial pick) |
| Art.18 | Classification of ICT-related incidents and cyber threats | Editorial | Art.33(1)Art.33(5)Art.34(1) | Same topic: Incident Response, Reporting (editorial pick) |
| Art.19 | Reporting of major ICT-related incidents and voluntary notification of significant cyber threats | Editorial | Art.33(1)Art.34(1) | Same topic: Reporting (editorial pick) |
| Chapter IV: Resilience testing · 4 | ||||
| Art.24 | General requirements for the performance of digital operational resilience testing | Editorial | Art.24(1)Art.32(2) | Same topic: Risk Management (editorial pick) |
| Art.25 | Testing of ICT tools and systems | Editorial | Art.32(1)(d) | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.26 | Advanced testing of ICT tools, systems and processes based on TLPT | Editorial | Art.32(1)(d) | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.27 | Requirements for testers for the carrying out of TLPT | Editorial | Art.32(1)(d) | Same topic: Vulnerability Mgmt (editorial pick) |
| Chapter V: ICT third-party risk · 3 | ||||
| Art.28 | General principles | Editorial | Art.28(1)Art.28(3) | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Art.29 | Preliminary assessment of ICT concentration risk at entity level | Editorial | Art.28(1) | Same topic: Supply Chain Risk (editorial pick) |
| Art.30 | Key contractual provisions | Editorial | Art.28(1)Art.28(3) | Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) |
Of 13 GDPR requirements, 12 map to something in DORA, 0 are only loosely related, and 1 have no mapping in our data.
GDPR is a privacy law: only its security-related articles are mapped here, and all mappings are editorial.
Likely new work: GDPR requirements with no mapping to DORA (1)
| GDPR | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| Requirements · 1 | ||||
| Art.38 | Position of the data protection officer | No mapping in our data | — | No mapping to DORA in our data. |
Mapped (12)
| GDPR | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| Requirements · 12 | ||||
| Art.5 | Principles relating to processing of personal data | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d)+3 | Same topic: Data Protection (editorial pick) |
| Art.24 | Responsibility of the controller | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+5 | Same topic: Risk Management (editorial pick) |
| Art.25 | Data protection by design and by default | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| Art.28 | Processor | Editorial | Art.28(2)Art.28(3)Art.28(4)+6 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Art.29 | Processing under the authority of the controller or processor | Editorial | Art.10(3) | Same topic: Insider Threat (editorial pick) |
| Art.30 | Records of processing activities | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| Art.32 | Security of processing | Editorial | Art.9(3)(a)Art.9(4)(d)Art.9(4)(c)+18 | Same topic: Encryption, Access Control (editorial pick) |
| Art.33 | Notification of a personal data breach to the supervisory authority | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+4 | Same topic: Incident Response (editorial pick) |
| Art.34 | Communication of a personal data breach to the data subject | Editorial | Art.11(2)(e)Art.11(7)Art.18(1)+5 | Same topic: Comms & Restore, Reporting (editorial pick) |
| Art.35 | Data protection impact assessment | Editorial | Art.8(2)Art.8(3)Art.8(7) | Same topic: Risk Assessment (editorial pick) |
| Art.37 | Designation of the data protection officer | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| Art.39 | Tasks of the data protection officer | Editorial | Art.5(2)(c)Art.5(3)Art.6(4)+2 | Same topic: Roles & Responsibilities (editorial pick) |
By topic
Both cover (22):
Only GDPR (1):
Only DORA (17):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.