Comparison

GDPR vs NIS2

GDPR · NIS2 Implementing Regulation (EU) 2024/2690 · data 2026-10-27

Requirement-level comparison of GDPR and NIS2 Implementing Regulation (EU) 2024/2690, in both directions, derived from published crosswalks and ControlMapping's curated topics.

Have GDPR → need NIS2

49 reqs

29 mapped · · 11 no mapping Open in gap view →

Of 49 NIS2 Implementing Regulation (EU) 2024/2690 requirements, 29 map to something in GDPR, 9 are only loosely related, and 11 have no mapping in our data.

NIS2 here is the technical measures of Implementing Regulation (EU) 2024/2690, which applies directly to digital-infrastructure and ICT-service providers; other NIS2 entities follow their country's transposition of Article 21. Incident reporting deadlines (Article 23) are not in scope. ENISA's mapping is non-binding.

Likely new work: NIS2 requirements with no mapping to GDPR (11)

NIS2	Requirement	Match	GDPR	Evidence
3. Incident handling · 2
3.2	Monitoring and logging	No mapping in our data	—	No mapping to GDPR in our data.
3.6	Post-incident reviews	No mapping in our data	—	No mapping to GDPR in our data.
6. Security in acquisition, development and maintenance · 3
6.4	Change management, repairs and maintenance	No mapping in our data	—	No mapping to GDPR in our data.
6.6	Security patch management	No mapping in our data	—	No mapping to GDPR in our data.
6.9	Protection against malicious and unauthorised software	No mapping in our data	—	No mapping to GDPR in our data.
11. Access control · 2
11.3	Privileged accounts and system administration accounts	No mapping in our data	—	No mapping to GDPR in our data.
11.7	Multi-factor authentication	No mapping in our data	—	No mapping to GDPR in our data.
12. Asset management · 2
12.1	Asset classification	No mapping in our data	—	No mapping to GDPR in our data.
12.5	Deposit, return or deletion of assets upon termination of employment	No mapping in our data	—	No mapping to GDPR in our data.
13. Environmental and physical security · 2
13.2	Protection against physical and environmental threats	No mapping in our data	—	No mapping to GDPR in our data.
13.3	Perimeter and physical access control	No mapping in our data	—	No mapping to GDPR in our data.

Check these: only loosely related (a shared CSF outcome, not a mapping) (9)

NIS2	Requirement	Match	GDPR	Evidence
3. Incident handling · 1
3.4	Event assessment and classification	Loosely related	Art.33(1)Art.33(5)	Only shares CSF RS.MA-02, RS.MA-03, RS.MA-04: related, not a mapping
6. Security in acquisition, development and maintenance · 3
6.3	Configuration management	Loosely related	Art.28(1)	Only shares CSF PR.PS-01: related, not a mapping
6.7	Network security	Loosely related	Art.28(1)	Only shares CSF PR.IR-01: related, not a mapping
6.8	Network segmentation	Loosely related	Art.28(1)	Only shares CSF PR.IR-01: related, not a mapping
10. Human resources security · 2
10.1	Human resources security	Loosely related	Art.29 Art.32(4)Art.39(1)(b)	Only shares CSF GV.RR-04, PR.AT-02: related, not a mapping
10.3	Termination or change of employment procedures	Loosely related	Art.29 Art.32(4)	Only shares CSF GV.RR-04: related, not a mapping
11. Access control · 2
11.4	Administration systems	Loosely related	Art.25(2)Art.32(1)(b)	Only shares CSF PR.AA-05: related, not a mapping
11.6	Authentication	Loosely related	Art.25(2)Art.32(1)(b)	Only shares CSF PR.AA-05: related, not a mapping
13. Environmental and physical security · 1
13.1	Supporting utilities	Loosely related	Art.28(1)Art.28(3)Art.5(2)	Only shares CSF DE.CM-06, ID.RA-10, GV.OC-03: related, not a mapping

Mapped (29)

NIS2	Requirement	Match	GDPR	Evidence
1. Policy on the security of network and information systems · 2
1.1	Policy on the security of network and information systems	Editorial	Art.24(2)	Same topic: Governance Policy (editorial pick)
1.2	Roles, responsibilities and authorities	Editorial	Art.37(1)Art.39(1)	Same topic: Roles & Responsibilities (editorial pick)
2. Risk management policy · 3
2.1	Risk management framework	Editorial	Art.24(1)Art.32(2)Art.35(1)+1	Same topic: Risk Management, Risk Assessment (editorial pick)
2.2	Compliance monitoring	Editorial	Art.5(2)	Same topic: Compliance (editorial pick)
2.3	Independent review of information and network security	Editorial	Art.5(2)	Same topic: Compliance (editorial pick)
3. Incident handling · 3
3.1	Incident handling policy	Editorial	Art.33(1)Art.33(5)	Same topic: Incident Response (editorial pick)
3.3	Event reporting	Editorial	Art.33(1)Art.34(1)	Same topic: Reporting (editorial pick)
3.5	Incident response	Editorial	Art.33(1)Art.33(5)	Same topic: Incident Response (editorial pick)
4. Business continuity and crisis management · 3
4.1	Business continuity and disaster recovery plan	Editorial	Art.32(1)(b)Art.32(1)(c)	Same topic: Business Continuity, Recovery Planning, Disaster Recovery (editorial pick)
4.2	Backup management	Editorial	Art.32(1)(c)	Same topic: Backup & Recovery, Disaster Recovery (editorial pick)
4.3	Crisis management	Editorial	Art.32(1)(b)Art.34(1)	Same topic: Business Continuity, Comms & Restore (editorial pick)
5. Supply chain security · 2
5.1	Supply chain security policy	Editorial	Art.28(1)Art.28(3)	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)
5.2	Directory of suppliers and service providers	Editorial	Art.28(1)Art.28(3)	Same topic: Vendor Risk Mgmt (editorial pick)
6. Security in acquisition, development and maintenance · 4
6.1	Security in acquisition of ICT services, ICT systems or ICT products	Editorial	Art.28(1)Art.28(3)	Same topic: Supply Chain Risk, Cloud Security, Vendor Risk Mgmt (editorial pick)
6.2	Secure development life cycle	Editorial	Art.25(1)	Same topic: Secure Development (editorial pick)
6.5	Security testing	Editorial	Art.32(1)(d)	Same topic: Vulnerability Mgmt (editorial pick)
6.10	Vulnerability handling and disclosure	Editorial	Art.32(1)(d)	Same topic: Vulnerability Mgmt (editorial pick)
7. Assessing the effectiveness of cybersecurity risk-management measures · 1
7.1	Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	Editorial	Art.24(1)Art.32(2)	Same topic: Risk Management (editorial pick)
8. Basic cyber hygiene practices and security training · 2
8.1	Awareness raising and basic cyber hygiene practices	Editorial	Art.39(1)(b)	Same topic: Awareness & Training (editorial pick)
8.2	Security training	Editorial	Art.39(1)(b)	Same topic: Awareness & Training (editorial pick)
9. Cryptography · 1
9.1	Cryptography	Editorial	Art.32(1)(a)Art.34(3)(a)	Same topic: Encryption (editorial pick)
10. Human resources security · 2
10.2	Verification of Background	Editorial	Art.29 Art.32(4)	Same topic: Insider Threat (editorial pick)
10.4	Disciplinary process	Editorial	Art.29 Art.32(4)	Same topic: Insider Threat (editorial pick)
11. Access control · 3
11.1	Access control policy	Editorial	Art.25(2)Art.32(1)(b)	Same topic: Access Control (editorial pick)
11.2	Management of access rights	Editorial	Art.25(2)Art.32(1)(b)	Same topic: Access Control (editorial pick)
11.5	Identification	Editorial	Art.25(2)Art.32(1)(b)	Same topic: Access Control (editorial pick)
12. Asset management · 3
12.2	Handling of assets	Editorial	Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)	Same topic: Data Protection (editorial pick)
12.3	Removable media policy	Editorial	Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)	Same topic: Data Protection (editorial pick)
12.4	Asset inventory	Editorial	Art.30(1)	Same topic: Asset Management (editorial pick)

Have NIS2 → need GDPR

13 reqs

12 mapped · · 1 no mapping Open in gap view →

Of 13 GDPR requirements, 12 map to something in NIS2, 0 are only loosely related, and 1 have no mapping in our data.

GDPR is a privacy law: only its security-related articles are mapped here, and all mappings are editorial.

Likely new work: GDPR requirements with no mapping to NIS2 (1)

GDPR	Requirement	Match	NIS2	Evidence
Requirements · 1
Art.38	Position of the data protection officer	No mapping in our data	—	No mapping to NIS2 in our data.

Mapped (12)

GDPR	Requirement	Match	NIS2	Evidence
Requirements · 12
Art.5	Principles relating to processing of personal data	Editorial	12.2 12.3 2.2+1	Same topic: Data Protection, Compliance (editorial pick)
Art.24	Responsibility of the controller	Editorial	2.1 7.1	Same topic: Risk Management (editorial pick)
Art.25	Data protection by design and by default	Editorial	6.2 11.1 11.2+1	Same topic: Secure Development, Access Control (editorial pick)
Art.28	Processor	Editorial	5.1 5.2 6.1	Same topic: Supply Chain Risk, Vendor Risk Mgmt, Cloud Security (editorial pick)
Art.29	Processing under the authority of the controller or processor	Editorial	10.2 10.4	Same topic: Insider Threat (editorial pick)
Art.30	Records of processing activities	Editorial	12.4	Same topic: Asset Management (editorial pick)
Art.32	Security of processing	Editorial	9.1 4.1 4.3+10	Same topic: Encryption, Business Continuity (editorial pick)
Art.33	Notification of a personal data breach to the supervisory authority	Editorial	3.1 3.3 3.5	Same topic: Incident Response, Reporting (editorial pick)
Art.34	Communication of a personal data breach to the data subject	Editorial	3.3 4.3 9.1	Same topic: Reporting, Comms & Restore, Encryption (editorial pick)
Art.35	Data protection impact assessment	Editorial	2.1	Same topic: Risk Assessment (editorial pick)
Art.37	Designation of the data protection officer	Editorial	1.2	Same topic: Roles & Responsibilities (editorial pick)
Art.39	Tasks of the data protection officer	Editorial	1.2 8.1 8.2	Same topic: Roles & Responsibilities, Awareness & Training (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.

GDPR vs NIS2

Have GDPR → need NIS2

Have NIS2 → need GDPR

By topic