All news
Regulation May 15, 2026 11 min

NIS2 and GDPR: how to orchestrate them operationally after Italian Decree 138/2024. The DPO checklist for the NIS Operator

Italian NIS2 transposition (Legislative Decree 138/2024, effective October 16, 2024): the DPO does not directly manage NIS2 but must interface with the security structure to avoid compliance gaps

TL;DR for the DPO

If your client is an 'essential entity' or 'important entity' under NIS2 (e.g. healthcare, energy, banks, transport, cloud providers, online platforms), you MUST coordinate with the Security Manager/CISO on incident management processes. NIS2 requires initial notification within 24h to ACN; GDPR requires notification within 72h to the DPA. Same incident may trigger both regimes - the flow must be unified to avoid contradictions in statements.

What changes with Legislative Decree 138/2024

Legislative Decree 138/2024 of September 4, 2024 transposed in Italy the NIS2 Directive (EU 2022/2555). It is effective since October 16, 2024 but sanctions apply from January 1, 2026. The Italian National Cybersecurity Agency (ACN) is the competent authority for entity registration and incident notification reception. The new aspect vs NIS1: scope expanded to 18 sectors, including cloud platforms, datacenters, ICT-managed services, social networks.

18
NIS2 essential and important sectors
24h
Initial ACN notification
72h
GDPR DPA notification
10MEUR
Max essential sanction

The NIS2-GDPR relationship

  • NIS2: protects SECURITY OF NETWORK AND INFORMATION SYSTEMS. Focus on availability and integrity of essential services
  • GDPR: protects PERSONAL DATA of data subjects. Focus on confidentiality, integrity and accountability of natural persons' processing
  • Overlap: a security incident affecting personal data activates BOTH regimes. E.g. ransomware encrypting customer DB = NIS2 (availability compromised) + GDPR (data breach)
  • Cumulative sanctions: NIS2 up to 10M EUR / 2% turnover for essentials; GDPR up to 20M / 4%. CAN be cumulated for same event
  • Different authorities: ACN for NIS2, DPA for GDPR. They must coordinate but don't always do so timely

Operational checklist if your client is a NIS2 entity

  • Verify scope: is the client essential or important under Decree 138/2024?
  • ACN registration: has the client registered on the ACN portal?
  • Contact point: who is the NIS Coordinator? Is the appointment in writing?
  • Incident management policy: does it exist? Does it include a 'DPO coordination' chapter? Timing: within 4h of internal trigger the DPO must also be notified
  • Notification templates: have ACN and DPA notification templates been prepared? Are they consistent?
  • Tabletop exercise: has a multi-regime simulated incident been done in the last year?
  • Supplier chain: has the client mapped NIS2-critical suppliers (cloud, MSP, ICT) with appropriate contractual clauses?
  • Training: has management completed mandatory NIS2 training (art. 23)?

In DPO Workspace

The Events/Workflow section includes a 'Multi-regime NIS2 Incident' template that triggers automatically when a NIS2-flagged client reports an incident. Generates 24h ACN + 72h DPA checklist with separate but coordinated timing.

Official source:Italian Legislative Decree 138/2024 - NIS2 transpositionOfficial source:ACN - Italian National Cybersecurity Agency

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Regulation
nullathe decision on a worker taken by the algorithm alone, from 23 October

A dismissal decided by the algorithm is void: from 23 October in Italy

Published in Official Gazette no. 234 of 8 October 2026 and in force since 23 October, decree no. 179/2026 provides that final decisions on the employment relationship cannot be based solely on automated processing, that the worker may request an understandable explanation, and that decisions taken in breach are void. In parallel, AI systems affecting work organisation enter the risk assessment under Article 28 of decree 81/2008. For a DPO this is the rare case where the consequence is not economic but civil, and it changes how the check is framed.

Oct 08, 2026New 8 min
Regulation
3signals that make notification due

Poland's UODO: not every breach must be notified. Public-register data on one side, PESEL, health and financial data on the other

If an invoicing system leaks only a sole trader's name, business name, tax number and registered address, already public in the business register, risk is normally unlikely. If it also leaks the national ID number, purchase details revealing health, or financial data, notification is due. Either way, the decision goes into the internal register.

Oct 05, 2026New 5 min
Regulation
120days to charge you, not to fine you

The 120 days are not the deadline to fine you: they are the deadline to charge you

Anyone who built an appeal on the authority's delay should re-read the calendar. The Court clarifies three things: the complaint procedure and the sanctioning procedure are autonomous, so overrunning the nine-to-twelve months on the complaint does not extinguish the power to fine; the 120 days are for notifying the charge, not for imposing the fine; and they run from the «definitive finding», which is not the first notice but the moment the authority can assess every element — including the hearing of your side. After the charge, only the five-year limitation period remains.

Sep 20, 2026 7 min