We are delighted to share an important milestone in the continued development of KG Legal’s Data, AI & Cybersecurity Desk.

It has been a great honour to serve as the exclusive expert contributors for Poland to the OneTrust DataGuidance Privacy Overview – Poland, one of the world’s leading professional legal compliance resources relied upon by in-house counsel, privacy professionals, compliance officers, multinational organisations and technology companies operating across multiple jurisdictions.

Preparing this contribution was a long-term project that required several months of intensive legal analysis, research and editorial work. Our objective was not simply to describe the application of the GDPR in Poland. Instead, we sought to create a practical and comprehensive guide reflecting the significant transformation of the Polish regulatory landscape that has taken place in recent years as a result of new European legislation and its implementation into Polish law.

The publication therefore extends far beyond a traditional overview of Polish data protection law. It examines the interaction between privacy, digital regulation, cybersecurity and artificial intelligence, providing readers with practical guidance on the most important legal developments affecting organisations operating in Poland.

Our contribution discusses, among other things:

• the practical application of the GDPR within the Polish legal system;
• the powers and regulatory practice of the Polish supervisory authority for personal data protection;
• employee monitoring and workplace privacy;
• cookies, consent mechanisms and online tracking technologies;
• electronic communications and direct marketing requirements;
• international data transfers;
• personal data breaches and notification obligations;
• practical compliance with Polish privacy legislation;
• cybersecurity-related regulatory developments;
• the growing interaction between data protection and artificial intelligence governance.

A particularly important aspect of this work was addressing the rapidly evolving legislative environment. During the last few years, Poland has experienced substantial regulatory changes resulting from the implementation of numerous European legal instruments and the entry into force of directly applicable EU regulations that significantly affect organisations processing personal data.

Accordingly, the publication takes into account the practical implications of the evolving European digital regulatory framework, including the interaction between the GDPR and newer legal instruments governing digital services, artificial intelligence, cybersecurity and data governance. The analysis also reflects the impact of the AI regulatory framework, developments concerning data governance and electronic communications, as well as the increasingly interconnected compliance obligations facing businesses operating in today’s digital economy.

Rather than presenting legislation in isolation, the publication adopts a practical, compliance-oriented perspective. It combines:

• the GDPR and Polish implementing legislation;
• guidance issued by the European Data Protection Board (EDPB);
• the jurisprudence of the Court of Justice of the European Union;
• decisions and regulatory guidance published by the Polish Personal Data Protection Office (UODO);
• recent Polish legislative developments and market practice.

Our ambition was to create a resource that would assist both international and domestic organisations in navigating one of the fastest-changing areas of European regulation, where privacy law increasingly intersects with cybersecurity, AI governance, digital platforms, online communications and emerging technologies.

The contribution was prepared by Małgorzata Kiełtyka and Jakub Gładkowski, whose combined experience covers complex cross-border advisory work in data protection, artificial intelligence, life sciences, healthcare, technology law, cybersecurity, intellectual property and regulatory compliance.

https://www.dataguidance.com/experts-directory/Jakub_G%C5%82adkowski

https://www.dataguidance.com/experts-directory/Malgorzata_Kieltyka

For many years, Małgorzata Kiełtyka has advised international companies on GDPR compliance, healthcare regulation, AI governance, technology transactions and cross-border regulatory matters. Her practice combines strategic legal advice with practical implementation of compliance frameworks for multinational businesses operating in highly regulated sectors.

Jakub Gładkowski focuses on data protection, digital regulation, cybersecurity, intellectual property, IT law and emerging technologies. His practice includes advising innovative businesses on regulatory compliance, digital transformation projects and the implementation of European technology legislation affecting both public and private sector organisations.

Being entrusted with preparing Poland’s national contribution to OneTrust DataGuidance represents an important recognition of our team’s expertise and international standing. We are particularly proud that this publication reflects not only our experience in privacy law, but also our broader interdisciplinary approach, integrating data protection with AI regulation, cybersecurity, digital compliance and technology law.

We sincerely thank the editorial team at OneTrust DataGuidance for their confidence in our expertise and for the opportunity to contribute to a publication that supports legal and compliance professionals around the world.

For KG Legal, this publication marks another significant milestone in the continued growth of our Data, AI & Cybersecurity Desk and reinforces our commitment to delivering practical, business-oriented legal advice at the intersection of privacy, technology and innovation.

Artykuł A Major Milestone for KG Legal’s Data, AI & Cybersecurity Practice: Exclusive Poland Contribution to OneTrust DataGuidance pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The Act amending the Act on the National Cybersecurity System aims to implement Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 (NIS Directive 2) and the partial application of Commission Delegated Regulation (EU) 2024/1366 of 11 March 2024 supplementing Regulation (EU) 2019/943 of the European Parliament and of the Council.

The amendment to the KSC Act significantly expands the scope of the regulations and introduces new obligations in the field of cybersecurity management. The changes include, among other things, the implementation of risk management systems and expanded incident reporting requirements. The new regulations also strengthen the powers of supervisory authorities and significantly increase the maximum amount of financial penalties. It also introduces liability for the management staff (manager) of an entity. In practice, this requires certain entities to take steps to comply with the new regulations.

The first experiences of entrepreneurs after the amendment came into force – practical conclusions

The few months that the amended Act on the National Cybersecurity System has been in effect demonstrate that the biggest challenge for businesses is no longer the analysis of the new regulations, but their practical implementation. For many organizations, the adaptation process began with a seemingly simple task: determining whether a given entity is even subject to the new regulations. In practice, this step proves to be one of the most problematic.

Under the previous legal framework, many businesses awaited a formal administrative decision confirming their status as an essential service operator. This approach is no longer appropriate. The status of a key or important entity stems directly from the Act, and obligations arise regardless of whether the business has already been entered on the register. This means that the responsibility for properly assessing their own situation rests primarily with the business itself.

Practice also shows that many companies focus solely on the issue of being entered into the register of key and important entities. However, entry itself is not the purpose of the regulation. The greatest challenges remain the actual implementation of an information security management system, conducting a risk analysis, developing incident response procedures, and adequately documenting the actions taken. In the future, supervisory authorities will primarily assess an organization’s actual level of compliance with the Act, not merely the formal fulfillment of registration obligations.

Another significant change is the significant increase in management responsibility. Management can no longer treat cybersecurity as a matter solely within the purview of IT departments. The Act requires active management involvement in the organization of the cybersecurity management system, oversight of its operation, and provision of adequate organizational and financial resources. In practice, this requires regular reporting on cybersecurity issues at the management level and documentation of decisions made.

Supply chain security is also becoming increasingly important. Businesses are required not only to secure their own IT systems but also to consider the risks arising from collaboration with IT service providers, cloud computing operators, software vendors, and outsourcing providers. In practice, this means reviewing supplier contracts, verifying the security measures in place, and implementing appropriate provisions for incident management and crisis cooperation.

It’s also noticeable that a growing number of businesses are choosing to conduct internal compliance audits before the statutory deadlines expire. This approach allows for early identification of organizational and technical gaps, reducing the risk of subsequent violations and costly remedial actions.

In practice, the best solution is to treat the implementation of the Act’s requirements not as a one-time project, but rather as a process encompassing regular risk analysis, procedure updates, employee training, and ongoing oversight of the organization’s security. This approach not only increases compliance but also significantly reduces the risk of cybersecurity incidents.

It’s worth emphasizing that the current transition period should be used to calmly prepare organizations for the full application of the new regulations. Postponing implementation until the final months before the statutory deadlines expire can be risky, especially for large organizations where implementing information security management systems requires the involvement of multiple departments and adequate time to prepare procedures and documentation.

Change in the circle of entities to which the Act applies.

Under the previous wording of the Act, an administrative decision was required to recognize an entity as an essential service operator (Article 5 of the Act before the amendment). Currently, the group of key and important entities is determined automatically (ex lege). The criteria for qualifying an entity as essential are found in Article 5, Section 1, and as an important entity in Article 5, Section 2 of the Act. It is possible that an entity meets the criteria for both key and important entities; such an entity is considered a key entity under Article 5, Section 4. When attempting to qualify entities, the Act also refers to EU regulations, particularly Regulation 651/2014/EU, which defines SMEs. Therefore, the primary criteria taken into account will be the number of employees and annual turnover. It is also necessary to refer to Annexes 1 and 2 of the Act, which precisely define the categories of entrepreneurs in specific sectors and subsectors.

The added Article 5a in paragraph 1 provides that key and important entities are subject to the obligations arising from the Act if they reside in the territory of the Republic of Poland or conduct their business in the territory of the Republic of Poland.

Articles 7 et seq. regulate matters related to the list of key and important entities. Before the amendment, the list contained only operators of essential services; now it includes key and important entities. Unlike the previous legal status, in which entry was made at the request of the authority responsible for cybersecurity (former wording of Article 7, paragraph 3 of the Act), entry is now made at the request of a key or important entity within six months of the occurrence of the conditions (Article 7c, paragraph 1 of the Act). Ex officio entry will generally only apply to existing operators of essential services, trust service providers, telecommunications companies, and public entities. This means that for entities meeting the conditions on the date the amendment comes into force, the deadline for submitting an application is October 3, 2026. Pursuant to the Announcement of the Minister of Digitization of April 8, 2026, regarding the schedule for submitting applications for entry in the register of key and important entities and for key or important entities to commence using the ICT system , self-registration on the list is possible from May 7, 2026, to October 3, 2026. The platform operating in the S46 system is available at https://wykaz-ksc.gov.pl/ . By April 3, 2027, key and important entities are required to commence using the ICT system specified in Art. 46 sec. 1 of the Act. This deadline begins depending on whether the entities were parties to agreements regarding the use of the ICT system referred to in Art. 46 sec. 1 of the Act concluded before April 3, 2026. For the former, the possibility of using the system was opened on April 8, 2026, and for the latter, this possibility will be available from June 12, 2026 (point 2 of the Communication of the Minister of Digital Affairs).

If an entity that meets the criteria for being considered a key or important entity fails to submit an application for entry, the authority responsible for cybersecurity may enter the entity on the list ex officio (Article 7j, paragraph 1 of the Act). Failure to comply with certain obligations related to the list (failure to timely complete missing data on the list or failure to correct data despite a request or failure to submit an application for entry) may result in the imposition of a substantial fine (Article 73, paragraph 1, point 1 and Article 73, paragraph 1a, point 1 of the Act). The catalogue of data to be included on the list has also been changed (expanded) (Article 7, paragraph 2).

In practice: The expansion of the scope of entities and the shift from administrative decision-making to automatic regulation mean that many entities may be subject to the Act without formal confirmation of this status. In practice, independent qualification analysis and continuous monitoring of compliance with statutory criteria become crucial. An incorrect assessment (or failure to comply) may result in exposure to sanctions (severe fines).

New responsibilities for cybersecurity management.

Duties

Chapter 3, which governs the obligations of key and important entities, has been expanded, and Chapters 3a and 3b have been added, addressing domain name registration service providers and public entities. Article 8 of the Act governs obligations related to the implementation of an information security management system. Compared to the previous legal framework, numerous obligations have been added. The responsibility of the manager of a key or important entity for the performance of its cybersecurity obligations has been introduced (Article 8c of the Act), and the manager’s responsibilities have also been defined (Articles 8d–8f of the Act).

The regulations regarding incident reporting have also changed. A key or important entity classifies a given incident as serious (after meeting the requirements of Article 2, Section 7 of the Act), then issues an early warning, reports the incident, and finally submits a final report on the handling of the serious incident to the CSIRT (a three-step reporting model instead of the previous one-step model – Article 11 of the Act).

Deadlines

Pursuant to Article 15 of the Act, key entities must conduct a security audit of the information system used in the service provision process at least once every three years. For key entities that were not previously classified as key service operators, the first audit should be conducted within 24 months of the date the conditions are met (Article 16, point 2, therefore, for these entities, the deadline for conducting the audit is April 3, 2028).

The Act amending the KSC Act establishes a 12-month transition period during which key and important entities have time to fulfill the obligations specified in Chapter 3 of the Act (except for the obligation to conduct the first audit, which entities have 24 months to conduct). Therefore, with respect to obligations such as implementing an information security management system, risk assessment, implementing technical and organizational measures, reporting and managing incidents, and verifying personnel’s criminal records, the deadline for compliance with these regulations expires on April 3, 2027.

In practice: The imposed obligations require the implementation of an information security management system. Furthermore, the single-tier incident reporting system has been changed, replaced by a more complex three-tier system. Essential entities will be required to conduct audits. Importantly, entities that were not previously considered essential service operators will be required to conduct an audit within two years of the amendment’s entry into force. However, most of the new obligations will have to be implemented by April 3, 2027. Failure to comply with these obligations will result in the manager of the relevant entity being held liable.

Change in the amount and grounds for imposing fines.

Until April 2, 2026, the maximum amount of the fine imposed on entities (only for the most serious violations) was PLN 1 million (former wording of Article 73, paragraph 5 in fine). Currently, the maximum amount of the fine is, as a rule, EUR 10 million (Article 73, paragraph 3 of the Act), and for the most serious violations, up to PLN 100 million (Article 73, paragraph 5 in fine of the Act).

With the imposition of a large number of obligations on key and important entities, the list of violations for which a fine may be imposed has also been expanded (Article 73 of the Act).

The new provisions on fines come into force only two years after the entry into force of the Act (i.e. from April 3, 2028).

In practice: Increasing the amount of fines disciplines key entities and important entities to take their cybersecurity obligations very seriously. It is worth emphasizing, however, that the amended regulations on fines will not enter into force until April 3, 2028.

Changes in the supervision and control of key and important entities.

Chapter 11 of the Act, which deals with the supervision and control of key and important entities, has been significantly expanded. Some provisions remain unchanged (the requirement to apply the provisions of the Entrepreneurs’ Law or the Act on Audit in Government Administration, the powers of the person conducting the audit, most of the obligations of audited entities, and provisions regarding audit protocols and post-audit recommendations).

Important changes

The most important changes in the scope of supervision include a significant expansion of Article 53, which describes the powers of the authority responsible for cybersecurity regarding supervision and oversight of key entities. It empowers the competent authority to issue various types of administrative decisions aimed at enforcing the provisions of the Act. This article also contains a number of procedural provisions defining the nature of the proceedings. Generally, the regulations contained in this article apply only to key entities, but as stated in Article 53, paragraph 17, certain provisions also apply to inspections of important entities. Article 53, paragraph 3 states that supervision of key entities is both post-empty and preventive, while for important entities, supervision is only post-empty.

A new obligation for both key and important entities is the information obligation specified in Article 53c, which requires a key or important entity to provide certain data at the request of the authority responsible for cybersecurity.

A new institution is the ad hoc review added in Article 59c, which may be carried out only if the conditions specified in the cited Article are met.

In practice: Strengthening the powers of supervisory authorities and introducing ad hoc inspections means increased risk of inspections and the need to maintain constant readiness to demonstrate compliance with regulations. Entities should also prepare for more frequent requests for information from authorized bodies.

Minor changes

Chapter 10 has been amended and Chapters 10a – 10c have been added, but they do not contain any standards addressed to entities and are therefore not relevant from a practical point of view.

Several changes concern Chapter 12 concerning the Government Plenipotentiary for Cybersecurity and the Cybersecurity Board, but these changes do not have any significant impact on the entities.

Article 12a has been added, addressing specific measures to ensure cybersecurity at the national level. It primarily contains provisions on recommendations from the Government Plenipotentiary for Cybersecurity (Article 67a), the procedure for designating a supplier as a high-risk supplier (Articles 67b–67f), and a safeguarding order in the event of a critical incident (Articles 67g–67i).

Minor changes also apply to the Cybersecurity Strategy of the Republic of Poland (Articles 68–72). The changes primarily concern the content and method of developing the strategy, as well as the frequency of strategy reviews (2.5 years instead of the previous 2 years).

The amendment to the Act on the National Emergency Response Plan creates the basis for the adoption of the National Emergency Response Plan (Articles 72a – 72f of the Act).

Recommended actions.

In light of the amendments to the Commercial Companies Code, entities subject to the new regulations should take steps to ensure their operations are in compliance with the law. It is recommended that:

1)      Self-identification in order to determine whether a given entity qualifies as a key or important entity within the meaning of the Act.

2)      Implementation or update of an information security management system.

3)      Development of procedures for identifying and reporting incidents, taking into account the new procedure.

4)      Ensuring the involvement of management staff, e.g. the manager’s implementation of the obligations under Article 8d or 8e.

5)      Preparing the organization for potential supervisory activities, e.g. inspections.

• Action:

ex officio entries carried out by the Minister of Digital Affairs (current key service operators, trust service providers, telecommunications companies and public entities)

• Deadline:

April 13 – May 6, 2026

• Action:

self-registration in the list of key and important entities

• Deadline:

May 7 – October 3, 2026

• Action:

launching the possibility of using the S46 system for new entities

• Deadline:

June 12, 2026

• Action:

end of the deadline for starting to use the S46 system and implementing obligations (end of the adjustment period)

• Deadline:

April 3, 2027

• Action:

the first ISMS audit (for key entities that were not key service operators) and the beginning of the application of the provisions on penalties

• Deadline:

April 3, 2028

Artykuł NIS2 in Poland: Practical Implications of the New Cybersecurity Framework for Businesses pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

Publication date: July 07, 2026

– the first edition of a new nationwide event dedicated to the defence, security and resilience of the state

On June 19-20, 2026, representatives of our law firm will participate in the Warsaw Defense Trade Fair (WTO 2026), which will be held at the EXPO XXI Exhibition Center in Warsaw. This is the first edition of a completely new trade fair and conference event, created in response to the growing importance of the defense sector, national security, and technologies supporting Poland’s institutional, economic, and social resilience. The fair is held under the honorary patronage of the Ministry of Interior and Administration and the Minister of National Defense. The event is informally referred to as a “mini-MSPO in Warsaw” – a capital city-based, intimate alternative to the September International Defense Industry Fair in Kielce, open not only to professionals but also – on the second day – to the general public.

The goal of the Warsaw Defense Fair is to integrate key groups responsible for national security and to create a space for dialogue, collaboration, and exchange of experiences between public administration, the military, uniformed services, the defense industry, the technology sector, the investor community, and military universities. The event combines exhibition, conference, and networking elements , creating a platform for showcasing modern technologies, exchanging expert knowledge, and building business relationships in one of the fastest-growing sectors of the Polish economy.

The trade fair program is divided into two complementary days, representing one of the most distinctive solutions adopted by the organizers. Friday, June 19, 2026, will be an industry day (B2B/B2G), intended exclusively for companies, institutions, and business partners. Industry registration is required. This day will be a platform for meetings and discussions between individuals and entities interested in establishing cooperation in the defense and security sector, including representatives of public administration and local governments, soldiers and uniformed services, representatives of companies in the defense and technology sectors, investors, industry advisors, and representatives of military universities. The program focuses on key challenges facing the defense and national security sectors, including conferences, panel discussions, and business and institutional meetings concerning the development of the Polish defense industry, modernization of the Armed Forces, public procurement in the defense sector, and cross-sectoral cooperation.

Saturday, June 20, 2026, will be an open day (B2B/B2G/B2C), also open to the public interested in security, defense, and shooting. The second day significantly complements the industry portion and expands the event to include the general public, as well as educational and outreach communities. It will feature demonstrations of equipment and technologies in near-operational settings, demonstration zones by exhibitors and manufacturers, presentations of solutions in cybersecurity, drones, communications, and critical infrastructure protection, as well as numerous lectures for enthusiasts. Topics covered include firearms licenses – myths and legal realities, training and shooting sports, hearing and eye protection, safety and ergonomics at the shooting range, and civic preparedness for crisis situations.

Exhibitors and thematic scope

Over 100 exhibitors will be present at the fair, representing a full cross-section of entities active in the Polish defense and security sector. Exhibitors include military units such as the 1st Warsaw Armored Brigade and the 18th Capital Territorial Defense Brigade, international technology companies, including 3M Poland, which presents personal protection solutions for the defense sector, and Artec 3D with 3D scanners used in military applications. The shooting and equipment segment will be strongly represented, with companies such as House of Guns , Hubertus Pro Hunting , Kaliber, 4HUNTING, Kolba, 4SHOOTER, Son of Gun , Jammas , and Wolfer. Group and Works11. The event is also partnered by the Legia Warsaw Central Military Sports Club – Shooting Section.

The exhibition covers cutting-edge weapons, equipment, facilities and technologies used in the defense and security sector: unmanned systems and drones, cybersecurity solutions, tactical communications and communication technologies, critical infrastructure protection, personal protective equipment, 3D scanning and simulation technologies, individual soldier equipment, as well as solutions in the area of civil defense and population protection.

Three conference stages and a substantive agenda

The WTO 2026 program will unfold simultaneously across three conference stages. The industry day will be dedicated to the most important strategic challenges facing the defense sector – the technical modernization of the Polish Armed Forces, the development of the domestic arms industry, cooperation with foreign partners, public procurement in the defense sector, new dual-use technologies , and the role of the private sector in building national resilience. The second day, open to the public, will feature lectures and discussions covering a much broader range of topics – from legal issues concerning access to weapons and individual security, through shooting sports and defense training, to preparing society for crisis situations and disseminating knowledge about modern defense technologies.

The significance of the event from a legal perspective

The establishment of the Warsaw Defense Fair is part of the broader context of the dynamic development of the Polish defense sector, which in recent years has become one of the most important areas of public and private investment, generating significant demand for legal services. From the firm’s perspective, issues related to public procurement in the defense sector, regulations regarding trade in arms and dual-use technologies, export controls, protection of classified information, cybersecurity in the context of the NIS2 directive, intellectual property rights in defense technology projects, and financing of projects from European funds (including the European Defense Fund and ASAP), as well as the development of regulations regarding artificial intelligence in military applications in light of the European AI Act . The participation of representatives of the KG LEGAL KIEŁTYKA GŁADKOWSKI law firm in this event is a natural element of tracking the development of one of the fastest-growing sectors of the Polish economy and building competences in the area of law related to new defense technologies.

The Warsaw Defense Fair 2026 demonstrates that security and defense are no longer the exclusive domain of the military and state administration. They have become an area of broad cross-sectoral cooperation, with technology companies, investors, academia, non-governmental organizations, and informed citizens playing key roles. The development of this sector today requires not only advanced technological competencies but also an appropriate legal, regulatory, and institutional environment.

Link to the event: https://wto26.exposupport.pl/program

#WarsawDefenceExpo #WTO2026 #WarszawskieTargiObronne #DefenceIndustry #DefenseIndustry #DefenceExpo #DefenseExpo #PolishDefenceIndustry #PolishArmedForces #NationalSecurity #StateResilience #CivilDefence #HomelandSecurity #DefenceTechnology #DefenseTech #MilitaryTechnology #MilitaryInnovation #DualUseTechnology #DefenceProcurement #PublicProcurement #ArmsTrade #ExportControl #ClassifiedInformation #CyberSecurity #NIS2 #CriticalInfrastructure #InfrastructureProtection #UnmannedSystems #Drones #UAV #TacticalCommunications #PersonalProtectiveEquipment #3DScanning #AIinDefence #AIAct #ArtificialIntelligence #EuropeanDefenceFund #EDF #ASAP #IntellectualProperty #DefenceIP #TerritorialDefence #WOT #ArmedForces #MilitaryModernization #SportShooting #FirearmsLaw #WeaponsPermits #ShootingSports #RangeSafety #CrisisPreparedness #EmergencyPreparedness #Resilience #B2B #B2G #EXPOXXI #Warsaw #Warszawa #Poland #MONRP #MSWiA #MiniMSPO #DefenceConference #SecurityConference #LegalTech #LawFirm #KGLegal #KieltykaGladkowski

Artykuł Representatives of our law firm KG LEGAL KIEŁTYKA GŁADKOWSKI will take part in the Warsaw Defence Fair 2026 pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

In an era of dynamic digital technology development and a growing number of cyberthreats, cybersecurity and personal data protection are becoming key aspects of how organizations operate in the European Union. New regulations, such as NIS2, DORA, AI Act, CRA, and eIDAS 2.0, combined with the current GDPR, create a comprehensive security system aimed at raising protection standards and ensuring greater transparency in data processing.

NIS2 and GDPR: Strengthening Data Protection and Incident Response

The Network and Information Security Directive (NIS2) is another step towards increasing the cyber resilience of entities operating in key economic sectors. In 2025, its implementation will require organizations to take a number of actions, including:

• Expanding security measures against cyberattacks,
• Introducing more rigorous incident reporting procedures,
• Strengthening cooperation between supervisory authorities and the private sector.

NIS2, in conjunction with GDPR (Regulation 2016/679), means that businesses will not only have to protect personal data more effectively, but also implement new procedures for risk management and auditing of IT security activities.

5 Things You Need to Know About NIS2

01 – Fines up to €10 million or 2% of total annual global turnover

02 – Expanded scope compared to NIS1, changing the way companies are classified and requiring more of them to comply with the directives

03 – Management staff is liable for violations and the authorities may suspend activities or functions

04 – Broad security risk management measures and shift to a risk-based approach

05 – Initial reporting of security incidents within 24 hours, further action within 72 hours, and final summary within 1 month

DORA: Cyber Resilience and Personal Data Security in Finance

DORA is the Regulation of the European Parliament and of the Council (EU) of 14 December 2022 on the digital operational resilience of the financial sector. This is another of many recent regulations concerning cybersecurity and the broadly defined security of information technology.

The Digital Operational Resilience Act (DORA) focuses on the financial sector, which is particularly vulnerable to cyberattacks. Key requirements imposed by DORA include:

• Testing the operational resilience of IT systems,
• Implementing risk management strategies based on threat analysis,
• Obligation to monitor and report digital incidents.

DORA applies to:

1. credit institutions;
2. payment institutions, including payment institutions exempted under Directive (EU) 2015/2366;
3. providers of account information access services;
4. electronic money institutions, including electronic money institutions exempted under Directive 2009/110/EC;
5. investment companies;
6. crypto-asset service providers,
7. central securities depositories;
8. central counterparties;
9. trading systems;
10. transaction repositories;
11. alternative investment fund managers;
12. management companies;
13. information sharing service providers;
14. insurance and reinsurance undertakings;
15. insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries;
16. institutions of occupational pension programs;
17. rating agencies;
18. administrators of critical benchmarks;
19. crowdfunding service providers;
20. securitization repositories;
21. external ICT service providers.

In the context of GDPR compliance, financial institutions must ensure adequate security measures to protect customer data against unauthorized access and information leakage. GDPR also mandates cooperation with cloud service providers and external IT operators, which requires thorough verification of their security standards.

Article 33 of the DORA Directive requires personal data breaches to be reported without undue delay, and within 72 hours where possible. In the event of a delay, an explanation of the reason for the delay must be included.

AI Act and GDPR: Managing Artificial Intelligence and Data Protection

The AI Act regulations classify AI systems according to risk level and impose obligations on entities that implement them. In the context of data protection, the AI Act requires:

• Transparency of artificial intelligence algorithms and mechanisms,
• Possibilities of controlling and auditing decisions made by AI,
• Compliance with the principles of data minimization and limitation of the processing purpose.

Companies that use AI to process personal data will have to meet stringent GDPR requirements, giving users greater control over their information and minimizing the risk of abuse.

CRA: Cyber Resilience Act – Security of Digital Products

The Cyber Resilience Act (CRA) introduces obligations related to the security of digital software and hardware. Its key requirements include:

• Designing secure digital products,
• Monitoring vulnerabilities and updating them regularly,
• Manufacturers’ responsibility to ensure continued safety throughout the product life cycle.

CRA aims to increase cybersecurity across the entire digital ecosystem, minimizing the risk of attacks based on device and application vulnerabilities.

eIDAS 2.0: Strengthening digital identification

The amendment to the eIDAS (electronic IDentification, Authentication and trust Services) regulation – known as eIDAS 2.0 – introduces a European digital identity wallet that:

• Allows citizens to securely store and share their identity data,
• It enables public and private institutions to provide secure online services,
• Strengthens authentication standards in digital transactions.

In conjunction with GDPR, eIDAS 2.0 improves users’ control over their identity data and increases the security of online transactions.

Challenges and benefits of new regulations

Adapting to new regulations poses numerous challenges for companies, including:

• The need to invest in modern security systems,
• Employee training in cybersecurity and data protection,
• Implementation of effective incident monitoring and reporting mechanisms.

However, the new regulations also bring numerous benefits, such as:

• Better protection of customer data and greater trust in the organization,
• Increased resistance to cyber attacks,
• Possibility to avoid high fines for violating data protection regulations.

The impact of new regulations on small and medium-sized enterprises (SMEs)

New regulations such as NIS2, DORA, AI Act, CRA, and eIDAS 2.0 can pose challenges for small and medium-sized enterprises (SMEs). Implementing these regulations requires investment in modern security systems and employee training in cybersecurity and data protection. SMEs may face challenges related to limited financial and human resources, which can make it difficult to fully comply with the new requirements.

However, compliance with these regulations also brings benefits, such as better protection of customer data, increased trust in the organization, and the ability to avoid significant fines for violating data protection regulations. Therefore, it is worthwhile for SMEs to consider partnering with external IT service providers and cybersecurity specialists to effectively implement the required security measures.

The future of cybersecurity in the EU

In the coming years, we can expect further development of regulations regarding cybersecurity and personal data protection. The European Union will continue to work on strengthening the legal framework to address growing cyber threats and ensure a high level of data protection. Organizations will need to be prepared to continuously adapt to new requirements and invest in modern security technologies and procedures.

Summary

In 2025, organizations will have to comply with a range of regulations regarding cybersecurity and personal data protection. NIS2, DORA, AI Act, CRA, and eIDAS 2.0, combined with the GDPR, create a modern legal framework aimed at improving data protection and increasing resilience to cyber threats across various economic sectors. Implementing these regulations will be a challenge, but also an opportunity, to build a more secure and digitally resilient business environment in the EU.

Artykuł Cybersecurity and GDPR Compliance in 2025 pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.