NIS and NIS2 Directives and Data Protection

Question 1

Which factors determine whether a regulated organization is classified as an "essential entity" rather than an "important entity" under the NIS2 Directive?

The specific type of critical infrastructure operated and the historical frequency of cyber incidents. The sector of the economy in which it operates combined with its overall enterprise size. The level of cross-border data transfers and the organization's reliance on cloud service providers. The volume of personal data processed combined with the annual global turnover of the business.

Correct Answer: The sector of the economy in which it operates combined with its overall enterprise size.

The NIS2 Directive classifies regulated organizations as essential or important entities based on the criticality of their sector combined with their enterprise size, specifically targeting large enterprises in highly critical sectors.
Personal data volume and turnover relate to GDPR penalty tiers rather than NIS2 scopes. Historical cyber incidents do not determine statutory entity classification under the directive. Cross-border data transfers and cloud reliance are operational details rather than primary legislative criteria for defining entity types.
Key concept: Entity classification criteria under the NIS2 Directive.

Question 2

According to the NIS2 Directive, how should an entity handle a cybersecurity incident that also constitutes a personal data breach?

The entity fulfills its obligations by solely notifying the designated national cybersecurity authority. The entity must notify both the cybersecurity authority under NIS2 and the data protection authority under the GDPR. The entity must submit a consolidated report exclusively to the lead data protection supervisory authority. The entity prioritizes the NIS2 notification and delays the GDPR notification until the threat is mitigated.

Correct Answer: The entity must notify both the cybersecurity authority under NIS2 and the data protection authority under the GDPR.

The correct answer is right because the NIS2 Directive clearly states that its incident reporting requirements are without prejudice to the GDPR, meaning dual reporting is mandatory when an incident involves personal data.

Notifying only the cybersecurity authority ignores the mandatory data breach notification requirements under the GDPR. Submitting a report exclusively to the data protection authority fails to comply with the separate cybersecurity reporting obligations under NIS2. Delaying the GDPR notification is incorrect because organizations must strictly adhere to the 72 hour reporting window mandated by the GDPR regardless of other ongoing investigations.

The key concept tested is the overlapping incident reporting obligations under NIS2 and the GDPR.

Question 3

What is the primary scope of entities regulated by the NIS2 Directive for cybersecurity risk-management and reporting obligations?

Public authorities and data controllers processing special categories of personal data. Essential and important entities operating in critical sectors across the EU. Digital platforms offering goods and services to consumers within the EU. Cloud service providers and technology hardware manufacturers based outside the EU.

Correct Answer: Essential and important entities operating in critical sectors across the EU.

The correct answer accurately reflects that the NIS2 Directive applies to medium and large organizations classified as essential and important entities within critical sectors like energy, transport, and health across the Union.

Regulating data controllers processing special categories of personal data falls under the General Data Protection Regulation. Focusing solely on foreign technology manufacturers ignores the broader sectoral scope of the directive. Targeting digital platforms offering goods and services to consumers is the primary focus of the Digital Services Act rather than this cybersecurity framework.

The key concept tested is the regulatory scope of the NIS2 Directive.

NIS and NIS2 Directives and Data Protection

CIPP/E - NIS and NIS2 Directives and Data Protection Example Questions

Question 1

Question 2

Question 3

Master European Data Privacy Law

Other Introduction to European Data Protection concepts