Digital Operational Resilience Act (DORA) and Data Protection: Ensuring Data Integrity
Reading Time: 4 minutes
Authors:
Trilateral Research |
Date: 24 July 2024
The Digital Operational Resilience Act (DORA) represents a significant step forward in the European Union's (EU) regulatory framework, focusing on cybersecurity posture and operational resilience of financial institutions. This legislation comes at a time when cyber threats are becoming more sophisticated, and the need for robust data protection mechanisms is more critical than ever. This article explores the relationship between DORA and data protection regulations, emphasising how DORA supports data protection efforts in financial institutions.
For senior executives in the financial sector, understanding and implementing the provisions of DORA is critical. The strategic implications are multifaceted, impacting risk management, Information and Communication Technology (ICT), third-party service provider governance, and cross-border operations.
Understanding DORA
DORA, adopted by the EU in December 2022, aims to establish a comprehensive regulatory framework to ensure the digital operational resilience of the financial sector against ICT risks. It encompasses a wide range of entities, including banks, insurance companies, investment firms, and critical third-party service providers. DORA's primary objective is to ensure that financial entities can withstand, respond to, and recover from all types of ICT-related disruptions and threats.
The Relationship Between DORA and Data Protection Regulations
Harmonisation with GDPR
One of the key aspects of DORA is its alignment with existing data protection regulations, particularly the EU General Data Protection Regulation (GDPR). While GDPR focuses on protecting personal data and ensuring privacy rights, DORA addresses the broader scope of digital operational resilience. They both pursue the goal of ensuring confidentiality, integrity and availability, albeit from different perspectives.
1. Protection of Personal Data
| DORA | GDPR | |
| Requirements | Introduction of strong security measures for ICT systems that process financial data (some of which will be personal data.) | Regulations on the processing, storage and protection of personal data. |
| Similarity | Both regulations mandate the implementation of security measures to ensure that personal data is secured against unauthorised access, loss, or misuse. *DORA has more specific measures on security, whereas for GDPR security is just one of its principles, open for firms to implement. | |
2. Notification of Security incidents
| DORA | GDPR | |
| Requirements | Requires financial entities to report ICT security incidents to the relevant supervisory authorities within a short period of time. | Mandates firms to report data breaches, which pose risk to the rights and freedoms of data subjects, to supervisory authorities within 72 hours. |
| Similarity | Both emphasise rapid notification of incidents to decrease impact of those affected. Firms must have mechanisms in place to make sure data breaches and incidents are reported. | |
3. Risk Management
| DORA | GDPR | |
| Requirements | Development and implementation of ICT risk management to identify, assess and manage risks. | Data Protection Impact Assessments (DPIAs) are required for processing operations that pose high risk to the rights and freedoms of data subjects. |
| Similarity | Both require systematic risk management that includes the identification and assessment of risks. | |
4. Controls and audits
| DORA | GDPR | |
| Requirements | Regular review and auditing of ICT risk management and security processes. | Mandates firms to regularly review compliance with data protection regulations and to carry out data protection audits. |
| Similarity | Both require regular reviews and audits to ensure the effectiveness of the measures implemented. | |
Regulatory Convergence
DORA also aligns with other EU regulations such as the Network and Information Security Directive (NIS2) and the Digital Markets Act (DMA). DORA operates alongside NIS2, which is a broader legislative framework for cybersecurity across various public sectors. DORA provides specific rules for financial entities that take precedence over the more general provisions of NIS2. This harmonisation is designed to avoid duplicative regulatory requirements for financial entities. We at Trilateral have also focused on NIS2 compliance, which you can read here.
How DORA Supports Data Integrity and Protection Efforts
DORA is built on five foundational pillars that aim to create a robust ICT risk management framework:
1. Risk Management
DORA mandates financial institutions implement robust risk management frameworks that address ICT-related risks. This includes regular risk assessments, incident reporting, and the development of contingency plans. By identifying and mitigating risks, financial institutions can ensure the confidentiality, integrity and availability of their data.
2. Incident Reporting and Response
DORA mandates a systematic approach to managing and reporting ICT incidents, ensuring transparency and accountability. Additionally, financial institutions must develop and test their incident response plans regularly, ensuring they are prepared to handle any cybersecurity incidents and any resultant data breaches effectively.
3. Third-Party Risk Management
Financial institutions increasingly rely on third-party service providers for various ICT services. DORA mandates managing third-party risks by conducting due diligence and continuous monitoring of third party service providers. Such work entails ensuring that third parties comply with the same data protection and security standards.
4. Digital Operational Resilience Testing
To maintain a high level of digital operational resilience, DORA requires financial institutions to conduct continuous monitoring and testing of their ICT systems. This includes regular vulnerability assessments, penetration testing, and security audits. This way financial institutions can identify and address vulnerabilities before they are exploited, ensuring the ongoing confidentiality, integrity and availability of their data.
5. Information Sharing Mechanism
DORA encourages collaboration and knowledge sharing among entities, fostering a community-based approach to cybersecurity and compliance. This involves setting up channels both within the organisation and with external entities for information sharing on cyber threats.
In order to support compliance with these enhanced information security requirements, senior leaders should consider the following steps:
- Conduct a thorough assessment of current ICT systems and identify gaps relative to DORA’s requirements.
- Engage in strategic planning to address identified gaps and enhance overall digital operational resilience.
- Establish a governance framework that embeds resilience in the firm’s culture and assigns clear roles and responsibilities for resilience efforts.
- Foster relationships with third-party service providers for mutual understanding and compliance with DORA’s standards.
In conclusion, DORA is not merely a regulatory requirement but a strategic enabler for the financial sector in recognition of its worth and our strong dependence on financial entities. In the face of increasing cyber threats and a rapidly evolving digital landscape, DORA provides a blueprint for financial entities to bolster their defences and ensure the stability and integrity of EU’s financial system. For senior leaders, the act is a clarion call to elevate digital operational resilience as a core component of their strategic agenda.
While implementing measures to comply with DORA, by the 17 of January 2025 deadline, may seem challenging, our data protection and cyber-risk service have a wealth of experience assisting organisations improve their security posture and prepare for regulatory change. Our auditors can design and implement a robust cyber-security governance framework, as well as support your organisation with the implementation of any other DORA requirements. If you would like to discuss our services, please contact our advisors.
