On this page
GDPR protects personal data and the people it relates to. NIS2, through the Swedish Cybersecurity Act, protects network and information systems in critical sectors. For organisations covered by both, the requirements on risk management, incidents and suppliers overlap - but deadlines and recipients differ.
Purpose and differences
GDPR applies to all processing of personal data, regardless of industry and size. The Cybersecurity Act only applies to organisations in certain sectors, usually from medium size, but covers all information and systems the services rely on - not just personal data. An outage without personal data can therefore be a NIS2 issue but not a GDPR issue, and a misdirected email can be a GDPR issue but not a NIS2 issue.
Who is covered?
In practice, every organisation covered by the Cybersecurity Act is also covered by GDPR, since it processes personal data about employees and customers. The reverse is not true. Start by determining whether you are covered by the Cybersecurity Act - GDPR you need to handle either way.
Take the self-testIncident reporting - two recipients, different deadlines
The same event can trigger both reporting chains:
- GDPR: personal data breach to IMY without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk. If the risk is high, data subjects must also be informed.
- Cybersecurity Act: significant incident to CERT-SE with an early warning within 24 hours, incident notification within 72 hours and a final report within one month.
- Reporting to one authority does not replace reporting to the other.
Risk analysis and measures you can do once
Both frameworks are built on appropriate, risk-based security measures. The same asset inventory, risk analysis, access control, logging, backups and continuity planning can serve both - and the GDPR record of processing is a good start for mapping what information lives where. What differs is the perspective: GDPR assesses the risk to individuals, the Cybersecurity Act the risk to the organisation's services.
GDPR record of processingSuppliers and processors
GDPR requires data processing agreements and that you only use processors providing sufficient guarantees. The Cybersecurity Act requires security across the whole supply chain, including suppliers that don't handle personal data. Combine both in one supplier follow-up: one register, one risk classification and the same security questions.
Management responsibility
Under GDPR, responsibility lies with the controller as an organisation. The Cybersecurity Act goes further and points to management: it must approve the risk-management measures and undergo training, and in essential entities a member of management can be temporarily prohibited from exercising managerial functions. Both frameworks include administrative fines.
Management responsibility under the Cybersecurity ActHow to coordinate the work
A practical setup:
- One incident routine with a decision step for each framework: is it a personal data breach? Is it a significant incident?
- One risk analysis where each risk is assessed both for individuals and for the services.
- One supplier register covering both processor agreements and security requirements.
- An annual review for management covering both frameworks.
Want to see it with your own organisation?
Getting started as a customer takes a few minutes. You choose frameworks, answer at your own pace and build compliance step by step - without consultancy fees.