EU law does not list one fixed set of security controls. It requires "appropriate technical and organisational measures" for the risk, and tells you who to notify, and how fast, when something goes wrong.
GDPR Article 32: security of processing
Taking into account the state of the art, costs and the risks to people, you must protect personal data with measures such as pseudonymisation and encryption, the ability to ensure ongoing confidentiality, integrity, availability and resilience, the ability to restore data quickly after an incident, and regular testing of how well your measures work.
Breach notification
- GDPR: notify your data protection authority within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk (Article 33). Tell the people affected when the risk to them is high (Article 34).
- NIS2 (Directive (EU) 2022/2555): essential and important entities must send an early warning within 24 hours of a significant incident, a notification within 72 hours, and a final report within one month. Read what NIS2 auditors ask first.
Other EU security laws
- NIS2 applies to medium and large organisations in sectors such as energy, transport, health, digital infrastructure, cloud and managed services, and to some smaller ones designated by national authorities. Management bodies are responsible for approving and overseeing cybersecurity measures.
- Cyber Resilience Act (Regulation (EU) 2024/2847): products with digital elements, including software sold in the EU, must be secure by design. Manufacturers must report actively exploited vulnerabilities and severe incidents from 11 September 2026; most other obligations apply from 11 December 2027.
- DORA (Regulation (EU) 2022/2554): since 17 January 2025, financial entities must manage ICT risk, report major incidents and oversee their critical ICT providers.
Website security checklist
- HTTPS everywhere, with HSTS and a valid certificate.
- Security headers: Content-Security-Policy, X-Content-Type-Options, X-Frame-Options or frame-ancestors, Referrer-Policy.
- Patch the CMS, plugins, server and dependencies on a schedule, and urgently for exploited flaws.
- Phishing-resistant multi-factor authentication for every admin account.
- Least privilege for staff, plugins and API keys; remove accounts nobody uses.
- Immutable backups that you have actually tested restoring.
- Logging and alerts on admin logins and changes, kept long enough to investigate.
- A written incident plan with the 24-hour and 72-hour deadlines and who calls whom.
This guide is general information about EU rules, not legal advice. Requirements can differ by country and by business: check with your data protection authority or a lawyer for your case.