In the first hours of an incident?
Speak to counsel — +351 919 497 920 — monitored outside working hours · first steps01What it is
DORA governs the digital operational resilience of the financial sector. It replaces a patchwork of national and sectoral expectations with one directly applicable regime covering ICT risk, incident reporting, testing and — its most consequential feature — third-party risk.
Its reach extends beyond financial entities themselves: the contractual requirements bind ICT providers, and those designated critical fall under direct Union oversight.
02Who it applies to
A wide range of financial entities: credit institutions, payment and electronic money institutions, investment firms, crypto-asset service providers, insurers and intermediaries, pension institutions, trading venues, and others.
And, indirectly but substantially, the ICT third-party service providers that serve them — including cloud providers, software vendors and managed service providers.
03Core obligations
04Timeline
05Where it meets the other regimes
DORA ↔ NIS2
DORA is lex specialis for financial entities: where it applies, it displaces the equivalent NIS2 obligations. The difficulty is at the boundary — an ICT provider serving both financial and non-financial clients may be in scope of both regimes for different parts of its business.
DORA ↔ GDPR
A major ICT incident under DORA is frequently also a personal data breach under the GDPR, with a different classification test, a different deadline and a different authority. The two reports are not interchangeable and should not be drafted as one.
DORA ↔ the contract
Most of DORA's third-party requirements are delivered through contract. Agreements signed before 2025 rarely contain what the Regulation now requires, and renegotiation is where the practical work sits.
06What we are instructed on
DORA scope and gap analysis, the register of information, ICT contract review and renegotiation, incident classification and reporting, and governance.
Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.