Compliance & Regulation
DORA Compliance: What Financial Entities Must Do
The Digital Operational Resilience Act brings ICT risk under direct financial supervision in the EU. What it requires and how to build a sustainable compliance programme.
Key takeaways
- Know what personal data you process, why and on what lawful basis.
- Maintain records of processing and run DPIAs for high-risk processing.
- Honour data subject rights within one month in most cases.
- Report qualifying breaches to the authority within 72 hours.
The checklist
| Area | What to have in place |
|---|---|
| Accountability | Policies, roles, DPO where required |
| Records of processing | Up-to-date RoPA |
| Lawful basis | Documented basis for each processing activity |
| Transparency | Clear privacy notices |
| Data subject rights | Process to handle requests within deadlines |
| DPIAs | Assessments for high-risk processing |
| Processors | Article 28 contracts and due diligence |
| International transfers | Adequacy, SCCs or other safeguards, with transfer assessments |
| Security | Appropriate technical and organizational measures |
| Breaches | Detection, assessment and 72-hour notification process |
| Retention | Defined retention periods and deletion |
Common gaps
- RoPA out of date or incomplete
- Marketing consent not properly recorded
- Processors without compliant contracts
- Retention periods defined but not enforced
- Data subject requests handled inconsistently
Evidence
Regulators and customers expect documented proof. Keep records of decisions, assessments, training and incident handling.
Data subject rights in practice
Individuals can request access, rectification, erasure, restriction, portability and objection. Build a single intake channel, verify identity proportionately, search all systems including SaaS and backups policies, and track every request to completion within the deadline. Templates and a request log provide the evidence regulators ask for.
International transfers after Schrems II
Transfers outside the EEA require an adequacy decision, standard contractual clauses or another valid mechanism, plus an assessment of the destination's legal environment where SCCs are used. The EU–US Data Privacy Framework provides an adequacy route for certified US organizations. Keep a transfer register alongside your RoPA.
A 60-day improvement plan
| Weeks | Focus |
|---|---|
| 1–2 | Refresh RoPA and data map |
| 3–4 | Review lawful bases, notices and consent records |
| 5–6 | Processor contracts and transfer assessments |
| 7–8 | DSR process test and breach simulation |
How NAZZTEC helps
We run GDPR gap assessments, build RoPA and DPIA processes, review processor contracts and manage privacy obligations alongside security frameworks in NAZZTEC AI GRC.
Next step: see NAZZTEC Privacy on our product roadmap or talk to our GRC team.
Frequently asked questions
Do we need a DPO?
Required for public authorities and organizations whose core activities involve large-scale monitoring or special-category data; others may appoint one voluntarily.
How quickly must we respond to an access request?
Within one month, extendable by two further months for complex or numerous requests.
What are the maximum fines?
Up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
