ΕλληνικάA single intrusion can engage three European regimes with different triggers, different deadlines and different recipients. The hardest questions are not technical, and most of them have to be answered in the first day.
The common account of a cyber incident treats the legal work as something that follows the technical response. The sequence is usually the reverse. Within hours of detection an organization has to decide whether an event is reportable at all, under which instrument, to which authority, and from what moment the time runs. Those are legal questions, the answers differ between the instruments that may apply simultaneously, and an organization that reaches them late has already lost the only part of the timetable it controls.
Which regime applies, and the limits of the carve-out
The starting point is Directive (EU) 2022/2555, which applies to essential and important entities across the sectors in its annexes. For financial entities, however, Regulation (EU) 2022/2554 operates as the sector-specific instrument. The Directive itself contemplates this: where a sector-specific Union act imposes risk-management or incident-notification obligations that are at least equivalent in effect, those provisions apply to the entities concerned, and the Directive records that the Regulation is to be treated in that way for financial entities.
The carve-out is frequently described as though a financial entity is simply outside the Directive. That is too broad. The displacement operates by subject matter: it reaches the matters the sector-specific act regulates, and the Directive is capable of remaining relevant where it covers ground the Regulation does not, and where national transposing law adds obligations of its own. For a group containing both regulated financial entities and unregulated service companies, the practical consequence is that different members of the same group may sit under different regimes for the same incident, with different reporting duties, while sharing the same network and the same incident response team.
Three triggers that do not coincide
The second difficulty is that the instruments are triggered by different legal facts. The Directive is concerned with a significant incident, meaning one that has caused or is capable of causing severe operational disruption of services or financial loss to the entity, or that has affected or is capable of affecting others by causing considerable material or non-material damage. The Regulation is concerned with a major information and communication technology related incident, assessed against its own classification criteria. Regulation (EU) 2016/679 is concerned with a personal data breach, which is a different concept again and can be present where neither of the other two thresholds is met, as in a purely internal disclosure affecting a small number of records.
These are not three descriptions of the same thing. A ransomware event that halts production but touches no personal data may be significant without being a breach. An exfiltration of a customer database by a contractor may be a breach without disrupting any service. A single event can be any combination of the three, and the assessment has to be made separately against each, from the same facts, at a point when the facts are incomplete.
The clocks start at different moments
This is where most incident plans fail, because they assume one deadline.
Under the Directive, an entity must submit an early warning without undue delay and in any event within twenty-four hours of becoming aware of a significant incident, an incident notification within seventy-two hours of becoming aware, and a final report no later than one month after the notification. The clock therefore runs from awareness.
Under the Regulation the architecture is different. The initial notification is due within four hours of the incident being classified as major, subject to an outer limit running from detection, with an intermediate report following the initial notification and a final report following that. The trigger is classification, not awareness, which has an important consequence: classification is itself a legal act with timing effects, and because the outer limit runs from detection, an organization cannot extend its time by declining to classify.
Under Regulation (EU) 2016/679 the controller must notify the supervisory authority without undue delay and, where feasible, not later than seventy-two hours after having become aware of the breach, and must communicate to data subjects where the risk to their rights and freedoms is high. That clock runs independently of the other two and is owed to a different authority.
An entity within both the Regulation on digital operational resilience and the data protection regime may therefore be working to a four hour clock, a seventy-two hour clock and a separate communication duty, measured from different events, in the same afternoon.
Classification is a legal decision, not a technical one
It follows that the most consequential decision in the first hours is who classifies, and on what basis. Where classification sits with the technical team alone, two failures recur. The first is that the criteria applied are operational rather than legal, so an event is graded by its effect on systems rather than by its effect on the services, persons and data the instruments are concerned with. The second is that the decision is not recorded in a way that shows when it was made or on what information, which matters because the defensibility of a late notification usually turns on demonstrating when the entity became aware or ought to have classified.
The practical answer is to treat classification as a joint decision with a named legal owner, taken against written criteria drawn from the instruments rather than from an internal severity scale, and recorded with its time and its evidential basis. The record is part of the compliance position and should be created as the decision is taken, not reconstructed afterwards.
Privilege over the forensic report
Few questions are handled as poorly as the status of the forensic investigation. An organization under attack commissions an external forensic firm, the report lands some weeks later, and it contains the clearest available statement of what went wrong and what the organization had failed to do. That document will be sought by regulators, by insurers and, in due course, by claimants.
Whether legal professional privilege attaches is not a matter of labeling. Broadly, it depends on who commissioned the work, for what dominant purpose, to whom the report is addressed and how it is subsequently circulated. A report commissioned by the business for operational remediation, addressed to management and shared across the organization, is unlikely to be protected in any system merely because a lawyer was copied. The position also differs by forum. In the context of European Commission investigations the Court of Justice has held that privilege does not extend to communications with in-house counsel, a limitation that surprises groups which rely on an internal legal function, and national rules on privilege and on professional secrecy vary considerably in their scope and in the proceedings to which they apply.
The consequence for planning is specific rather than general. If the organization wants any prospect of protection, the instruction has to come from counsel, for the dominant purpose of advice or of anticipated proceedings, with a defined addressee and a controlled distribution list, and that structure has to be in place before the forensic firm is engaged. It cannot be applied retrospectively to a report that already exists. Equally, the organization should assume that some material will be disclosable and should avoid creating documents whose only function is to characterize fault before the facts are established.
Preservation, and its tension with data protection
Logs, forensic images, communications and decision records may be required later by a supervisory authority, an insurer or a court, and the obligation to preserve them sits uneasily beside the data protection principles of storage limitation and minimization. The tension is manageable but it has to be addressed deliberately: a legal hold should identify the categories held, the purpose and legal basis for retaining them, the access restrictions applied and the point at which the hold is reviewed. Preserving everything indefinitely is not a neutral choice, and deleting on the ordinary cycle during a live incident is worse.
The Greek layer
In Greece the Directive is transposed by Law 5160/2024, and the National Cybersecurity Requirements Framework for essential and important entities was established by ministerial decision 1689/2025, which sets out twenty-two requirements covering, among other things, risk analysis, incident handling, business continuity and supply chain security. Entities within scope register with the National Cybersecurity Authority, which also acts as the national computer security incident response team. Sanctions include administrative fines and, for the more serious cases, suspension of certifications and a temporary prohibition on individuals exercising management functions. That last measure is the one that tends to concentrate attention at board level, and it is a reason to ensure that the approval of risk-management measures is documented as a decision of the management body rather than as an IT matter.
What the matrix should actually contain
A notification matrix is worth preparing before an incident, and it is a legal document rather than a checklist. For each regime that could apply to the entity, it should record the legal trigger in the instrument’s own language, the event from which time runs, each deadline, the authority or person to whom the report is owed, the named individual responsible for making the assessment and the named individual who approves the filing, the content required at each stage, and the position on contractual and insurance notice duties, which often run to shorter periods than the regulatory ones and are commonly missed.
Two refinements make the difference between a document that is used and one that is filed. The first is to map the group, because the regime depends on the entity rather than the network, and the matrix should say which company reports what. The second is to record, for each regime, how the organization will evidence the moment of awareness or classification, since that is the fact on which the lawfulness of the timing will later be judged.
OIKONOMAKIS LAW advises companies on cybersecurity and operational resilience obligations, on incident governance and notification analysis, and on the contractual position with technology providers, and coordinates local counsel where an incident crosses borders. Contact leads@oikonomakislaw.com or +30 210 3600036.
Christos Oikonomakis, Chairman, OIKONOMAKIS LAW
This publication provides general legal and regulatory information and does not constitute legal advice on any individual matter. The position should be verified in relation to the specific facts and jurisdiction concerned.