DORA and Other EU Laws

DORA is one part of European Union financial regulation, and it applies from 17 January 2025, alongside sectoral laws that already govern banks, insurers, investment firms, payment institutions, and other financial entities. It does not repeal those laws, and it does not displace data protection law, contract law, or other general EU rules that touch a firm's systems and data. The practical task is therefore one of mapping: for a given service, which law imposes which duty, where duties overlap, and where a single control or record can satisfy more than one duty without confusing the duties themselves.

A payment institution offers a clear illustration, and it is only an illustration. Its authorisation and conduct duties come from payments law, its safeguarding and prudential duties come from its sectoral framework, its handling of personal data is governed by data protection law, and its digital operational resilience duties come from DORA. Each lens asks a different question about the same payment service, and a firm that answers only one lens will have an incomplete picture.

Sectoral laws set the conditions for authorisation, prudential soundness, conduct, and governance in each part of the financial sector, and many of them already contained outsourcing, risk management, and internal control expectations before DORA arrived. DORA adds a harmonised, cross-sectoral layer for digital operational resilience, with its own chapters on ICT risk, incidents, testing, third-party risk, and information sharing. Where a sectoral rule and DORA both touch outsourcing or ICT risk, the firm needs to read them together and to avoid treating compliance with one as automatic compliance with the other. The harmonised layer is valuable precisely because it creates a common language across sectors, but that common language still has to be translated into sector-specific governance and reporting arrangements.

Digital operational resilience work constantly touches personal data and contracts, so data protection law and contract law are never far away. Incident handling may involve personal data, information sharing arrangements must respect confidentiality and data protection requirements, and third-party risk work is carried out largely through contracts that set audit, access, security, and exit terms. DORA does not override those frameworks, and a contract clause or a sharing arrangement that ignores them will create a new problem while solving an old one. The practical discipline is to involve data and legal perspectives early, when an incident playbook, a sharing circle, or a provider contract is designed, rather than asking them to approve a finished design that already assumes an answer.

Beyond sectoral law, the European Union has other rules concerned with cybersecurity, critical infrastructure, and operational continuity, and DORA is designed to interact with them rather than to float free of them. The boundary with NIS2 is examined in its own guide in this cluster, since that boundary causes particular confusion for firms that straddle financial and non-financial activities. More generally, a firm should map which regime names it, which authority supervises it under each regime, and which service each regime is concerned with, before assuming that work done for one regime automatically satisfies another. Overlap in language, such as risk management or incident reporting, does not mean overlap in scope, criteria, or reporting channels.

The United Kingdom has its own operational resilience framework, supervised by the FCA and the PRA, and it is distinct from DORA, which is an EU regulation. A group with both EU and UK entities therefore needs to hold two pictures at once: DORA for its EU financial entities, and the UK framework for its UK entities, with group systems and providers potentially serving both. Similar words in the two frameworks, such as important business services in the UK context, do not make the frameworks interchangeable, and a record prepared for one regime should not be relabelled for the other without checking what each regime actually requires. The UK picture is a useful comparator for understanding DORA, but it is not a substitute for reading DORA itself.

A service by service map is again the most reliable tool. For each service, list the laws that touch it, the duty each law imposes, the authority that supervises that duty, and the record or control that evidences it. Where one record serves two duties, note both duties against it, so that a change in one law can be traced to the shared record. Where duties diverge, keep the records separate, even if the underlying work is similar, so that a supervisor under either regime can follow the reasoning. The map should be reviewed when any relevant law changes, when a new service is launched, or when a provider arrangement changes, because overlap is a moving picture, not a fixed diagram.