Skip to content
Dueline
Menu
HelpHow deadlines are counted

How deadlines are counted

Every deadline Dueline shows is worked out by one engine, the same one the free calculator runs, from the legal text of each rule. This page lists how it counts and every report each rule asks for. To read the deadlines on a work item, start with Read the deadlines.

How a deadline is counted

  • From the time you became aware of it (for DORA’s first report, from the classification as major, and no later than 24 hours after you became aware, as Art. 5 of Delegated Regulation 2025/301 says).
  • Hours are exact hours. One month is the same time on the same date of the next month, or the last day of that month when the date does not exist. Where the law can be read two ways, Dueline shows the earlier of the two readings.
  • A report that runs from an earlier one starts when that one is recorded as sent.

The reports

GDPR (Regulation 2016/679, Art. 33 and 34), to the supervisory authority.

  • Notification to the supervisory authority: without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk people’s rights. After 72 hours it comes with the reasons for the delay.
  • Communication to the people affected: without undue delay, only when the risk to them is high.
  • Breach register (Art. 33(5)): no deadline. Dueline lists what was recorded; it is not the documentation Art. 33(5) asks you to keep.

NIS2 (Directive 2022/2555, Art. 23), to the national CSIRT or competent authority.

  • Early warning: within 24 hours.
  • Incident notification: within 72 hours, or 24 for a trust service provider.
  • Intermediate report: on request, no deadline.
  • Final report: one month after the notification. If the incident is still ongoing then, a progress report is due that day and the final report one month after the incident is handled.

DORA (Regulation 2022/2554, Art. 19, and Delegated Regulation 2025/301, Art. 5), to the competent authority.

  • Initial notification: within 4 hours from classifying the incident as major and no later than 24 hours from becoming aware. Classified more than 24 hours after awareness, 4 hours from the classification.
  • Intermediate report: 72 hours after the initial notification, even when nothing has changed.
  • Final report: one month after the latest intermediate report.

CRA (Regulation 2024/2847, Art. 14), on ENISA’s single reporting platform.

  • An exploited vulnerability: an early warning within 24 hours, a notification within 72 hours, an intermediate report on request, and a final report 14 days after a fix or mitigation is available.
  • A severe incident: an early warning within 24 hours, a notification within 72 hours, an intermediate report on request, and a final report one month after the notification.

DORA and weekends

A DORA deadline that falls on a weekend, in your country’s time zone, may move to noon of the next working day. Dueline shows that later time beside the strict one (“or by …”) and counts a report late only after it. The rule does not move the initial and intermediate reports of credit institutions, central counterparties, trading venues and NIS2 entities: an admin says so in Settings. Bank holidays are not built in, so a deadline Dueline shows can be earlier than the law allows, never later. A competent authority may also rule the move out for a significant entity.

The Dueline panel on a DORA work item, aware Fri 23 Oct 21:30, with “Updated just now” and Recalculate in its top right corner: DORA initial notification is late by 5 d. The report goes to Finanstilsynet, reported on Virk.dk with a MitID Erhverv login. The initial notification is due Sat 24 Oct 02:30, or by Mon 26 Oct 13:00, Late by 5 d with “Give the reasons for the delay” and a Record as sent button. The intermediate report is Waiting for the initial notification, the final report Waiting for the intermediate report. Under the table, the small print, the note about reminders, and the note that Dueline does not move a deadline for a bank holiday, so its time may be earlier than the law allows, never later; then an Open in Dueline link.
A DORA report due on a Saturday, with the later time the weekend rule allows

National law may be stricter than the EU rule, as NIS2 allows. Check yours.