Where to report an incident in the EU, by country

Every report goes to a body that depends on your country, and on your sector for DORA. Dueline shows the one for your main establishment next to each rule, once you pick the country in Settings; this page lists them all.

Check before you file. Each entry was read from the authority’s own page on the day shown, and authorities move their forms. An entry marked “Not checked yet” has not been read against the authority’s page: use the official list. Dueline sends nothing: you file, then record it.

CRA has one platform for the whole EU, ENISA’s Single Reporting Platform, reached through the coordinating CSIRT of your main establishment.

Every country

CRA: ENISA's single reporting platform, to the coordinating CSIRT of the main establishment and ENISA (Art. 14(1), (3), (7)).

ENISA Single Reporting Platform
- How: online form
- Have ready:
  - The report goes to the CSIRT designated as coordinator in the member state of your main establishment
- Open the reporting page · Checked 29 October 2026.

Austria

Austrian Data Protection Authority (DSB) (Österreichische Datenschutzbehörde)
- How: online form
- Have ready:
  - A PDF form is the alternative to the online form
  - Email to dsb@dsb.gv.at or a letter also accepted
- Open the reporting page · Checked 28 October 2026.

NIS2

CERT.at (national CSIRT), via the NISG 2026 incident reporting platform
- How: portal (account needed)
- Have ready:
  - Report on the online NISG 2026 Incident Reporting Platform (nim.services.usp.gv.at)
- Open the reporting page · Checked 28 October 2026.

DORA

FMA (Finanzmarktaufsicht) (Finanzmarktaufsichtsbehörde)
- Not checked yet: confirm on the official list.

Belgium

Belgian Data Protection Authority (APD-GBA) (Autorité de protection des données / Gegevensbeschermingsautoriteit)
- How: portal (account needed)
- Have ready:
  - Notify through the APD portal: a business account is created when you log in or register
  - Notifications sent by email are not processed
- Open the reporting page · Checked 28 October 2026.

NIS2

Centre for Cybersecurity Belgium (CCB) (Centrum voor Cybersecurity België / Centre pour la Cybersécurité Belgique)
- Not checked yet: confirm on the official list.

DORA

Banks: NBB (National Bank of Belgium) (Nationale Bank van België / Banque nationale de Belgique)
- How: portal (account needed)
- Have ready:
  - OneGate access needed
  - Manual entry in OneGate, CSV upload or XML upload
  - If OneGate is unavailable, email operational.crisis.supervision@nbb.be (circular NBB_2026_04); OneGate submission still follows
- Open the reporting page · Checked 28 October 2026.
Insurers: NBB (National Bank of Belgium) (Nationale Bank van België / Banque nationale de Belgique)
- How: portal (account needed)
- Have ready:
  - OneGate access needed
  - Manual entry in OneGate, CSV upload or XML upload
  - If OneGate is unavailable, email operational.crisis.supervision@nbb.be (circular NBB_2026_04); OneGate submission still follows
- Open the reporting page · Checked 28 October 2026.
Payment institutions: NBB (National Bank of Belgium) (Nationale Bank van België / Banque nationale de Belgique)
- How: portal (account needed)
- Have ready:
  - OneGate access needed
  - Manual entry in OneGate, CSV upload or XML upload
  - If OneGate is unavailable, email operational.crisis.supervision@nbb.be (circular NBB_2026_04); OneGate submission still follows
- Open the reporting page · Checked 28 October 2026.
Investment firms: NBB (stockbroking firms) or FSMA (other firms), by who supervises the firm (NBB / FSMA)
- Not checked yet: confirm on the official list.

Bulgaria

Commission for Personal Data Protection (CPDP) (Комисия за защита на личните данни (КЗЛД))
- How: PDF or document by email
- Have ready:
  - Download the notification form (PDF or DOCX) and fill it in
  - The notification must be in Bulgarian
  - By email it must carry a qualified electronic signature; on paper, signed and stamped
  - Or send it through the Secure Electronic Delivery System of the Ministry of e-Government
- Open the reporting page · Checked 28 October 2026.

NIS2

CERT Bulgaria (national CSIRT, GovCERT Bulgaria)
- Not checked yet: confirm on the official list.

DORA

Banks: BNB (Bulgarian National Bank) (Българска народна банка)
- Not checked yet: confirm on the official list.
Payment institutions: BNB (Bulgarian National Bank) (Българска народна банка)
- Not checked yet: confirm on the official list.
Investment firms: FSC (Financial Supervision Commission) (Комисия за финансов надзор)
- How: email
- Have ready:
  - Encrypted email to ict_contact_point@fsc.bg
  - ESA incident template as XLSX (v1.2)
  - FSC's PGP key and encryption instructions are linked from its guide
- Open the reporting page · Checked 28 October 2026.
Insurers: FSC (Financial Supervision Commission) (Комисия за финансов надзор)
- How: email
- Have ready:
  - Encrypted email to ict_contact_point@fsc.bg
  - ESA incident template as XLSX (v1.2)
  - FSC's PGP key and encryption instructions are linked from its guide
- Open the reporting page · Checked 28 October 2026.

Croatia

Croatian Personal Data Protection Agency (AZOP) (Agencija za zaštitu osobnih podataka (AZOP))
- How: PDF or document by email
- Have ready:
  - Fill in the Agency's report form (RTF)
  - Sign it (stamp if applicable), post it and email a scan to incidenti@azop.hr
- Open the reporting page · Checked 28 October 2026.

NIS2

CARNET National CERT or National Cybersecurity Centre (NCSC-HR), through the PiXi platform
- How: portal (account needed)
- Have ready:
  - Access is for authorised persons of entities that got a categorisation notice
  - An authorised representative first grants access in e-Ovlaštenja
  - Login through NIAS with a credential of at least substantial assurance
  - PiXi help: helpdesk@carnet.hr, +385 1 6661 555
- Open the reporting page · Checked 28 October 2026.

DORA

Banks: HNB (Croatian National Bank) (Hrvatska narodna banka)
- Not checked yet: confirm on the official list.
Payment institutions: HNB (Croatian National Bank) (Hrvatska narodna banka)
- Not checked yet: confirm on the official list.
Investment firms: HANFA (Croatian Financial Services Supervisory Agency) (Hrvatska agencija za nadzor financijskih usluga)
- Not checked yet: confirm on the official list.
Insurers: HANFA (Croatian Financial Services Supervisory Agency) (Hrvatska agencija za nadzor financijskih usluga)
- Not checked yet: confirm on the official list.

Cyprus

Office of the Commissioner for Personal Data Protection (Γραφείο Επιτρόπου Προστασίας Δεδομένων Προσωπικού Χαρακτήρα)
- Not checked yet: confirm on the official list.

NIS2

National CSIRT-CY (Digital Security Authority) (Εθνική Ομάδα Αντιμετώπισης Περιστατικών Ασφάλειας (CSIRT-CY))
- Not checked yet: confirm on the official list.

DORA

Banks: Central Bank of Cyprus
- Not checked yet: confirm on the official list.
Payment institutions: Central Bank of Cyprus
- Not checked yet: confirm on the official list.
Investment firms: CySEC
- Not checked yet: confirm on the official list.

Czechia

Office for Personal Data Protection (ÚOOÚ) (Úřad pro ochranu osobních údajů)
- How: PDF or document by email
- Have ready:
  - Fill in the electronic form and send it by data box (ID qkbaa2n), post or email to posta@uoou.gov.cz
  - Email needs a recognised electronic signature, or a hand-signed copy sent by post or delivered in person
  - A representative must attach a power of attorney
- Open the reporting page · Checked 28 October 2026.

NIS2

National Cyber and Information Security Agency (NÚKIB) (Národní úřad pro kybernetickou a informační bezpečnost)
- How: portal (account needed)
- Have ready:
  - Incidents are reported by a form in the 'Chci vyřídit' section of Portál NÚKIB since 1 Nov 2025
  - Login via Identita občana
  - Regulated entities report their regulated service on the portal
- Open the reporting page · Checked 28 October 2026.

DORA

ČNB (Czech National Bank) (Česká národní banka)
- How: portal (account needed)
- Have ready:
  - Registration in the SDAT system is needed first
  - Until 31 Dec 2026 the ESA Excel template is attached to the SDAT report; from 1 Jan 2027 structured data (SDAT web form, ESMA JSON or SDAT-XML)
  - One report occurrence in SDAT for each incident
- Open the reporting page · Checked 28 October 2026.

Denmark

Danish Data Protection Agency (Datatilsynet)
- How: portal (account needed)
- Have ready:
  - Sign in to Virk.dk with MitID
  - The questions can be previewed on Virk.dk before you notify
  - The Virk.dk form also covers other authorities, so a few opening questions pick the right one
- Open the reporting page · Checked 28 October 2026.

NIS2

Danish Agency for Societal Security (SAMSIK); national CSIRT is run by the Defence Intelligence Service (FE) (Styrelsen for Samfundssikkerhed)
- How: portal (account needed)
- Have ready:
  - Login with MitID on virk.dk
  - NIS 2 entities register with SAMSIK (separate page: samsik.dk/nis2/registrering-nis2/)
  - Sector authorities supervise their own sectors
- Open the reporting page · Checked 28 October 2026.

DORA

Finanstilsynet
- How: online form
- Have ready:
  - Reported on Virk.dk with a MitID Erhverv login
  - ESA Excel template (v1.3)
  - Only if Virk.dk is technically impossible: email ITIncidents@FTNET.DK
- Open the reporting page · Checked 28 October 2026.

Estonia

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
- How: portal (account needed)
- Have ready:
  - The e-service needs an Estonian eID: ID-card, Mobile-ID or Smart-ID
  - Alternative: fill in the Word form and email it to info@aki.ee
  - Incomplete information can be marked as preliminary and added later
- Open the reporting page · Checked 28 October 2026.

NIS2

Information System Authority (RIA), CERT-EE (Riigi Infosüsteemi Amet)
- How: portal (account needed)
- Have ready:
  - Log in before using the cyber incident notification form
- Open the reporting page · Checked 28 October 2026.

DORA

Finantsinspektsioon (Estonian FSA)
- How: portal (account needed)
- Have ready:
  - Log in to the joint data collection portal of Eesti Pank and the FI at https://aruandlus.eestipank.ee/ with ID-card, Mobile-ID or Smart-ID
  - ESA Excel template v1.2.1, in English or Estonian
  - The FI's submission guide (PDF) is linked on the page; if the portal cannot be used, tell the FI another way
- Open the reporting page · Checked 3 November 2026.

Finland

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
- Not checked yet: confirm on the official list.

NIS2

National Cyber Security Centre Finland (NCSC-FI, Traficom) (Kyberturvallisuuskeskus (Liikenne- ja viestintävirasto Traficom))
- Not checked yet: confirm on the official list.

DORA

Finanssivalvonta (FIN-FSA)
- How: portal (account needed)
- Have ready:
  - Log in to the FIN-FSA e-services on behalf of the organisation
  - Needs the mandate 'Reporting disruptions in financial sector operations' (Trade Register right of representation or Suomi.fi e-Authorizations)
  - Choose initial or final report; intermediate and final reports go from the case folder
- Open the reporting page · Checked 28 October 2026.

France

French data protection authority (CNIL) (Commission nationale de l'informatique et des libertés (CNIL))
- How: online form
- Have ready:
  - A preparatory document can be filled in before the online notification
  - Phased reporting allowed: initial notification within 72 hours, then a complementary one
  - The service is for controllers only; complaints sent through it are not taken into account
- Open the reporting page · Checked 28 October 2026.

NIS2

ANSSI / CERT-FR (Agence nationale de la sécurité des systèmes d'information)
- How: online form
- Have ready:
  - NIS2 not yet in national law (as of 28 Oct 2026): report to the national CSIRT
  - ANSSI says reporting will become mandatory once the law is final
- Open the reporting page · Checked 28 October 2026.

DORA

Banks: ACPR (Autorité de contrôle prudentiel et de résolution)
- Not checked yet: confirm on the official list.
Insurers: ACPR (Autorité de contrôle prudentiel et de résolution)
- Not checked yet: confirm on the official list.
Payment institutions: ACPR (Autorité de contrôle prudentiel et de résolution)
- Not checked yet: confirm on the official list.
Investment firms: AMF (management companies, trading venue operators, crowdfunding providers)
- How: email
- Have ready:
  - Notification form as XLSX, sent to ir.dora-sgp@ (management companies), ir.dora-marches@ (trading venues) or ir.dora-psfp@ (crowdfunding) amf-france.org
  - Request a Sesterce secure messaging account from the same address
- Open the reporting page · Checked 28 October 2026.

Germany

German data protection authorities (BfDI and 16 Land authorities) (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) und Landesbehörden)
- Have ready:
  - Private companies are mostly supervised by the Land authority; the BfDI list page links all 16 and has a finder for the competent one
  - Federal bodies, telecoms and postal services go to the BfDI; the Land of the controller's seat applies otherwise (rows below)
- Open the reporting page · Checked 28 October 2026.
Federal bodies, telecoms, postal (BfDI): Federal Commissioner for Data Protection and Freedom of Information (BfDI) (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit)
- How: online form
- Have ready:
  - The notification form is linked from the BfDI's contact pages
- Open the reporting page · Checked 28 October 2026.
Baden-Württemberg: Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg
- How: online form
- Open the reporting page · Checked 28 October 2026.
Bayern: Bayerisches Landesamt für Datenschutzaufsicht (private sector)
- How: online form
- Have ready:
  - For Bavarian controllers in the non-public sector
- Open the reporting page · Checked 28 October 2026.
Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit
- How: online form
- Open the reporting page · Checked 28 October 2026.
Brandenburg: Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
- How: online form
- Open the reporting page · Checked 28 October 2026.
Bremen: Landesbeauftragte für Datenschutz und Informationsfreiheit Bremen
- How: online form
- Open the reporting page · Checked 28 October 2026.
Hamburg: Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
- How: online form
- Have ready:
  - For controllers based in Hamburg
- Open the reporting page · Checked 28 October 2026.
Hessen: Hessischer Beauftragter für Datenschutz und Informationsfreiheit
- How: online form
- Open the reporting page · Checked 28 October 2026.
Mecklenburg-Vorpommern: Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern
- How: online form
- Open the reporting page · Checked 28 October 2026.
Niedersachsen: Landesbeauftragte für den Datenschutz Niedersachsen
- How: online form
- Have ready:
  - A preliminary notification can be filed to keep the 72 hours
- Open the reporting page · Checked 28 October 2026.
Nordrhein-Westfalen: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
- Not checked yet: confirm on the official list.
Rheinland-Pfalz: Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
- How: online form
- Open the reporting page · Checked 28 October 2026.
Saarland: Unabhängiges Datenschutzzentrum Saarland
- How: online form
- Have ready:
  - The form is only for controllers within the Saarland centre's remit
- Open the reporting page · Checked 28 October 2026.
Sachsen: Sächsische Datenschutz- und Transparenzbeauftragte
- How: online form
- Have ready:
  - End-to-end encryption of the form is temporarily unavailable; transport encryption only
- Open the reporting page · Checked 28 October 2026.
Sachsen-Anhalt: Landesbeauftragter für den Datenschutz Sachsen-Anhalt
- How: online form
- Have ready:
  - For controllers or those acting for them, not for people affected
- Open the reporting page · Checked 28 October 2026.
Schleswig-Holstein: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
- How: PDF or document by email
- Have ready:
  - Download the notification form (ODT) and email it to mail@datenschutzzentrum.de
- Open the reporting page · Checked 28 October 2026.
Thüringen: Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit
- How: PDF or document by email
- Have ready:
  - PDF form to send by email to poststelle@datenschutz.thueringen.de or by post
- Open the reporting page · Checked 28 October 2026.

NIS2

Federal Office for Information Security (BSI), BSI-Portal (Bundesamt für Sicherheit in der Informationstechnik)
- How: portal (account needed)
- Have ready:
  - Login only with an ELSTER organisation certificate, requested via Mein Unternehmenskonto (needs a German tax number)
  - Register the entity in the BSI-Portal first
  - Before registration an incident goes through the online form of the Melde- und Informationsportal (MIP)
  - No phone support; portal-support@bsi.bund.de
- Open the reporting page · Checked 28 October 2026.

DORA

BaFin (Bundesanstalt für Finanzdienstleistungsaufsicht)
- How: portal (account needed)
- Have ready:
  - Register in the MVP portal and get approved for the DORA procedure (the company's LEI is needed)
  - MVP form, JSON file upload or SOAP web service; the ESA Excel template is not a submission format
  - Significant banks supervised by the ECB also report to BaFin
  - Email IKT-Vorfall@bafin.de only if the MVP is unavailable
- Open the reporting page · Checked 28 October 2026.

Greece

Hellenic Data Protection Authority (HDPA) (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα)
- How: portal (account needed)
- Have ready:
  - Log in to the HDPA portal with taxisnet credentials (controllers established in Greece)
  - Controllers not established in Greece notify by email with the downloadable Excel form
  - English accepted for cross-border breaches or where Art. 3(2) or (3) GDPR applies
- Open the reporting page · Checked 28 October 2026.

NIS2

National Cybersecurity Authority (NCSA) (Εθνική Αρχή Κυβερνοασφάλειας)
- How: email
- Have ready:
  - Fill the 24-hour or 72-hour Excel form from the page and email it to incident@cyber.gov.gr
  - Optional online channel on the Hellenic CSIRT site (csirt.cd.mil.gr)
- Open the reporting page · Checked 28 October 2026.

DORA

Banks: Bank of Greece (Τράπεζα της Ελλάδος)
- Not checked yet: confirm on the official list.
Insurers: Bank of Greece (Τράπεζα της Ελλάδος)
- Not checked yet: confirm on the official list.
Payment institutions: Bank of Greece (Τράπεζα της Ελλάδος)
- Not checked yet: confirm on the official list.
Investment firms: Hellenic Capital Market Commission (Επιτροπή Κεφαλαιαγοράς)
- Not checked yet: confirm on the official list.

Hungary

Hungarian National Authority for Data Protection and Freedom of Information (NAIH) (Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH))
- How: online form
- Have ready:
  - Online incident notification system or e-Papír; also a Word or Excel form by email or post
  - Preliminary notifications may be in English but must be repeated in Hungarian
- Open the reporting page · Checked 28 October 2026.

NIS2

National Cyber Defence Institute (NBSZ NKI), national CSIRT (Nemzeti Kibervédelmi Intézet)
- Not checked yet: confirm on the official list.

DORA

MNB (Magyar Nemzeti Bank)
- How: portal (account needed)
- Have ready:
  - Approved registration for the 'DORA Incidens bejelentés' service in the ERA system
  - Certificate-based interface with two-factor login
  - A third party reporting for the entity needs a delegation recorded in the service
- Open the reporting page · Checked 28 October 2026.

Ireland

Data Protection Commission (DPC) (An Coimisiún um Chosaint Sonraí)
- How: online form
- Have ready:
  - Updating an earlier report needs its BN reference number
  - Telecoms and ISP providers use a separate Data Security Breach Notification Form
- Open the reporting page · Checked 28 October 2026.

NIS2

National Cyber Security Centre (NCSC) / CSIRT-IE (An Lárionad Náisiúnta Cibearshlándála)
- How: email
- Have ready:
  - NIS2 not yet in national law (as of 28 Oct 2026): report to the national CSIRT
  - Email certreport@ncsc.gov.ie
  - NCSC says NIS2 registration and reporting portals open only once the law is in force
- Open the reporting page · Checked 28 October 2026.

DORA

Central Bank of Ireland
- How: portal (account needed)
- Have ready:
  - Submitted on the Central Bank Portal (a submission guide is linked)
  - ESA templates as XLSX
  - Pension schemes do not report here (the Pensions Authority)
- Open the reporting page · Checked 28 October 2026.

Italy

Italian Data Protection Authority (Garante)
- How: online form
- Have ready:
  - Notify only through the Garante's online services portal procedure (since 1 July 2021)
- Open the reporting page · Checked 28 October 2026.

NIS2

National Cybersecurity Agency (ACN), CSIRT Italia (Agenzia per la Cybersicurezza Nazionale)
- How: portal (account needed)
- Have ready:
  - Register on the ACN portal first (each year 1 Jan to 28 Feb)
  - Significant incidents go to CSIRT Italia from January 2026
- Open the reporting page · Checked 28 October 2026.

DORA

Banks: Banca d'Italia
- How: portal (account needed)
- Have ready:
  - Submitted through the INFOSTAT platform
  - Instructions and template are in a ZIP file on the page
- Open the reporting page · Checked 28 October 2026.
Investment firms: Banca d'Italia
- How: portal (account needed)
- Have ready:
  - Submitted through the INFOSTAT platform
  - Instructions and template are in a ZIP file on the page
- Open the reporting page · Checked 28 October 2026.
Payment institutions: Banca d'Italia
- How: portal (account needed)
- Have ready:
  - Submitted through the INFOSTAT platform
  - Instructions and template are in a ZIP file on the page
- Open the reporting page · Checked 28 October 2026.
Insurers: IVASS (Istituto per la Vigilanza sulle Assicurazioni)
- Open the reporting page · Checked 28 October 2026.

Latvia

Data State Inspectorate (DVI) (Datu valsts inspekcija)
- How: portal (account needed)
- Have ready:
  - The online form signs in through the latvija.lv portal
  - Notice of 26 Oct 2026: the online form is temporarily unavailable; download the Excel form, sign it with a secure electronic signature and email it to pasts@dvi.gov.lv with the subject 'Paziņojums par personas datu aizsardzības pārkāpumu'
- Open the reporting page · Checked 28 October 2026.

NIS2

CERT.LV (National Cyber Security Centre) (Nacionālais kiberdrošības centrs, CERT.LV)
- How: phone and email
- Have ready:
  - Phone +371 67085888, 24x7 for incident reporting
  - Email cert@cert.lv
- Open the reporting page · Checked 28 October 2026.

DORA

Latvijas Banka
- How: file upload
- Have ready:
  - The ESAs' template as an XLSX (V1.2), sheet order and table placement fixed
  - File named DORA_IR_v_nn_yyyymmdd.xlsx (v 1, 2 or 3 for initial, intermediate, final)
  - Sent through FAS, or by email to ict_incidents@bank.lv protected with CryptShare
  - Latvian or English
- Open the reporting page · Checked 28 October 2026.

Lithuania

State Data Protection Inspectorate (VDAI) (Valstybinė duomenų apsaugos inspekcija)
- Not checked yet: confirm on the official list.

NIS2

National Cyber Security Centre (NKSC) (Nacionalinis kibernetinio saugumo centras)
- Not checked yet: confirm on the official list.

DORA

Lietuvos bankas
- Not checked yet: confirm on the official list.

Luxembourg

National Commission for Data Protection (CNPD) (Commission nationale pour la protection des données (CNPD))
- How: PDF or document by email
- Have ready:
  - Download the notification form and email it to databreach@cnpd.lu
  - A GPG public key is offered to encrypt the email
- Open the reporting page · Checked 28 October 2026.

NIS2

Luxembourg Regulatory Institute (ILR) (Institut luxembourgeois de régulation)
- How: portal (account needed)
- Have ready:
  - Report in SERIMA (login needed); self-registration has its own section
  - Questions: incident_notification@ilr.lu
- Open the reporting page · Checked 28 October 2026.

DORA

Banks: CSSF (Commission de Surveillance du Secteur Financier)
- How: portal (account needed)
- Have ready:
  - Submitted through the CSSF eDesk portal (or by API); managed file transfer is by invitation
  - CSSF's additional operational instructions of Sept 2026 apply on top of the ESAs' instructions
- Open the reporting page · Checked 28 October 2026.
Investment firms: CSSF (Commission de Surveillance du Secteur Financier)
- How: portal (account needed)
- Have ready:
  - Submitted through the CSSF eDesk portal (or by API); managed file transfer is by invitation
  - CSSF's additional operational instructions of Sept 2026 apply on top of the ESAs' instructions
- Open the reporting page · Checked 28 October 2026.
Payment institutions: CSSF (Commission de Surveillance du Secteur Financier)
- How: portal (account needed)
- Have ready:
  - Submitted through the CSSF eDesk portal (or by API); managed file transfer is by invitation
  - CSSF's additional operational instructions of Sept 2026 apply on top of the ESAs' instructions
- Open the reporting page · Checked 28 October 2026.
Insurers: CAA (Commissariat aux Assurances)
- Not checked yet: confirm on the official list.

Malta

Office of the Information and Data Protection Commissioner (IDPC)
- How: online form
- Have ready:
  - Keep the reference number in the acknowledgment email: it is needed for any later contact on the breach
- Open the reporting page · Checked 28 October 2026.

NIS2

CSIRTMalta (Critical Information Infrastructure Protection Department)
- Not checked yet: confirm on the official list.

DORA

MFSA (Malta Financial Services Authority)
- Not checked yet: confirm on the official list.

Netherlands

Dutch Data Protection Authority (AP) (Autoriteit Persoonsgegevens)
- How: online form
- Have ready:
  - The form itself is in Dutch
  - The same form is used to supplement, amend or withdraw an earlier report
- Open the reporting page · Checked 28 October 2026.

NIS2

National Cyber Security Centre (NCSC-NL) with the sector's CSIRT and supervisor, via MijnNCSC (Nationaal Cyber Security Centrum)
- How: portal (account needed)
- Have ready:
  - One report in MijnNCSC reaches your sector CSIRT and the supervisor
  - Registration obligation comes first (own page on ncsc.nl)
- Open the reporting page · Checked 28 October 2026.

DORA

Banks: DNB (De Nederlandsche Bank)
- How: portal (account needed)
- Have ready:
  - Reported in Mijn DNB, under 'Aanvragen en meldingen', 'melding Major ICT-incidents'
  - Excel template 'DORA Incident reporting Template V1.2', checked by DNB's validation rules (v1.3)
  - NIS2-scope firms also report to the NCSC
- Open the reporting page · Checked 28 October 2026.
Insurers: DNB (De Nederlandsche Bank)
- How: portal (account needed)
- Have ready:
  - Reported in Mijn DNB, under 'Aanvragen en meldingen', 'melding Major ICT-incidents'
  - Excel template 'DORA Incident reporting Template V1.2', checked by DNB's validation rules (v1.3)
  - NIS2-scope firms also report to the NCSC
- Open the reporting page · Checked 28 October 2026.
Payment institutions: DNB (De Nederlandsche Bank)
- How: portal (account needed)
- Have ready:
  - Reported in Mijn DNB, under 'Aanvragen en meldingen', 'melding Major ICT-incidents'
  - Excel template 'DORA Incident reporting Template V1.2', checked by DNB's validation rules (v1.3)
  - NIS2-scope firms also report to the NCSC
- Open the reporting page · Checked 28 October 2026.
Investment firms: AFM (Authority for the Financial Markets) (Autoriteit Financiële Markten)
- Not checked yet: confirm on the official list.

Poland

Personal Data Protection Office (UODO) (Urząd Ochrony Danych Osobowych)
- How: online form
- Have ready:
  - The electronic form is on the biznes.gov.pl platform
  - Controllers only; the form is not for individuals
- Open the reporting page · Checked 28 October 2026.

NIS2

CSIRT NASK, CSIRT GOV or CSIRT MON by sector, through the S46 system (Zespoły CSIRT poziomu krajowego (system S46))
- How: portal (account needed)
- Have ready:
  - Login to S46 needed
  - Ministry of Digital Affairs says reports go straight to the CSIRTs through S46
- Open the reporting page · Checked 28 October 2026.

DORA

KNF (Polish Financial Supervision Authority) (Komisja Nadzoru Finansowego)
- How: portal (account needed)
- Have ready:
  - Reported in KNF's DORA Incident System (SOID) at csirt.knf.gov.pl, not the CRP communication platform
  - Login through Profil Zaufany
  - If the system is down, email incydenty.dora@knf.gov.pl and register the report in SOID afterwards
- Open the reporting page · Checked 28 October 2026.

Portugal

National Data Protection Commission (CNPD) (Comissão Nacional de Proteção de Dados)
- How: online form
- Have ready:
  - One option for a new notification, another to amend one submitted earlier
  - Complaints sent through this form are not reviewed
- Open the reporting page · Checked 28 October 2026.

NIS2

National Cybersecurity Centre (CNCS), CERT.PT (Centro Nacional de Cibersegurança)
- Not checked yet: confirm on the official list.

DORA

Banco de Portugal (central receiver of major ICT incident reports under Law 73/2025; ASF and CMVM supervise insurers and securities)
- Not checked yet: confirm on the official list.

Romania

National Supervisory Authority for Personal Data Processing (ANSPDCP) (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal)
- How: online form
- Open the reporting page · Checked 28 October 2026.

NIS2

National Cyber Security Directorate (DNSC) (Directoratul Național de Securitate Cibernetică)
- Not checked yet: confirm on the official list.

DORA

Banks: BNR (National Bank of Romania) (Banca Națională a României)
- Not checked yet: confirm on the official list.
Payment institutions: BNR (National Bank of Romania) (Banca Națională a României)
- Not checked yet: confirm on the official list.
Investment firms: ASF (Financial Supervisory Authority) (Autoritatea de Supraveghere Financiară)
- Have ready:
  - ESA incident form as XLSX
- Open the reporting page · Checked 28 October 2026.
Insurers: ASF (Financial Supervisory Authority) (Autoritatea de Supraveghere Financiară)
- Have ready:
  - ESA incident form as XLSX
- Open the reporting page · Checked 28 October 2026.

Slovakia

Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky)
- How: portal (account needed)
- Have ready:
  - The electronic form sits on the state ÚPVS portal (slovensko.sk), which asks for a sign-in with an eID card with chip or the mobile key
- Open the reporting page · Checked 28 October 2026.

NIS2

National Security Authority (NBÚ), SK-CERT, via JISKB (Národný bezpečnostný úrad)
- Not checked yet: confirm on the official list.

DORA

NBS (National Bank of Slovakia) (Národná banka Slovenska)
- How: portal (account needed)
- Have ready:
  - Filled NBS template as XLSX only (Incident reporting Template V1.2, 7 May 2026 version)
  - Uploaded in the statistical collection portal ŠZP-SK as free attachment to report dor_01
  - Without portal access, email the template to dora-incidenty@nbs.sk
  - Money fields 3.11, 4.13, 4.14 in thousands
- Open the reporting page · Checked 28 October 2026.

Slovenia

Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec)
- How: PDF or document by email
- Have ready:
  - The notification form is optional and downloadable (docx); email it to prijava-krsitev@ip-rs.si
  - Phased reporting: within 72 hours at least say a breach was detected, details can follow
  - Cross-border breaches also need the annex to the form
- Open the reporting page · Checked 28 October 2026.

NIS2

SI-CERT (ARNES), national CSIRT (Slovenski odzivni center za kibernetsko varnost SI-CERT)
- Not checked yet: confirm on the official list.

DORA

Banks: Banka Slovenije
- How: file upload
- Have ready:
  - DORA-IR template as XLSX (V1.2)
  - Files go through the Bank's technical file-exchange guideline for DORA
- Open the reporting page · Checked 28 October 2026.
Payment institutions: Banka Slovenije
- How: file upload
- Have ready:
  - DORA-IR template as XLSX (V1.2)
  - Files go through the Bank's technical file-exchange guideline for DORA
- Open the reporting page · Checked 28 October 2026.
Investment firms: ATVP (Securities Market Agency)
- Not checked yet: confirm on the official list.
Insurers: AZN (Insurance Supervision Agency)
- Not checked yet: confirm on the official list.

Spain

Spanish Data Protection Agency (AEPD) (Agencia Española de Protección de Datos)
- How: online form
- Have ready:
  - Notifications must be made electronically with the form on the AEPD Sede Electrónica
  - Only Spanish and English accepted
  - Email notification is for controllers outside the EU with no Spanish establishment only
- Open the reporting page · Checked 28 October 2026.

NIS2

INCIBE-CERT (private sector and citizens) (Instituto Nacional de Ciberseguridad)
- Not checked yet: confirm on the official list.
Public sector: CCN-CERT (public sector) (Centro Criptológico Nacional)
- Not checked yet: confirm on the official list.

DORA

Banks: Banco de España
- How: portal (account needed)
- Have ready:
  - Join the 'PIR' DORA notification service first through the Banco de España adhesion procedure
  - Electronic certificate needed
  - Excel template (.xlsx) sent through Internet-ITW with process code PIRI3R
- Open the reporting page · Checked 28 October 2026.
Payment institutions: Banco de España
- How: portal (account needed)
- Have ready:
  - Join the 'PIR' DORA notification service first through the Banco de España adhesion procedure
  - Electronic certificate needed
  - Excel template (.xlsx) sent through Internet-ITW with process code PIRI3R
- Open the reporting page · Checked 28 October 2026.
Investment firms: CNMV
- Not checked yet: confirm on the official list.
Insurers: DGSFP (Dirección General de Seguros y Fondos de Pensiones)
- How: portal (account needed)
- Have ready:
  - Electronic headquarters procedure Tel242, 'Notificación de ciberincidentes graves o ciberamenazas importantes'
- Open the reporting page · Checked 28 October 2026.

Sweden

Swedish Authority for Privacy Protection (IMY) (Integritetsskyddsmyndigheten)
- How: online form
- Have ready:
  - Use Chrome or Edge for the e-service
  - Missing information can be supplied later, within four weeks
  - A copy can be downloaded after submitting
  - The report becomes an official document that anyone can request
- Open the reporting page · Checked 28 October 2026.

NIS2

National Cybersecurity Centre (NCSC) through CERT-SE; supervisor Transportstyrelsen for transport (Nationellt cybersäkerhetscenter)
- How: portal (account needed)
- Have ready:
  - Reporting service (Rapporteringstjänst) in the cyberportal; first version opened 1 July 2026, still in development
  - All significant incidents reported to NCSC from 1 July 2026
- Open the reporting page · Checked 28 October 2026.

DORA

Finansinspektionen
- How: portal (account needed)
- Have ready:
  - Reported in FI's reporting system Fidac
  - JSON format only for new incidents since 31 Mar 2025
- Open the reporting page · Checked 28 October 2026.

Iceland

Persónuvernd (Icelandic Data Protection Authority)
- How: online form
- Have ready:
  - The notification is a form filled out on Ísland.is (also a PDF in Icelandic)
- Open the reporting page · Checked 28 October 2026.

NIS2

CERT-IS (Communications Authority of Iceland) (Netöryggissveit fjarskiptastofu CERT-IS)
- Not checked yet: confirm on the official list.

DORA

Seðlabanki Íslands (Central Bank of Iceland, financial supervision)
- Not checked yet: confirm on the official list.

Liechtenstein

Data Protection Authority of Liechtenstein (DSS) (Datenschutzstelle Fürstentum Liechtenstein)
- How: online form
- Have ready:
  - Signing in with eID.li is optional: without it you get a blank form
  - The form has a temporary storage function
- Open the reporting page · Checked 28 October 2026.

NIS2

CSIRT.LI (Office for Cyber Security) (Stabsstelle Cyber-Sicherheit)
- Not checked yet: confirm on the official list.

DORA

FMA Liechtenstein (Finanzmarktaufsicht Liechtenstein)
- How: portal (account needed)
- Have ready:
  - Submitted in the FMA e-Service Portal
  - ESA Excel templates (V1.3), used unchanged
  - DORA applies in Liechtenstein since 1 Feb 2025
- Open the reporting page · Checked 28 October 2026.

Norway

Norwegian Data Protection Authority (Datatilsynet)
- How: portal (account needed)
- Have ready:
  - Sign in to Altinn with an eID, or a business certificate (Commfides or Buypass)
  - You need a role in the Enhetsregisteret or a delegated right to the single service
  - Phased reporting allowed: say in the first notification that more information will follow
  - If Altinn is not possible, email or post is accepted
- Open the reporting page · Checked 28 October 2026.

NIS2

National Security Authority (NSM), NCSC-NO (Nasjonal sikkerhetsmyndighet)
- Not checked yet: confirm on the official list.

DORA

Finanstilsynet (Norway)
- How: email
- Have ready:
  - Email hendelse@finanstilsynet.no (Altinn form KRT-3190 not usable for now)
  - Sensitive reports: Altinn form KRT-1060 marked 'Hendelsesrapportering IKT', or an encrypted, password-protected Word document by email
- Open the reporting page · Checked 28 October 2026.

The official lists

GDPR: The EDPB's members
NIS2: The CSIRTs Network
DORA: The ESAs' lists of competent authorities
CRA: ENISA's Single Reporting Platform

Where to file, by country

Every country

Austria

GDPR

NIS2

DORA

Belgium

GDPR

NIS2

DORA

Bulgaria

GDPR

NIS2

DORA

Croatia

GDPR

NIS2

DORA

Cyprus

GDPR

NIS2

DORA

Czechia

GDPR

NIS2

DORA

Denmark

GDPR

NIS2

DORA

Estonia

GDPR

NIS2

DORA

Finland

GDPR

NIS2

DORA

France

GDPR

NIS2

DORA

Germany

GDPR

NIS2

DORA

Greece

GDPR

NIS2

DORA

Hungary

GDPR

NIS2

DORA

Ireland

GDPR

NIS2

DORA

Italy

GDPR

NIS2

DORA

Latvia

GDPR

NIS2

DORA

Lithuania

GDPR

NIS2

DORA

Luxembourg

GDPR

NIS2

DORA

Malta

GDPR

NIS2

DORA

Netherlands

GDPR