EU incident reporting deadlines calculator

Pick the rules that apply, say when you became aware of the incident, and this page lists every report each rule asks for and by when: GDPR, NIS2, DORA and CRA, from the legal texts, with the same arithmetic Dueline runs in Jira.

It runs on this page, in your browser. Nothing you enter is sent anywhere, and nothing is kept: close the page and it is gone.

Work out the deadlines

How the deadlines are counted

• From when you became aware of the incident. For DORA’s initial notification, from when it was classified as major, and no later than 24 hours after you became aware, as Art. 5 of Delegated Regulation 2025/301 says.
• Hours are exact hours. One month is the same time on the same date of the next month, or the last day of that month when the date does not exist.
• Where the law can be read two ways, the earlier of the two readings is shown.
• A report that runs from an earlier one is listed as waiting: its deadline starts when the earlier one is sent.
• DORA: a deadline on a weekend in your country moves to noon of the next working day, and that later time is shown beside the strict one. Bank holidays are not built in, so a deadline shown can be earlier than the law allows, never later.

Where each rule comes from

• GDPR, Articles 33 and 34: Regulation (EU) 2016/679
• NIS2, Article 23: Directive (EU) 2022/2555
• DORA, Article 19: Regulation (EU) 2022/2554, with the time limits of Delegated Regulation (EU) 2025/301, Article 5
• CRA, Article 14: Regulation (EU) 2024/2847

Read each guide for one rule: DORA, GDPR, CRA and ENISA’s platform and NIS2.

What this does not do

It does not decide whether a report is due: that is your assessment, and national law may be stricter than the EU rule. It sends nothing to any authority. This calculator is a guide from the rules’ texts, not legal advice, given without warranty. Dueline keeps the record of each report on the Jira work item.