One incident can trigger both GDPR and NIS2 reports, to different authorities on different clocks. Plan for parallel reporting so neither is missed.
Why it matters
For GDPR, gdpr and nis2 is rarely a purely technical question. It touches ownership, budget and how quickly decisions can be made when something goes wrong. Teams that agree on these points in advance spend less time debating them under pressure.
What to check
- Map which authority gets which report
- Share facts between the two reporting tracks
- Keep one timeline for both
Where to start
A single incident coordinator avoids mixed messages. Write down what you decide, who owns it and when it will be reviewed. That record is often the evidence a reviewer asks for later.