Complass
When it has happened: reporting duties under NIS2, the CRA and the GDPR in one flow
Saturday, 2:14 a.m.: one incident, three laws, three recipients – and the first deadlines expire before anyone is back in the office on Monday.
A single security incident can trigger up to three reporting duties at once: under § 32 BSIG (NIS2) to the joint reporting office of the BSI and BBK, under Art. 14 of the Cyber Resilience Act via ENISA's single reporting platform, and under Art. 33 and 34 GDPR to the data protection authority and, where required, to the people affected. Each duty has its own conditions, deadlines and recipients.
The whitepaper opens with an incident in the night to Saturday and from there sets the deadlines side by side (24 hours, 72 hours, 14 days, one month), explains when an incident counts as significant under Implementing Regulation (EU) 2024/2690, walks through a decision tree on "whether and by when", and shows how to prepare roles, templates and exercises.
Each obligation chapter includes a short "Implementation in Complass" box with a platform screenshot (decision W11); only features already live are named.
15 pages · Version 1.1 · as of 07.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.