NIS2, GDPR, ISO 27001: what matters is who imposes it and what it costs you.
Compliance is not a catalogue of acronyms. It is an external constraint, with a deadline and a penalty. These three frameworks share neither the same source nor the same price for inaction: two are matters of law, the third is a standard you choose, often because a client requires it.
Contents
Three questions to find out what applies to you
Lining up NIS2, GDPR and ISO 27001 on the same page suggests they are the same kind of thing. They are not. Before any talk of tools or budget, three questions tell one framework from another.
Who imposes it?
A regulator, or a client? The answer changes everything: a law is not negotiable, a market requirement is a choice.
On what deadline?
An entry into force, a notification window, an audit cycle. The constraint always comes with a clock.
What does it cost you?
A fine, a director held personally liable, a contract lost. It is the cost of inaction that gives a framework its weight.
Who imposes it
- NIS2
- The state imposes it
- GDPR
- The regulator imposes it
- ISO 27001
- You choose it, often at a client's request
Legal obligation
Legal obligation
Voluntary standard
GDPR: the fine can reach
4%of worldwide turnover
The only figure we state without reservation. For NIS2, the directive sets a minimum that national law then transposes; for ISO 27001, there is no fine at all.
The three frameworks, read side by side
They do not form a queue, they compare. Two are imposed on you by law. The third is imposed by no one: it is a standard you choose, often because a client or a tender asks for it. Read each row from left to right.
| Axis | NIS2 | GDPR | ISO 27001 |
|---|---|---|---|
| Nature of the text | Security of network and information systemsLegal obligationA European directive: it sets objectives that each member state transposes into its own law. In France, the transposition law has not yet been enacted. | General Data Protection RegulationLegal obligationA European regulation: it applies as it stands across the whole Union, with no transposition, since 25 May 2018. | International standard ISO/IEC 27001:2022 (information security management)Voluntary standardAn international standard: it describes how to run security (a management system and 93 reference controls). On its own, it creates no obligation. |
| Who imposes it | The European Union, through a directive transposed into national law. In France, the supervisory authority is ANSSI. | The European Union, through a regulation that applies directly. In France, the supervisory authority is the CNIL. | No one, as far as the law is concerned. You choose it, most often because a client, a prime contractor or a tender asks for certification. |
| Who carries it | Entities designated as 'essential' and 'important' in 18 listed sectors (energy, transport, health, digital infrastructure and others), from the size of a medium-sized enterprise upwards. | Any organisation processing the personal data of people located in the Union, whatever its sector. | Any organisation, whatever its size or sector, that decides to commit to it. It weighs most on service providers entrusted with their clients' data. |
Who is concerned, text by text
The comparison says what kind of text each framework is. That leaves the question everyone asks first: does it apply to me? Here are the criteria, each with the article that sets it, then what the text requires of you.
Map of obligations
NIS2Legal obligation
Directive (EU) 2022/2555
Who is concerned
- Essential entity
- A highly critical sector from Annex I (energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, B2B ICT services, public administration, space) and a large enterprise: 250 staff or more, or turnover above EUR 50 million and balance sheet above EUR 43 million.
- Art. 3(1) · Annex I
- Important entity
- Other Annex I and II entities, from the size of a medium-sized enterprise: 50 staff or more, or turnover and balance sheet above EUR 10 million. Annex II adds seven sectors: postal services, waste, chemicals, food, manufacturing, digital providers, research.
- Art. 2(1) · Art. 3(2) · Annex II
- Regardless of size
- Providers of public electronic communications networks or services, trust service providers, top-level domain name registries, DNS service providers, or an entity that is the sole provider of a critical service in the country.
- Art. 2(2)
- Public sector
- Central government bodies and, in France, local authorities: the exact scope depends on the transposition law, which has not yet been enacted.
- Art. 2(2)(f) and 2(5)NIS2 and local authorities, in detail
To check your own case: MonEspaceNIS2, ANSSI's official eligibility tool.
What it requires
24h
early warning
72h
notification to the authority
1month
final report
A significant incident triggers an early warning within 24 hours, a notification to the authority within 72 hours, then a final report within one month.
What it costs you
Administrative penalties, and direct liability for company directors. The directive provides for a ceiling of at least EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important entities, whichever is higher.
GDPRLegal obligation
Regulation (EU) 2016/679
Who is concerned
- Any organisation
- Company, association, administration, local authority: as soon as you process personal data (clients, employees, citizens), whatever your size.
- Art. 2(1) · Art. 4
- Established in the Union
- The regulation applies to your processing, whether the data is hosted in France, in the United States or anywhere else.
- Art. 3(1)
- Established outside the Union
- As soon as it offers goods or services to people in the Union, or monitors their behaviour.
- Art. 3(2)
- Data protection officer
- Mandatory for public authorities and bodies, and for organisations whose core activities involve regular and systematic monitoring on a large scale, or sensitive data on a large scale.
- Art. 37(1)
The only exclusion: purely personal or household activity (Art. 2(2)(c)).
What it requires
72h
notification to the authority
A data breach must be notified to the authority within 72 hours of becoming aware of it; the people concerned are informed where the risk is high.
What it costs you
An administrative fine of up to EUR 20 million or 4% of total annual worldwide turnover, whichever is higher.
ISO 27001Voluntary standard
ISO/IEC 27001:2022
Who is concerned
- No one, by default
- The standard is imposed on no organisation. You choose it, implement it, then have it certified, or not.
- Voluntary approach
- Providers under client pressure
- Hosting providers, SaaS vendors, managed service providers: when a contract or a tender asks for certification, it becomes a condition of market access.
- Contractual requirement
- Health data hosting providers
- The one case where it becomes unavoidable in France: HDS certification, required by law, has incorporated the ISO 27001:2022 requirements since its 2024 framework.
- Art. L.1111-8 CSP · HDS framework
- Entities subject to NIS2
- The directive encourages the use of European and international standards. ISO 27001 certification helps demonstrate the Article 21 measures, without amounting to compliance on its own.
- Art. 25 NIS2
The certificate is issued by an accredited body (Cofrac in France) for 3 years, with a surveillance audit every year.
What it requires
3years
certificate validity
1year
between two surveillance audits
Not a legal deadline, but an audit cycle: an accredited certification body (Cofrac in France) issues a certificate valid for 3 years, then returns every year for a surveillance audit.
What it costs you
No fine. The cost is commercial: a tender that requires certification, a contract left unsigned, a major account moving to a certified competitor.
One incident, two clocks
NIS2Legal obligation
24 h : early warning
72 h : notification to the authority
1 month : final report
GDPRLegal obligation
72 h : notification to the authority
What the CNIL actually fines
The 4% ceiling describes the worst case. Here is what the CNIL, the French data protection authority, has actually fined, and what it has announced. Its 2025 total, €487M, includes €475M imposed on two tech giants over cookies: for an SME or a local authority, these are the figures that matter.
What the CNIL actually fines
14
sanctions in 2025 for inadequate data security: weak passwords, accounts shared between users. Ordinary failings, not sophisticated attacks.
EUR 5M
fine for France Travail, a public body, on 22 January 2026. The CNIL found weak authentication, logging too poor to detect abnormal behaviour and overly broad access rights.
6,167
personal data breaches notified to the CNIL in 2025, 9.5% more than in 2024. One in two stems from hacking.
50%
of CNIL inspections and sanctions will target cybersecurity in 2026. Local authority cybersecurity is among its priorities.
EUR 10,000
fine for a municipality on 11 September 2025, notably for poor security. The public sector is not spared: other municipalities were fined in 2023 and 2024.
EUR 466,000
average cost of a cyberattack for a small or medium business, EUR 13M for a mid-sized company, according to an ANSSI survey of Clusif members quoted by the French Senate. Self-reported: an order of magnitude, not a measurement.
5 years
in prison and a EUR 300,000 fine: the penalty in the French Criminal Code for processing data without the measures needed to keep it secure. The CNIL guide notes that an elected official or a civil servant can be held liable.
CNIL and Cybermalveillance.gouv.fr guide for local authorities (in French)
Beneath the three acronyms, one common trunk
The frameworks differ in their source and in their penalty. On the ground, they call for the same capabilities. Three of them, at once: none waits for the others.
Know what is happening
All three assume you can see your information system: log, detect, keep a trace. Without visibility there is neither notification nor evidence.
Be able to prove it
Records of processing, audit logs, documented controls: compliance has to be demonstrated, to an authority as much as to an auditor.
React within the deadline
Detect, qualify and notify before the clock runs out (72 hours for the GDPR, 24 then 72 hours for NIS2) or, for ISO 27001, show the auditor an incident management process that works.
Strengthening the security these texts expect, in order
Here there really is a sequence. You do not wire up tools before knowing what you have to cover. Four steps, in this order.
Step 01
Assess your posture
Where your security stands against the measures these texts expect. An honest assessment before any spending.
Step 02
Close the gaps
Prioritise what is missing and put in place the technical and organisational security measures that count first.
Step 03
Equip detection and evidence
Centralised logging, detection, documentation: enough to feed a notification within the deadline as well as an audit file.
Step 04
Maintain and reassess
Security is not a project that closes: regular review of your measures (GDPR art. 32(1)(d)), testing, continuous detection.
Our sources
Every criterion, deadline and ceiling on this page points to an official text.
Official texts
French authorities
Standards and certification
Sanctions and observed costs
- Sanctions and corrective measures: 2025 report (in French)CNIL (new tab)
- 2025 annual report (in French)CNIL (new tab)
- Data breach: EUR 5 million fine against France Travail (in French)CNIL (new tab)
- Sanctions issued by the CNIL (in French)CNIL (new tab)
- Cybersecurity obligations and liabilities of local authorities (in French)CNIL and Cybermalveillance.gouv.fr (new tab)
- Report no. 393 on the resilience and cybersecurity bill (in French)French Senate (new tab)
Sources consulted on 27 September and 2 October 2026.
Read next
CertificationGuide · 5 min
ISO 27001 Guide
Understanding the ISO 27001 standard, ISMS, Annex A controls, the certification process and concrete benefits for your organization.
Read the guideDefinitionArticle · 3 min
What is a Modern SOC?
Discover how businesses effectively protect themselves against cyber threats through a modern Security Operations Center, combining human expertise and advanced technologies.
Read the article
Your security posture, assessed in the free audit
The free audit shows where your security stands against the measures these texts expect, and what to strengthen first. You leave with a clear reading, whether or not we work together afterwards.