DORA - Digital Operational Resilience Act

Regulation on digital operational resilience

Since January 16, 2023, the DORA regulation, accompanied by its associated directive, aims to strengthen the security of financial services in the face of digital transformation and cyberattacks.

At My Data Solution, we support you in integrating this new regulatory framework while promoting innovation and ensuring consumer protection.

Who is affected by the DORA regulations?

DORA applies to a wide range of financial sector stakeholders, including:

At My Data Solution, we help you understand these obligations and anticipate their strategic and operational impact.

Application schedule:

January 2025: Official entry into force of the DORA regulation.

Transposition of Directive 2022/2556 by Member States before this date.

Expertise required for DORA compliance and improving digital operational resilience

To navigate the complexities of the Digital Operational Resilience Act (DORA) and strengthen your digital operational resilience, a multidisciplinary team is essential.
The DORA Regulation distinguishes itself from previous frameworks by consolidating various aspects of digital operational resilience into one comprehensive piece of legislation.
Unlike previous regulations, which could address these issues in a piecemeal manner, DORA provides a unified approach specifically targeting financial entities.
For the first time in the EU, DORA sets out a detailed framework focused on ensuring that financial institutions can resist and effectively recover from digital disruption.
Additionally, it establishes a direct monitoring mechanism for providers of critical ICT services at EU level.
This oversight is designed to strengthen accountability and transparency, in contrast to previous frameworks that generally relied on national or less centralized systems.
This team must be able to offer a comprehensive and coordinated approach, leveraging expertise in several critical areas:

Risk and Security Management

ICT Risk Management:

Professionals competent in the identification and management of risks associated with Information and Communication Technologies (ICT) are essential. They must have in-depth knowledge of industry-specific challenges and solutions to address digital resilience.

Cybersecurity and Crisis Management:

Specialists capable of implementing robust cybersecurity measures and crisis management strategies are crucial. This includes protecting against potential threats and ensuring continuity and recovery from disruptions.

Regulatory and Legal Expertise

Regulatory Compliance:

Legal experts are needed to interpret and navigate regulatory requirements. They help understand the full scope and application of DORA mandates and related standards (RTS, ITS, etc.).

Contractual Reviews:

Experts who can review and renegotiate contracts with ICT service providers are crucial. They ensure that all legal aspects are aligned with operational resilience objectives and regulatory standards.

By assembling a team with skills covering these areas, organizations can better ensure compliance with DORA and build a robust framework for digital operational resilience.

How does the DORA Regulation align with the European Commission's digital finance strategy?

The Digital Operational Resilience Act (DORA) is a key part of the European Commission’s digital finance strategy. This regulation supports the strategy’s objective of leveraging innovation and integrating new technologies. At the same time, it guarantees the stability of the financial system and protects the interests of consumers.

Foster innovation and technological adoption

Encouraging new technologies: DORA is designed to create an environment where financial companies can explore and implement cutting-edge digital solutions.

Simplifying compliance: By standardizing digital risk management across the EU, the act facilitates business innovation in a secure and compliant framework.

Ensuring financial stability and consumer protection

Robust Cybersecurity Measures: One of DORA’s goals is to strengthen financial institutions’ defenses against cyber threats, thereby maintaining market confidence.
Uniform Guidelines: The Regulation provides clear guidance, promoting the resilience of financial operations and helping to prevent disruptions that could affect economic stability.

In summary, DORA is essential to the broader digital finance strategy by marrying innovation and prudence, ultimately leading to a more secure and advanced financial ecosystem in Europe.

The 5 pillars of digital operational resilience

ICT risk
management

Development and monitoring of a comprehensive risk management system to counter digital threats.

Management and reporting of ICT incidents

Harmonization of notification processes for rapid response and better anticipation of cyber threats.

Digital Operational Resilience Testing

Implementation of an annual testing program including critical functions and advanced tests such as TLPT.

Risk management
linked to ICT service providers

Integration of third-party management policies and continuous monitoring of relationships with critical service providers.

Information sharing
in cybersecurity

Creating trusted communities for sharing cyber threat information and best practices.

Transform challenges into opportunities
with My Data Solution

Our mission: help you transformyour regulatory obligations into a competitive lever. By strengthening your operational resilience, you gain agility, reliability and trust with your customers.

Our DORA support services:

DORA Compliance Strategic Consulting

Development of tailor-made action plans to effectively integrate the requirements of the DORA regulation into your organization.

Training dedicated
to teams

Targeted training sessions to raise awareness among your employees of the issues and best practices related to digital operational resilience.

Outsourcing of the DPO/DPD function

Complete and professional support, with guarantees of transparency and efficiency, to optimize the management of your regulatory compliance.

YOUR QUESTIONS ABOUT GDPR FOR THE BANKING AND FINANCE SECTOR

Frequently asked questions Banking Finance

What is the Dora Directive?

The DORA Regulation aims to harmonize existing requirements for managing risks associated with external ICT service providers. Among the obligations imposed on financial entities, they must establish a strategy regarding the risks associated with third-party IT service providers.

What is the objective of DORA?

The objective of DORA is explicitly defined in its recital 105, a preamble which precedes the text of the law and sets out its motivations: “to achieve a high level of digital operational resilience for all regulated financial entities”.

But concretely, what do we mean by “digital operational resilience”? According to the text of DORA itself, this refers to: “the ability of a financial entity to develop, guarantee and reassess its operational integrity and reliability by ensuring directly or indirectly through the use of services provided by third party ICT service providers, the full ICT-related capabilities necessary to guarantee the security of the networks and information systems it uses, and which underpin the continued provision of financial services and their quality, including in the event of disruptions” – DORA, Article 3(1)

Who should care about DORA compliance?

Le Règlement sur la résilience opérationnelle du numérique concerne 21 types d’entités. Les voix comme décrites dans l’Article 2 :

credit institutions;
payment institutions, including payment institutions exempted under Directive (EU) 2015/2366;
account information service providers;
electronic money institutions, including electronic money institutions exempted under Directive 2009/110/EC;
investment firms;
crypto-asset service providers and issuers of asset-referenced tokens;
central securities depositories;
central counterparties;
trading venues;
central repositories;
alternative investment fund managers;
management companies;
data reporting service providers;
insurance and reinsurance companies;
insurance intermediaries, reinsurance intermediaries, and ancillary insurance intermediaries;
professional retirement institutions;
credit rating agencies;
administrators of critical benchmarks;
crowdfunding service providers;
securitisation repositories;
third-party ICT service providers

DORA : la liste des exceptions

Are excluded from the scope of DORA :

alternative investment fund managers referred to in Article 3(2) of Directive 2011/61/EU;
insurance and reinsurance undertakings based on their size, as referred to in Article 4 of Directive 2009/138/EC;
professional retirement institutions managing pension schemes that, collectively, have no more than fifteen members in total;
natural or legal persons exempted under Articles 2 and 3 of Directive 2014/65/EU;
insurance intermediaries, reinsurance intermediaries, and ancillary insurance intermediaries that are micro-enterprises or SMEs. The definition is provided in Article 4(60) of DORA: employing fewer than ten persons and whose annual turnover and/or annual balance sheet total does not exceed €2 million;
postal giro institutions referred to in Article 2(5.3) of Directive 2013/36/EU.

Please note that Member States may choose to exclude from the scope of DORA certain very specific national credit or investment entities, as referred to in Article 2(5) of Directive 2013/36/EU. In France for example, the Statepourrait choisir d’épargner la Caisse des dépôts et consignations.

What is the GDPR and how does it affect the Banking - Finance sector?

The GDPR, General Data Protection Regulation, is a European Union regulation which aims to protect the personal data of individuals. It also affects the banking and financial sector, as institutions frequently collect and process sensitive data from their customers, such as banking information and credit card details.

What are the consequences of a GDPR violation in the financial sector?

For GDPR violations, companies in the Banking – Finance sector can face fines of up to 4% of their global annual turnover or €20 million, whichever is greater. In addition to fines, violations can lead to loss of customer trust and serious damage to the company’s reputation.

What are the main steps to comply with GDPR in the financial sector?

The main steps to comply with the GDPR include: carrying out a data assessment, implementing data protection policies, obtaining informed consent from individuals, strengthening data security, raising employee awareness and establishing a process to manage the rights of data subjects.

How can I obtain consent from customers for the processing of their personal data?

To obtain valid consent, ensure that your consent request is clear, understandable and specific to each processing purpose. Clients must give their consent freely, informed and without pressure. You must also inform customers of their right to withdraw consent at any time.

What security measures should be put in place to protect personal data in the financial sector?

Security measures include using encryption techniques to protect data, restricting access to sensitive data, implementing access controls, educating employees about data security, and conducting regular audits to evaluate the effectiveness of the measures.

How can My Data Solution help our business achieve GDPR compliance?

My Data Solution offers a range of personalized services to help you achieve GDPR compliance. We carry out compliance assessments, develop tailor-made action plans, train your staff in best practices, manage individual rights and carry out regular audits to ensure ongoing compliance.

What are the concrete advantages of GDPR compliance for the Banking - Finance sector?

GDPR compliance builds trust with your customers by showing your commitment to protecting their data. This helps you avoid costly fines for non-compliance, protects your reputation, and gives you a competitive advantage by attracting privacy-conscious customers.

Qu'est-ce que le RGPD et en quoi concerne-t-il le secteur Banque - Finance ?

Le RGPD, Règlement Général sur la Protection des Données, est une réglementation de l’Union Européenne qui vise à protéger les données personnelles des individus. Il concerne également le secteur bancaire et financier, car les institutions collectent et traitent fréquemment des données sensibles de leurs clients, telles que les informations bancaires et les détails de cartes de crédit.

Quelles sont les conséquences d'une violation du RGPD dans le secteur financier ?

En cas de violation du RGPD, les entreprises du secteur Banque – Finance peuvent faire face à des amendes pouvant atteindre 4 % de leur chiffre d’affaires annuel mondial ou 20 millions d’euros, selon le montant le plus élevé. En plus des amendes, les violations peuvent entraîner une perte de confiance des clients et nuire gravement à la réputation de l’entreprise.

Quelles sont les principales étapes pour se conformer au RGPD dans le secteur financier ?

Les principales étapes pour se conformer au RGPD comprennent : réaliser une évaluation des données, mettre en place des politiques de protection des données, obtenir le consentement éclairé des individus, renforcer la sécurité des données, sensibiliser les employés et mettre en place un processus de gestion des droits des personnes concernées.

Comment puis-je obtenir le consentement des clients pour le traitement de leurs données personnelles ?

Pour obtenir un consentement valide, assurez-vous que votre demande de consentement soit claire, compréhensible et spécifique à chaque finalité de traitement. Les clients doivent donner leur consentement de manière libre, éclairée et sans pression. Vous devez également informer les clients de leur droit de retirer leur consentement à tout moment.

Quelles sont les mesures de sécurité à mettre en place pour protéger les données personnelles dans le secteur financier ?

Les mesures de sécurité comprennent l’utilisation de techniques de cryptage pour protéger les données, l’accès restreint aux données sensibles, la mise en œuvre de contrôles d’accès, la sensibilisation des employés à la sécurité des données et la réalisation d’audits réguliers pour évaluer l’efficacité des mesures.

Comment My Data Solution peut - elle aider notre entreprise à atteindre la conformité RGPD ?

My Data Solution offre une gamme de services personnalisés pour vous aider à atteindre la conformité RGPD. Nous réalisons des évaluations de conformité, développons des plans d’action sur mesure, formons votre personnel aux bonnes pratiques, gérons les droits des individus et effectuons des audits réguliers pour assurer une conformité continue.

Quels sont les avantages concrets de la conformité RGPD pour le secteur Banque - Finance ?

La conformité RGPD renforce la confiance de vos clients en montrant votre engagement envers la protection de leurs données. Cela vous permet d’éviter des amendes coûteuses pour non-conformité, protège votre réputation et vous donne un avantage concurrentiel en attirant des clients soucieux de leur vie privée.