A smart-city vendor treats NIS 2 incident rules as identical to GDPR personal-data breach rules. Which statement correctly separates the regimes?
Select an answer to reveal the explanation.
Short Explanation
Two fire alarms on the same building can ring for different reasons. NIS 2 is the cyber-resilience alarm for covered entities; GDPR breach rules are the personal-data alarm when people’s information is compromised. A smart-city outage might trigger one, the other, or both—but the checklists are not copy-paste twins.
Full Explanation
NIS 2 focuses on cybersecurity risk-management and incident obligations for covered entities, while the GDPR’s personal-data breach regime addresses confidentiality, integrity, or availability incidents involving personal data and related notification duties—related layers that are not interchangeable. Smart-city vendors must not treat NIS 2 incident rules as identical to GDPR breach rules: triggers, audiences, timelines, and remedies differ even when one event engages both. NIS 2 does not solely govern cookie consent banners. GDPR breach notification does not completely replace NIS 2 for every infrastructure operator. Neither regime applies only to deceased persons’ records. Exam caveat: concurrent-regime items reward separation of cyber-entity duties from personal-data breach duties. Operational check: for a municipal OT/IT incident affecting resident databases, open both a NIS 2 (if in scope) incident track and a GDPR Articles 33/34 assessment with separate clocks, owners, and notice content. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.