Compliance Regulations by Industry: What Applies to Your Sector

The regulations that apply to your company depend on three things: what you do, what data you handle and where you sell. Financial entities answer to DORA, operators in critical sectors to NIS2, anyone handling personal data to GDPR, and manufacturers to EU product rules. Frameworks such as ISO 27001 sit on top of these as the common way to prove the work is done. The practical answer is to map your sector once, then run every obligation from one set of documents and evidence. That is how we built Guardiso to work.

Regulation, standard, framework: the three words that cause most confusion

Before matching rules to industries, it helps to be precise about what kind of rule you are looking at.

A regulation is law. In the EU, regulations are binding in their entirety and apply directly in Member States, while directives need national transposition. That difference matters in practice. GDPR and DORA are regulations, so the same text applies in Paris and Prague. NIS2 is a directive, so each Member State writes its own implementing law and the details of scope and supervision can differ by country.

A standard is a technical or management specification written by a standards body. According to the European Commission’s business portal, technical requirements in EU legislation are mandatory, while harmonised standards are usually voluntary, and you may use another technical solution if it achieves the same level of compliance. The same page names CEN, CENELEC and ETSI as the three European standardisation organisations.

A framework is a structured set of controls and processes you adopt to meet one or more of the above. ISO 27001 is the best-known example in information security. ENISA’s review of auditing schemes found that some schemes are sector-specific and backed by legislation, while large frameworks such as ISO 27001 are not sector-specific and are adopted across sectors on a voluntary basis.

So the rule of thumb is simple. Law tells you what you must achieve. Standards and frameworks tell you how to organise the work and how to prove it. Customers and insurers frequently ask for the proof even where no law does.

Compliance regulations by industry at a glance

The table below covers the main European regimes that information security and data teams meet. It is a starting map, not legal advice. Confirm scope against the official text and your national implementing law.

The sections that follow explain each row in more detail.

Financial services: DORA and the wider rulebook

DORA is the Digital Operational Resilience Act. It is an EU regulation that applies directly to covered financial entities. It addresses ICT risk management, incident management, resilience testing and the risk from third-party ICT providers. A Greek law firm’s newsletter notes that DORA is directly applicable and focused on financial-sector digital resilience, while NIS2 is broader and needs national implementation.

According to a Mayer Brown briefing, DORA has applied since 17 January 2025 to credit institutions, investment firms, payment institutions, e-money institutions, crypto-asset service providers, insurance and reinsurance undertakings, and critical ICT third-party service providers. The same briefing describes the incident clock for major ICT-related incidents: an initial notification within 4 hours of classification and no later than 24 hours from awareness, an intermediate report within 72 hours of the initial notification, and a final report no later than one month after the intermediate report or its latest update.

That timetable is why financial entities need incident evidence ready before anything happens. Logs, owners, escalation paths and supplier registers cannot be assembled in four hours.

GDPR sits alongside DORA for any personal data in scope, and firms dealing in crypto-assets also look at MiCA. Our page on DORA explains who it covers and what teams need to prepare.

Critical sectors and digital services: NIS2

NIS2 is Directive (EU) 2022/2555. The EUR-Lex summary lists the sectors it covers: energy, transport, banking and financial market infrastructure, health, drinking water, waste water, digital infrastructure and others. The same summary includes healthcare providers and manufacturers of critical medical devices under health, and data centre and cloud computing services under digital infrastructure.

Organisations in scope are classed as essential or important entities. One law firm-style analysis from a compliance consultancy says the general size threshold is at least 50 employees or annual turnover above €10 million, with exceptions for certain systemic entities. The same source says the distinction between essential and important mainly changes supervision and enforcement, while the core risk-management and reporting duties are the same. Because NIS2 is a directive, always confirm the threshold and any extra sectors in your own country’s implementing law.

The duties are practical. They include cybersecurity risk measures, incident handling and reporting, business continuity, supply chain security, secure systems, training, cryptography, access control and multi-factor authentication. The reporting procedure in Article 23 has three steps, according to the text published at NIS2-info.eu: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report no later than one month after the notification.

If you suspect you are in scope, a gap assessment is the sensible first step. Our guide to running a NIS2 gap assessment shows what to check, and the NIS2 standard page lists who is covered.

Personal data in every industry: GDPR

GDPR does not belong to a sector. It applies wherever you process personal data of people in the EU, which means hospitals, retailers, recruiters, schools, software vendors and banks alike. The result is that nearly every company has at least one regime to manage, however small it is.

For healthcare, GDPR matters because patient records are among the most sensitive data a company can hold. For retail, it covers customer accounts, marketing lists and loyalty data. For SaaS companies, it shapes processor contracts, data location and subprocessor lists. Storing data inside the EU simplifies several of those questions, which is one reason we keep all Guardiso data in the European Union. You can read how we protect it on our security page.

In the UK, UK GDPR and the Data Protection Act 2018 play the same role. Companies selling in both markets usually build one privacy programme and add local variations.

Payments and retail: PCI DSS

Any business that stores, processes or transmits payment card data is expected to follow PCI DSS, which is a contractual industry standard rather than a law. Acquiring banks and card schemes enforce it through merchant agreements. Retailers, online shops, hotels and payment service providers meet it most often. Our PCI DSS page explains who it covers.

The point for scoping is that PCI DSS and GDPR overlap. Access control, logging, encryption and incident response show up in both, so one set of evidence can answer both.

Manufacturing, devices and products

Product sectors follow a different logic. The European Commission’s Your Europe portal explains that manufacturers, inside or outside the EU, must identify the applicable product rules, carry out conformity assessment, prepare technical documentation and an EU declaration of conformity, provide safety information and meet traceability requirements. Documentation and the declaration must be kept for 10 years after the product is placed on the market, or for the period EU law specifies.

The same guidance shows that headquarters location is not the test. A non-EU business placing products on the EU market faces the same obligations as an EU one.

Medical devices have their own regime. Our pages explain the EU MDR and the UK MDR 2002. Manufacturers of critical medical devices can also fall under NIS2 in the health sector.

UK specifics: Cyber Essentials and public contracts

In Great Britain, many suppliers meet buyers’ expectations through Cyber Essentials, a baseline scheme of technical controls often requested in public procurement. Our Cyber Essentials page sets out who it covers. UK companies that also serve EU customers can still fall within NIS2 or DORA through their customers’ supply chains, so a UK address does not remove EU obligations by itself.

Where ISO 27001 fits

ISO 27001 is the cross-industry framework most often named in customer questionnaires. It specifies an information security management system that suits any size and sector. Because it is voluntary, it is not what the law asks for. Still, its structure of risk assessment, policies, controls, internal audit and management review lines up closely with what NIS2, DORA and GDPR expect. That is why it is a common backbone.

When a buyer in finance, healthcare or the public sector asks a supplier to prove security, an ISO 27001 certificate or a mapped control set is usually the quickest answer. Guardiso is an ISO 27001 certified company, so we work with the framework daily.

Does company size change what applies?

Size changes how much you must do and, in some regimes, whether you are in scope at all. The European Commission’s 2025 voluntary standard for small undertakings uses thresholds of two out of three criteria: micro enterprises up to €450,000 balance sheet, €900,000 turnover and 10 employees; small enterprises up to €5 million, €10 million and 50 employees; medium enterprises up to €25 million, €50 million and 250 employees.

Those are definitions for sustainability reporting. Other laws set their own tests. Sustainability reporting under CSRD, for example, applies to large undertakings, non-micro listed SMEs and parent companies of large groups, and national law shapes the detail because it is a directive. NIS2 uses sector plus size. DORA uses the type of financial entity. GDPR uses the activity of processing personal data.

For a company of 10 to 250 employees the working method is:

1. List what you do: sectors served, products sold, data handled, countries of customers.
2. Match each activity to the regimes in the table above.
3. Check the official text and your national implementing law for scope.
4. Record the decision and the reason, so you can show it to a regulator or customer.

It is easy to skip step 4. A written scoping decision is evidence in itself.

What regulators and auditors expect to see

Across regimes, the evidence duties look alike. You need documented policies, a risk register, assigned owners, records that controls operate, incident logs, supplier oversight and management sign-off. Consequences differ by regime and country. For instance, penalties under the Accounting Directive as amended by CSRD may include a public statement naming the company, a correction order and financial penalties set nationally. Check each regime’s official text for its own sanctions.

In the UK, directors carry personal duties. The ICAEW’s guide explains that directors must keep adequate accounting records and that approving defective accounts can be a criminal offence in specific circumstances. Compliance is a management responsibility as well as a technical one.

How to manage overlapping requirements without repeating work

The expensive mistake is treating each regime as a separate project. Most regimes ask for versions of the same things: an asset inventory, a risk assessment, access control, incident response, supplier management and training.

A workable approach:

1. Build one control set. Start with a framework such as ISO 27001 and write each control once.
2. Map controls to requirements. For every NIS2 measure, DORA article or GDPR obligation, record which control satisfies it.
3. Collect evidence once. One access review, one incident test or one supplier assessment can back several mappings.
4. Assign owners and dates. Each control needs a named person and a review cycle.
5. Track status in one place. Open tasks, risks and gaps belong in a single view, so management sees the real position.
6. Prepare the auditor pack early. Gather evidence continuously, not in the weeks before an audit.

Doing this in spreadsheets works for one framework and gets heavy with two. That is where a dedicated platform earns its place.

How Guardiso handles several regimes in one system

Guardiso is a platform for governance, risk and compliance. In one system you run ISO 27001, GDPR, NIS2, DORA, SOC 2, ISO 22301 and about 30 other standards. One set of documents and evidence serves many regulations, so your team does not repeat the same work for each new framework. Our standards mapping, document and policy templates, risk and evidence registers and audit planning cover the cycle from implementation to audit. Ready policies are available in English and Polish.

Evidence collection runs through integrations with tools such as Microsoft 365, GitHub and AWS. Before an audit, Guardiso prepares a complete evidence pack for the auditor, and the auditor portal supports electronic signatures. A board dashboard shows compliance status, risks and open tasks, and a public Trust Center lets you share status with customers and partners. You can browse every supported framework on our standards page.

Plans are published: Starter costs €199 per month and Professional costs €499 per month, with Enterprise priced on request. See the pricing page for what each includes. If you need hands-on help, we also offer security audits for ISO, NIS2 and DORA, penetration tests, vulnerability assessments and a virtual security officer service through our services pages.

To see how the platform handles your mix of regulations, start from the compliance platform overview.

FAQ

Which compliance regulations apply to my industry?

Start with your sector and activity. Financial entities look to DORA, critical sectors to NIS2, anyone processing personal data to GDPR, card-accepting merchants to PCI DSS and manufacturers to EU product rules. Confirm scope in the official text and your national law.

What is the difference between a compliance regulation and a framework?

A regulation is binding law, such as GDPR or DORA. A framework, such as ISO 27001, is a structured set of controls you adopt to meet legal and customer requirements. Frameworks are usually voluntary, though contracts can make them mandatory in practice.

Is ISO 27001 mandatory?

ISO 27001 is a voluntary standard adopted across sectors, according to ENISA. Many buyers still ask for it, and its controls map well to NIS2, DORA and GDPR, so it is a practical foundation for proving security.

Does NIS2 apply to small companies?

NIS2 mainly covers organisations in listed critical sectors, usually of medium size or above, with exceptions for certain entities regardless of size. Because it is a directive, check your Member State’s implementing law for the exact threshold.

Can one set of evidence serve several regulations?

Yes. Controls such as access management, incident response and supplier oversight appear in many regimes. Map each control to every requirement it satisfies, then collect the evidence once and reuse it.

Sources

• EU law framework: cutting through the jargon
• Standardisation in Europe: technical requirements
• ENISA: Auditing Security Measures
• DORA and NIS2 newsletter, Potamitis Vekris
• Cyber risk: how UK and EU banks will navigate incident reporting, Mayer Brown
• EUR-Lex: Cybersecurity of network and information systems
• DORA and NIS2: building digital resilience in the EU, C-Risk
• NIS2 Directive Article 23: reporting obligations
• General product compliance, Your Europe
• European Commission voluntary sustainability reporting standard for SMEs
• PwC: overview of the sustainability reporting regulation
• Greenly: what is the CSRD
• ICAEW: directors’ responsibilities for corporate administration

Recommended

• Standards: ISO 27001, GDPR, NIS2, DORA and more
• KRI: what it is, who it covers
• DCB0129: what it is, who it covers