DORA
Data & Privacy
- Data Act
- Data Governance Act
- ePrivacy Directive
- GDPR
AI & Trust
- Artificial Intelligence Act
Cybersecurity
- Cybersecurity Act
- DORA
- NIS2
Digital Services & Media
- Digital Markets Act
- Digital Services Act
- European Media Freedom Act
Digital Operational Resilience Act
- Recitals
CHAPTER I
General provisionsArticles 1 — 4
CHAPTER II
ICT risk managementArticles 5 — 16
CHAPTER III
ICT-related incident management, classification and reportingArticles 17 — 23
CHAPTER IV
Digital operational resilience testingArticles 24 — 27
CHAPTER V
Managing of ICT third-party riskArticles 28 — 44
CHAPTER VI
Information-sharing arrangementsArticles 45 — 45
CHAPTER VII
Competent authoritiesArticles 46 — 56
CHAPTER VIII
Delegated actsArticles 57 — 57
CHAPTER IX
Transitional and final provisionsArticles 58 — 64
DORA
DORA Article 51. Exercise of the power to impose administrative penalties and remedial measures
- 1.Competent authorities shall exercise the powers to impose administrative penalties and remedial measures referred to in Article 50 in accordance with their national legal frameworks, where appropriate, as follows:
- (a)directly;
- (b)in collaboration with other authorities;
- (c)under their responsibility by delegation to other authorities; or
- (d)by application to the competent judicial authorities.
- 2.Competent authorities, when determining the type and level of an administrative penalty or remedial measure to be imposed under Article 50, shall take into account the extent to which the breach is intentional or results from negligence, and all other relevant circumstances, including the following, where appropriate:
- (a)the materiality, gravity and the duration of the breach;
- (b)the degree of responsibility of the natural or legal person responsible for the breach;
- (c)the financial strength of the responsible natural or legal person;
- (d)the importance of profits gained or losses avoided by the responsible natural or legal person, insofar as they can be determined;
- (e)the losses for third parties caused by the breach, insofar as they can be determined;
- (f)the level of cooperation of the responsible natural or legal person with the competent authority, without prejudice to the need to ensure disgorgement of profits gained or losses avoided by that natural or legal person;
- (g)previous breaches by the responsible natural or legal person.