EDPB and EDPS adopt joint opinion on EU Cybersecurity Act and NIS2 amendments
The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted Joint Opinion 4/2026 assessing the European Commission’s proposals for a revised EU Cybersecurity Act and amendments to the EU NIS 2 Directive (NIS2), following a formal consultation. They supported the overall objectives of strengthening the European Union Agency for Cybersecurity’s (ENISA’s) role, reviving the European cybersecurity certification framework, simplifying compliance, and addressing information and communication technology (ICT) supply chain risks, while underlining that cybersecurity measures must remain necessary and proportionate to avoid undue interference with privacy and data protection. They welcomed improved cooperation mechanisms and a single-entry point for incident and personal data breach reporting. They recommended safeguards where ENISA processes personal data, including clear legislative limits and prior EDPS consultation, extending the European Cybersecurity Skills Framework to the general workforce, clarifying links with EU General Data Protection Regulation certification, supporting ICT supply chain measures and the designation of digital identity and business wallet providers as essential entities, and ensuring safeguards for ransomware reporting.