Ireland—Banking & Financial Service analysis: This article, was written by Patrick Brandt, Ciara Brady, Louise Hogan and Sarah Lee of A&L Goodbody LLP.

This Practice Note outlines the key requirements of Regulation (EU) 2022/2554 (the Digital Operational Resilience Act or DORA) and Directive (EU) 2022/2556 amending certain Directives as regards digital operational resilience for the financial sector (the Amending Directive). What is DORA? On 24 September 2020, the European Commission published proposals for a Regulation on digital operational resilience for the financial sector (the Digital Operational Resilience Act or DORA) and a Directive amending digital operational resilience requirements in directives 2006/43/EC, 2009/65/EC, 2009/138/EU, 2011/61/EU, EU/2013/36, 2014/65/EU, (EU) 2015/2366 and EU/2016/2341 (the Amending Directive). These proposals were part of the Commission’s Digital Finance Package. DORA is designed to consolidate and upgrade Information Communication Technologies (ICT) risk requirements throughout the EU financial sector to ensure that a very wide range of participants of the financial system are subject to a common set of standards to mitigate ICT risks for their operations. Specifically, DORA establishes requirements for dedicated ICT risk management capabilities, reporting of major ICT-related incidents, digital operational resilience testing, management by financial entities of ICT third-party risk, as well as information sharing among

The Data Protection Act 1998

Brexit: On 31 January 2020, the UK ceased to be an EU Member State and entered an implementation period, during which it continues to be subject to EU law. During this period, the GDPR applies in the UK and the UK generally continues to be treated as an EU (and EEA) state for EEA and UK data protection law purposes. Any references to EEA or EU states in this Practice Note should therefore be read to also include the UK until the end of the implementation period. For further guidance on that period, its duration and the data protection laws that are anticipated to apply after the end of it, see Practice Note: Brexit—implications for data protection [Archived]. ARCHIVED: This Practice Note is archived content and reflects the position prior to the General Data Protection Regulation becoming applicable. This Practice Note is for background information only and is not maintained. The General Data Protection Regulation (EU) 2016/679 (the GDPR) was published in the Official Journal of the EU on 4 May 2016.

Brexit: On 31 January 2020, the UK ceased to be an EU Member State and entered an implementation period, during which it continues to be subject to EU law. During this period, the GDPR applies in the UK and the UK generally continues to be treated as an EU (and EEA) state for EEA and UK data protection law purposes. Any references to EEA or EU states in this Practice Note should therefore be read to also include the UK until the end of the implementation period. For further guidance on that period, its duration and the data protection laws that are anticipated to apply after the end of it, see Practice Note: Brexit—implications for data protection [Archived]. ARCHIVED: This Practice Note is archived content and reflects the position prior to the General Data Protection Regulation becoming applicable. This Practice Note is for background information only and is not maintained. The General Data Protection Regulation (EU) 2016/679 (the GDPR) was published in the Official Journal of the EU on 4 May 2016.

Brexit: On 31 January 2020, the UK ceased to be an EU Member State and entered an implementation period, during which it continues to be subject to EU law. During this period, the GDPR applies in the UK and the UK generally continues to be treated as an EU (and EEA) state for EEA and UK data protection law purposes. Any references to EEA or EU states in this Practice Note should therefore be read to also include the UK until the end of the implementation period. For further guidance on that period, its duration and the data protection laws that are anticipated to apply after the end of it, see Practice Note: Brexit—implications for data protection [Archived]. ARCHIVED: This Practice Note is archived content and reflects the position prior to the General Data Protection Regulation becoming applicable. This Practice Note is for background information only and is not maintained. The General Data Protection Regulation (EU) 2016/679 (the GDPR) was published in the Official Journal of the EU on 4 May 2016. It came

Brexit: On 31 January 2020, the UK ceased to be an EU Member State and entered an implementation period, during which it continues to be subject to EU law. During this period, the GDPR applies in the UK and the UK generally continues to be treated as an EU (and EEA) state for EEA and UK data protection law purposes. Any references to EEA or EU states in this Practice Note should therefore be read to also include the UK until the end of the implementation period. For further guidance on that period, its duration and the data protection laws that are anticipated to apply after the end of it, see Practice Note: Brexit—implications for data protection [Archived]. ARCHIVED: This Practice Note is archived content and reflects the position prior to the General Data Protection Regulation becoming applicable. This Practice Note is for background information only and is not maintained. The General Data Protection Regulation (EU) 2016/679 (the GDPR) was published in the Official Journal of the EU on 4

Brexit: On 31 January 2020, the UK ceased to be an EU Member State and entered an implementation period, during which it continues to be subject to EU law. During this period, the GDPR applies in the UK and the UK generally continues to be treated as an EU (and EEA) state for EEA and UK data protection law purposes. Any references to EEA or EU states in this Practice Note should therefore be read to also include the UK until the end of the implementation period. For further guidance on that period, its duration and the data protection laws that are anticipated to apply after the end of it, see Practice Note: Brexit—implications for data protection [Archived]. ARCHIVED: This Practice Note is archived content and reflects the position prior to the General Data Protection Regulation becoming applicable. This Practice Note is for background information only and is not maintained. The General Data Protection Regulation (EU) 2016/679 (the GDPR) was published in the Official Journal of the European Union

Brexit: On 31 January 2020, the UK ceased to be an EU Member State and entered an implementation period, during which it continues to be subject to EU law. During this period, the GDPR applies in the UK and the UK generally continues to be treated as an EU (and EEA) state for EEA and UK data protection law purposes. Any references to EEA or EU states in this Practice Note should therefore be read to also include the UK until the end of the implementation period. For further guidance on that period, its duration and the data protection laws that are anticipated to apply after the end of it, see Practice Note: Brexit—implications for data protection [Archived]. ARCHIVED: This Practice Note is archived content and reflects the position prior to the General Data Protection Regulation becoming applicable. This Practice Note is for background information only and is not maintained. The General Data Protection Regulation (Regulation (EU) 2016/679) (the GDPR) was published in the Official Journal of the European

Brexit: On 31 January 2020, the UK ceased to be an EU Member State and entered an implementation period, during which it continues to be subject to EU law. During this period, the GDPR applies in the UK and the UK generally continues to be treated as an EU (and EEA) state for EEA and UK data protection law purposes. Any references to EEA or EU states in this Practice Note should therefore be read to also include the UK until the end of the implementation period. For further guidance on that period, its duration and the data protection laws that are anticipated to apply after the end of it, see Practice Note: Brexit—implications for data protection [Archived]. ARCHIVED: This Practice Note is archived content and reflects the position prior to the General Data Protection Regulation becoming applicable. This Practice Note is for background information only and is not maintained. The General Data Protection Regulation (EU) 2016/679 (the GDPR) was published in the Official Journal of the EU on 4 May 2016. It

Brexit: On 31 January 2020, the UK ceased to be an EU Member State and entered an implementation period, during which it continues to be subject to EU law. During this period, the GDPR applies in the UK and the UK generally continues to be treated as an EU (and EEA) state for EEA and UK data protection law purposes. Any references to EEA or EU states in this Practice Note should therefore be read to also include the UK until the end of the implementation period. For further guidance on that period, its duration and the data protection laws that are anticipated to apply after the end of it, see Practice Note: Brexit—implications for data protection [Archived]. ARCHIVED: This Practice Note is archived content and reflects the position prior to the General Data Protection Regulation becoming applicable. This Practice Note is for background information only and is not maintained. The General Data Protection Regulation (EU) 2016/679 (the GDPR) was published in the Official Journal of the EU on 4 May 2016.

Brexit: On 31 January 2020, the UK ceased to be an EU Member State and entered an implementation period, during which it continues to be subject to EU law. During this period, the GDPR applies in the UK and the UK generally continues to be treated as an EU (and EEA) state for EEA and UK data protection law purposes. Any references to EEA or EU states in this Practice Note should therefore be read to also include the UK until the end of the implementation period. For further guidance on that period, its duration and the data protection laws that are anticipated to apply after the end of it, see Practice Note: Brexit—implications for data protection [Archived]. ARCHIVED: This Practice Note is archived content and reflects the position prior to the General Data Protection Regulation becoming applicable. This Practice Note is for background information only and is not maintained. The General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR) was published in the Official Journal of the European Union