NIS2 Compliance Checklist for Customer Data and Martech Systems

A NIS2 compliance checklist for customer data systems has five parts: confirm you are an essential or important entity (Annex I or II), map the ten Article 21 measures to every system holding customer data, including your customer data platform (CDP) and marketing vendors, prepare a 24-hour early warning, record board approval and training, and follow your national transposition law 1.

Who this is for: CISOs, data protection officers and heads of marketing operations in the EU. You get a scope table, a measure-by-measure map, the incident clock, a transposition snapshot and a checklist. Hub: regulation.

Who is in scope: Annex I, Annex II and the size rule

Directive (EU) 2022/2555 (NIS2) covers public and private entities of a type listed in Annex I or II that are medium-sized or larger and provide services or carry out activities in the EU 1. Medium-sized means fewer than 250 staff and turnover up to €50 million or a balance sheet up to €43 million; the small-enterprise ceiling is fewer than 50 staff and €10 million, and group figures can count 7. Some entities are covered whatever their size, including public electronic communications providers, trust service providers, and DNS and top-level-domain (TLD) registries 1.

Source: Annexes I and II 1.

Essential or important? Annex I entities above the medium-sized ceilings are essential, as are qualified trust service providers, TLD registries, DNS providers and central government bodies. Other Annex I and II entities are important 1. For breaches of Articles 21 or 23, maximum fines must reach at least €10 million or 2% of worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important entities, whichever is higher 1.

Lists. Member States had to establish lists of essential and important entities by 17 April 2025 and review them every two years; entities report changes within two weeks 1. If your authority has not contacted you, check whether you must register.

Banks and DORA. Credit institutions are in Annex I, but recital 28 treats Regulation (EU) 2022/2554 (DORA) as the sector-specific regime for the financial entities it covers 1. Our DORA article covers registers and vendor contracts.

Do NIS2 requirements reach marketing systems?

The Directive regulates entities, not departments, and names no marketing systems. Article 21 requires in-scope entities to manage risks to the network and information systems they use, and recital 83 confirms this holds whether those systems are run in-house or outsourced 1. Article 6 defines such a system as any device or group of related devices that processes digital data, plus the data 1. A CDP, consent platform, tag manager, email service and analytics warehouse all fit when they support your services.

Their rank in your risk register is a judgement your risk analysis must record. Our reading, not the Directive's text, is that a CDP rates high: it concentrates identity data and can message every customer, making it a breach target and a phishing route.

The ten Article 21 measures mapped to customer data and martech

Article 21(2) lists ten measures that must be included at least, within an all-hazards approach proportionate to risk, size and cost 1. For cloud, data centre, managed service and similar digital providers, Commission Implementing Regulation (EU) 2024/2690 sets detailed requirements, and ENISA published guidance on it in June 2025 28.

Source: Article 21(2) 1; the applications are ours. For its entity types, the implementing regulation adds least-privilege access with a register, separate privileged accounts and full key lifecycle management 2.

Supply chain security for SaaS and martech vendors

Article 21(2)(d) requires supply chain security, including relationships with direct suppliers and service providers. Article 21(3) says what to weigh: each direct supplier's specific vulnerabilities, the overall quality of its products and cybersecurity practices including secure development, and the results of coordinated EU risk assessments under Article 22(1) 1. Recital 85 encourages building security measures into contracts 1. Incidents rarely stop at direct suppliers, so also ask about sub-processors. The implementing regulation's supply chain annex is a usable template 2.

Our vendor lock-in clauses, vendor register worksheet and cloud exit template turn this into working documents.

SaaS versus customer-owned deployment. SaaS shifts patching to the vendor but ties your reporting clock to its notice. A customer-owned deployment (on-premise, or private cloud in your own account) gives you control of logs, keys and timing, and also makes you responsible for patching, backup and round-the-clock operations. Neither is automatically compliant. With a single-tenant platform such as PrivyCDP, the supply chain question becomes software provenance, updates and vulnerability disclosure. Our self-hosting guide explains when that is a bad idea.

NIS2 incident reporting: 24 hours, 72 hours, one month

An incident is significant if it has caused or can cause severe operational disruption or financial loss, or has affected or can affect other persons through considerable material or non-material damage. Notify your national computer security incident response team (CSIRT) or competent authority without undue delay [1, Art. 23].

Source: Article 23(4) 1. Trust service providers notify within 24 hours instead of 72. Notification alone does not add to the notifier's liability 1.

The customer-data wrinkle. One platform incident can start two clocks: the NIS2 early warning in 24 hours and, if personal data is breached, a GDPR Article 33 notice to the supervisory authority where feasible within 72 hours of awareness, with processors telling controllers without undue delay 9. Recipients, content and thresholds differ, so build one runbook with two branches. A single reporting point proposed in the Digital Omnibus is not law 6.

Vendor-detected incidents. If your platform is SaaS, you may learn of an incident from the vendor, so set its contractual notice period well inside your 24 hours. Cloud and managed service providers use their own significant-incident thresholds, such as direct financial loss above €500,000 or 5% of annual turnover, whichever is lower 2.

Management liability and training

Article 20 requires management bodies to approve the risk-management measures, oversee their implementation and complete training, and they can be held liable for infringements of Article 21 1. For essential entities, responsible natural persons can be held liable and authorities can seek a temporary ban on a chief executive or legal representative exercising managerial functions if other measures fail; that power excludes public administration and is not listed for important entities [1, Arts. 32-33].

NIS2 transposition status in 2026

Member States had to adopt transposition measures by 17 October 2024 and apply them from 18 October 2024 1. On 7 May 2025 the Commission sent reasoned opinions to 19 Member States for failing to notify full transposition 4. Its country pages were last updated in July 2025, so use a tracker. The European Cyber Security Organisation (ECSO) tracker, updated 10 September 2026, lists 24 of 27 Member States as transposed and France, Ireland and Spain at draft-law stage 5.

On 20 January 2026 the Commission proposed targeted amendments (COM(2026) 13) on jurisdiction rules, ransomware data collection and ENISA's coordinating role in cross-border supervision 6, which it says would ease compliance for 28,700 companies, including 6,200 micro and small enterprises 3. It is only a proposal: today's obligations are the Directive plus national law. In several countries, build to the Article 21 baseline and keep a national annex per country. Dates sit in our deadline tracker.

NIS2 compliance checklist for customer data systems

Scope

• Decide per legal entity: Annex I or II, size rule (including group figures), essential or important, competent authority.
• Confirm listing or registration duties in every Member State where you provide services, and which duties come from DORA if you are a financial entity.

Governance

• Management approves the measures and takes training; minutes and records kept.
• Named owners for customer-data systems and each critical vendor; board approval minuted.

Measures applied to customer data

• CDP, consent store, messaging tools, tag manager, warehouse and exports are in the risk register.
• Backup restore of profiles and consent state is tested.
• Least privilege and MFA are enforced on every console.
• Encryption in transit and at rest; key custody documented.
• SDKs, tags, connectors and API keys are inventoried, patched and scanned.
• Control effectiveness, including a vendor-breach tabletop, is tested at least annually; marketing operators are trained.

Vendors

• Register of services, data, hosting location and sub-processors.
• Contracts cover incident notice inside your 24 hours, audit rights, vulnerability handling, subcontractors, data return and deletion.
• Each vendor states whether it is a NIS2 entity and who supervises it.
• Tested exit plan and export for every critical vendor.

Incidents and evidence

• Runbook with 24-hour, 72-hour and one-month steps, authority contacts and an early-warning template.
• One decision tree for NIS2, GDPR Article 33 and sector rules.
• Logs, approvals and policy versions retained for audit.

If your NIS2 programme includes bringing customer data processing into infrastructure you operate, our deployment qualification shows how a customer-owned deployment is scoped and what your team would run. Controls are summarised on the security page; the regulation hub lists the other playbooks.