Report: EU Digital Operational Resilience Regulation (DORA) - Global Privacy Law Review View Report: EU Digital Operational Resilience Regulation (DORA) by - Global Privacy Law Review Report: EU Digital Operational Resilience Regulation (DORA) 6 1

The EU Digital Operational Resilience Regulation 2022/2554 (DORA) is part of the EU’s Digital Finance Package and applies from 17 January 2025. The intention of DORA is to foster digital resilience in the financial services sector by addressing risk management in relation to information and communications technology (ICT) services, ICT risks and ICT third-party service providers. DORA aims to provide a comprehensive and harmonized regulatory framework by providing financial services (FS) entities with clarity on digital operational resilience requirements, including requirements that need to be incorporated into FS entities’ contracts with their ICT third party service providers.

This article provides an overview of DORA, focussing on its scope and applicability and how it differs from previous regulation and guidance in the FS sector. This report also addresses the key issues for FS entities to consider in managing ICT third-party risks, particularly in relation to their remediation of contracts with ICT third-party service providers.

Global Privacy Law Review