The European Data Protection Board (“EDPB”) and the European Data Protection Supervisor (“EDPS”) recently published their Joint Opinion 4/2026 (the “Opinion”) on the European’s Commission’s proposal for a Cybersecurity Act 2 and proposal for targeted amendments to the NIS 2 Directive (together, the “Proposals”) (previously discussed here).
The EDPB and EDPS generally support and welcome the Proposals. However, the Opinion acknowledges that the relationship between data protection and cybersecurity is “double-sided”. On the one hand, cybersecurity serves the protection of personal data by limiting the risks of unwanted access, modification or unavailability of that data. On the other hand, some cybersecurity measures can interfere with individuals’ rights and freedoms, in particular the rights to privacy and data protection. The Opinion emphasises the need to balance the effectiveness of cybersecurity measures against what is necessary and proportionate, having regard to the impact on