Authored by:
Kolvin Stone,
Aravind Swaminathan,
Antony P. Kim and
Shea G. Leitch
On July 6, 2016, the European Parliament passed the Network and
Information Security ("NIS") Directive, over three years
after the initial draft was proposed. The Directive will
enter into force in August 2016. EU Member States will then
have 21 months to transpose the Directive into their national laws
and 6 additional months to identify the operators of certain
essential services that are subject to the Directive's
requirements.
In short, the NIS Directive will impose comprehensive
cybersecurity and breach reporting requirements on critical
infrastructure operators. Unlike the breach reporting
obligations under the General Data Protection Regulation that
require notification to individuals in an incident where personal
data is compromised, the NIS Directive will impose an obligation to
report incidents to the relevant authority without regard to
whether personal data is
