DORA & GDPR Compliance Assessment
A fictional DORA and GDPR reporting assessment with separate decision timelines.
A fictional EU financial-services exercise comparing DORA major ICT incident classification and GDPR personal-data breach reporting through separate decisions, reporting clocks and evidence gates.
- My contribution
- Modeled separate incident-reporting decisions
- Evidence / output
- 19 selected checkpoints and five illustrative reporting clocks
- Scope
- Fictional regulatory exercise
Repository updated · Snapshot checked 6 Nov 2026 (UTC)
Project context
The same security event can trigger different legal and operational obligations. The exercise explores defensible assessment, documentation and escalation without conflating DORA major incidents and GDPR personal-data breaches.
What I did
- Defined three contrasting invented incidents for a fictional EU financial entity.
- Mapped 19 selected DORA/GDPR obligations, fictional ICT arrangements and evidence gaps.
- Added nine edge-case classification exercises and five illustrative reporting clocks.
- Drafted six explicitly unsent communications and a tabletop-only resilience and remediation workflow.
Evidence and outcomes
- Separate incident and reporting-clock registers preserve regulatory distinctions.
- Every mock communication is marked unsent and hypothetical.
- Automated checks test timeline arithmetic and cross-file traceability.
Full documentation and source files are in the public GitHub repository.
Limitations
Entirely fictional regulatory case study. No reports were sent, no legal opinion was issued, and no real resilience recovery was verified.