Privacy Map

European Union. Cybersecurity. Directive (EU) 2016/1148

NIS Directive (NIS1)NIS Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems

Repealed/superseded

§1Summary

Synopsis

Directive (EU) 2016/1148 was the first EU-wide cybersecurity law. It required Member States to adopt a national network and information security strategy, set up national authorities and computer security incident response teams, and impose security and incident notification duties on operators of essential services and on digital service providers. Directive (EU) 2022/2555 (NIS2) repealed it with effect from 18 October 2024.

Key themes
  • network and information security
  • operators of essential services
  • digital service providers
  • incident notification
Unique features

Left Member States to identify operators of essential services; NIS2 replaced this with size-based scope.

SaaS relevance

Historical only; replaced by NIS2 (Directive (EU) 2022/2555).

§2Obligations

Breach notification
Incident notification to the competent authority or CSIRT (Member State rules)
DPO
No
Cross-border transfers
Cooperation Group and CSIRTs network
Maximum penalty
Set by Member States ('effective, proportionate and dissuasive')

§3Dates

Key dates
  • Adopted
  • In force
  • Ended
  • Adopted 6 July 2016; published 19 July 2016; in force 8 August 2016; Member States to apply by 9 May 2018; repealed with effect from 18 October 2024 by Directive (EU) 2022/2555 (NIS2)

§4Text and authority

Text
Authority
National competent authorities and CSIRTs; Cooperation Group

§5Where it applies

Also applies in

§6Sources and verification

Sources consulted
Verification

High confidence.

In force date is the 20th day after the 19 July 2016 publication (Article 26). Repeal date from Article 44 of NIS2. Scope, breach and penalty fields are summarised from the Directive's structure and were not read in full.