The convention is the first legally binding international instrument in the data protection field. It applies to all data processing carried out by both the private and public sectors, including data processing by the judiciary and law enforcement authorities. It seeks to both protect individuals and to regulate the trans-border flows of personal data.
The directive sets out the framework for data protection regulation in the European Union. It regulates and strictly limits the processing, including the collection, use, storage, disclosure, and destruction of personal data about individuals, both by automated means (e.g., a computer database of customers) and data contained in or intended to be part of non-automated filing systems (traditional paper files).
The Agency works closely together with EU Member States, Commissions, and other stakeholders to provide advice and solutions in meeting the requirements or matters of network and information security and improving their cybersecurity capabilities. It also supports the development of a collaborative response to large-scale cross-border cybersecurity incidents or crises, and it has been developing cybersecurity certification schemes since 2019.
It is the cornerstone of the common cybersecurity policy in European Union. It is also the first text to openly use the term “cybersecurity”. Member States are directed to establish a National Computer Emergency Response Team (CERT) and a competent cybersecurity authority to represent the country in European-level discussions.
is designed to approximate the criminal law of the EU member states in the area of attacks against information systems by among other things establishing minimum rules concerning the definition of criminal offences.
The regulation repeals and replaces the Electronic Signatures Directive 1999/93/EC. It is the first European regulation that approach cybersecurity topics from a solution standpoint, establishing the conditions for the development of electronic identification and trust services, and creating standards for creation and verification of signatures. It establishes measures for national electronic identification schemes, electronic signatures, electronic seals, time stamping, electronic delivery service and website authentication.
The Directive clarifies and complements some of NIS rules. It aims to ensure a high and common level of security for the networks and information systems of the EU, with the implementation of a cyber-resilience program with three major components: 1.) robust cybersecurity defenses; 2.) preventive measures against cyber risks; 3.) incident management and reporting systems and tools. It applies to 2 categories of central players: digital service providers (DSP) and operators of essential services (OES), to be defined and listed by each Member State. It also led to the creation of the NIS Cooperation Group among Member States, coordinated by the ENISA, to support and facilitate strategic cooperation and the exchange of information on risks and network and information system security incidents.
The regulation established protections for privacy and security of personal data about individuals in European Economic Area (EEA)-based operations and certain non-EEA organizations that process personal data of individuals in the EEA. Preamble of GDPR states: "The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data. This Regulation is intended to contribute to the accomplishment of an area of freedom, security and justice and of an economic union, to economic and social progress, to the strengthening and the convergence of the economies within the internal market, and to the well-being of natural persons."
Convention 108+ contains important innovations. It consolidates the proportionality requirement for data processing and strengthens the data subjects' arsenal of rights. It requires notification of security breaches and reinforces the responsibility of those in charge of data processing. It strengthens the supervisory authorities' independence, powers, and means of action. It also strengthens the mechanism for ensuring its effective implementation by entrusting the Committee established by the Convention with the task of verifying Parties' compliance with their commitments.
The Act is the second cornerstone of the EU legislation on cybersecurity, bringing forward awareness on the new needs in terms of cybersecurity, resilience, and cooperation in the EU. The Act promotes two main points, namely he European Cybersecurity Certification Framework which provides companies with EU-wide certification schemes in a package of comprehensive set of rules, technical requirements, standards and procedures, as well as the strengthening of the European Network Information Security Agency (ENISA), the official European Union Agency for Cybersecurity.
This second new strategy aims to ensure a global and open Internet with strong safeguards in the event of risk to European citizens' security. It is a major update to the first EUCSS, with the primary goal of implementing and promoting three areas of EU action: 1.) Increasing resilience, technological sovereignty, and leadership; 2.) Increasing operational capacity to prevent, deter, and respond; 3.) Advancing a global and open cyberspace through increased cooperation. The most well-known change mentioned was the announcement of the NIS 2 Directive, an upgrade and update to the NIS Directive.
The Act aims to improve the transparency on the security of hardware and software products and introduces rules, through a coherent cybersecurity framework, to ensure that manufacturers remain responsible for the cybersecurity throughout their products’ lifecycle. The Act carries its own set of penalties in case of incompliance, third party vendors would see themselves fined up to €15,000,000 or at the level of their 2.5% of their annual turnover (whichever the highest).
The EU cybersecurity rules introduced in 2016 were updated by the NIS2 Directive that came into force in 2023. It provides legal measures to boost the overall level of cybersecurity in the EU, by modernizing the existing legal framework and expanding the scope of the cybersecurity rules to new sectors and entities, it further improves the resilience and incident response capacities of public and private entities, competent authorities and the EU as a whole.