NIS2 · GDPR

Healthcare

Hospitals, laboratories and medical device makers are essential entities under NIS2, and they process the most sensitive category of personal data there is.

WHAT MAKES THIS SECTOR DIFFERENT

Where the pressure actually comes from

Two regimes land on the same incident. A ransomware outage is a NIS2 reportable event within 24 hours, and if patient records were reachable it is also a GDPR breach with a 72-hour clock and a different regulator. Device manufacturers pick up a third set of duties as the CRA phases in.

WHICH RULES CATCH YOU

Start here, in this order

96 days left

NIS2 / ZInfV-1

Slovenia's Information Security Act, in force since 19 June 2025, took the number of obliged organisations from roughly 100 to roughly 1,000. Risk measures, incident reporting, supply-chain security and training, supervised by URSIV.

Cyber Resilience Act

Anyone placing hardware or software with digital elements on the EU market: secure by design, secure defaults, signed updates, and reporting of actively exploited vulnerabilities. Reporting duties start first; full compliance follows on 11 December 2027.

GDPR / ZVOP-2

The oldest of these and still the most enforced. ZVOP-2 has been the Slovenian implementing act since January 2023, supervised by the Informacijski pooblaščenec. A breach exposing personal data is reportable within 72 hours whether or not ZInfV-1 also catches you — one incident, two clocks, two regulators.

WHAT WE DO ABOUT IT

The three that matter most here

SOCaaS