NIS2 and personal data: you can't protect what you can't find

Key takeaways

• NIS2 covers far more organisations than the first NIS directive. Medium-sized and large companies in 18 sectors can be in scope, from energy and health to manufacturing and digital services.
• Companies outside its scope are still affected indirectly. Organisations in scope must manage supply chain security, so the requirements reach their suppliers through contracts and questionnaires.
• NIS2 work starts with resilience. Risk management, incident handling, backup, suppliers and access control come first. Personal data takes up little space.
• Personal data is still part of the asset picture. Classification and access control depend on knowing where sensitive information sits, including copies outside the main systems.
• NIS2 does not require data minimisation. GDPR does. Both frameworks, though, reward holding less data that could be stolen or exposed in an incident.
• Putting the GDPR clean-up on hold leaves the exposure in place. Small teams often have to sequence the work, and the data waits in the meantime.
• The groundwork overlaps. An accurate overview of where personal data lives supports the NIS2 asset inventory and the GDPR clean-up at the same time.

Who does NIS2 cover?

NIS2 is the EU's updated directive on network and information security, formally Directive (EU) 2022/2555. It replaced the first NIS directive from 2016. Each member state turns it into national law, so the date obligations start and the authority that supervises them depend on where a company operates.

The directive covers 18 sectors. Annex I lists sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space. Annex II lists other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. In those sectors, medium-sized and large organisations are generally in scope. They are classed as essential entities, mostly large organisations in Annex I sectors, or as important entities, which covers the rest.

Many companies outside that list are still affected by NIS2 indirectly. Organisations in scope must manage security in their supply chain (Article 21(2)(d)), so their requirements reach suppliers through contracts and security questionnaires.

Early supervision focuses on resilience, and the first supervisory questionnaires we have seen reflect that. They cover policies, risk management, incident handling, logging, backup, supplier management and access control. Personal data gets very little attention. That is understandable: when a company has to show its services keep running after a ransomware attack, an old spreadsheet with personal ID numbers is not where an inspector starts.

NIS2 vs GDPR

The two frameworks overlap, but they protect different things.

GDPR protects people. It regulates how personal data is collected, used, stored and deleted, and it requires organisations to keep only what they need for as long as they need it.

NIS2 protects services. It regulates how essential entities manage the risk to the networks and information systems those services depend on, whatever kind of data runs through them.

The overlap sits in the security of personal data. GDPR Article 32 already requires appropriate technical and organisational measures. NIS2 asks for many of the same measures with more detail, from a different starting point. A significant incident can also trigger reporting under both laws, to different authorities.

Why personal data still matters under NIS2

NIS2 does not regulate personal data as such. It regulates risk to information systems, and most organisations' systems are full of personal data: customer records, HR files, payroll, patient or citizen records and years of correspondence.

Most of that data lives where it should, in core systems such as CRM, HR or case management, with defined owners and access rules. A lot of it does not. Over the years, copies have been exported to Excel, forwarded by email, saved in personal OneDrive folders and posted in Teams chats. Those copies sit outside the systems the asset register describes, and they carry the same sensitivity as the originals.

This is where NIS2 and personal data meet. You can only classify, protect and restrict access to information you know about.

Which NIS2 requirements touch personal data?

Several of the minimum measures in Article 21(2) of the directive depend on knowing where sensitive information sits. The Commission's Implementing Regulation (EU) 2024/2690 describes them in more detail. That regulation only binds certain digital service providers directly, so most organisations follow their national law and their supervisory authority's guidance. Its annex remains the most detailed public reference for what good practice looks like.

Asset management — Article 21(2)(i) Section 12 of the Implementing Regulation asks entities to set classification levels for all assets, including information, based on the protection they need. A classification scheme works on the data you have located. A spreadsheet with personal ID numbers in a forgotten folder has no classification at all.

Asset inventory — Article 21(2)(i) The same section describes an inventory where each asset has an owner, a required protection level and a location. An inventory that lists systems, but not the sensitive information spread around them, gives an incomplete picture of what needs protecting.

Access control — Article 21(2)(i) Access policies decide who may see what. They protect the systems you have mapped. Personal data copied into broadly shared SharePoint sites or old Teams channels falls outside those rules.

Cryptography and encryption — Article 21(2)(h) Encryption policies are usually set by classification level. Data that was never classified rarely gets the protection its content calls for.

Incident reporting — Article 23 After a significant incident, entities must notify the authorities in stages and assess the impact. If personal data was involved, a GDPR breach notification to the national data protection authority may follow within 72 hours. Both assessments are faster when you already know what data the affected accounts or systems hold.

None of these requirements is about personal data specifically. All of them are harder to meet when nobody knows where it is.

Where personal data hides in Microsoft 365

Scattered personal data rarely comes from carelessness. It builds up because people need to get their work done, and the quickest way often involves a copy.

Some common examples:

• Exports from core systems. Someone pulls a list of customers, patients or citizens from a CRM or case system into Excel to plan work or chase deadlines. The file stays in OneDrive long after the task is done.
• Email as an archive. CVs, contracts, medical notes, complaints and ID numbers arrive by email and stay in mailboxes for years, including the mailboxes of people who have changed roles or left.
• Teams chats and channels. Colleagues discuss a specific customer, employee or case in a chat to save time. The conversation, with names and details, stays searchable by everyone in the channel.
• Old SharePoint sites. Project sites from completed initiatives keep their documents, and often their broad permissions, after the project ends.
• Scanned documents and images. Signed forms, ID copies and photographed letters contain personal data that keyword searches rarely find.

Each of these is an information asset in practice. None of them is likely to appear in the asset register, because nobody decided to create them.

How much pressure are compliance teams under?

The people responsible for NIS2 need to understand demanding legal frameworks and know the company's infrastructure and processes in detail. When those are the same few people who already own GDPR, the two frameworks compete for their time.

The threat they are preparing for is concrete. Check Point Research has described a shift in how ransomware groups operate. In its figures, the number of organisations publicly named as data leak victims rose by 126% in the first quarter of 2025 compared with the same period a year earlier, as ransomware groups moved towards leaking stolen data.

When extortion depends on what attackers can take, the amount of sensitive data an organisation holds becomes part of its risk.

Why postponing the clean-up keeps the risk in place

We recently spoke with an organisation that was ready to start cleaning up personal data. The project was put on hold because an NIS2 gap analysis had to come first.

That is a reasonable priority. There is an inspection to answer, and resilience work protects services that citizens depend on.

The personal data is still there, though. It stays there until someone has time again, and with the same small team covering both frameworks, that could take a while.

Data minimisation is a GDPR principle, and NIS2 does not require it. NIS2 is built on reducing risk, and here the two frameworks point the same way. Data you no longer hold cannot be stolen or leaked. Every forgotten file with personal ID numbers adds to the consequences of the incident the organisation is already preparing for.

In our view, this is the hidden cost of treating NIS2 and GDPR as a queue. The NIS2 work moves forward, while the exposure the GDPR work would have removed stays exactly where it was.

A framework for sharing the groundwork between NIS2 and GDPR

For a small team, running NIS2 and GDPR as two separate projects means mapping the same environment twice. A more practical approach uses the overlap. Four layers can build on each other:

1. Extend the asset inventory to information. List the systems, and also the places where sensitive information collects outside them: mailboxes, OneDrive, SharePoint and Teams. This is where NIS2's asset management and GDPR's accountability principle ask for the same thing.
2. Classify by what the data actually contains. A classification scheme based on system names misses the personal ID numbers in an exported spreadsheet. Classification works better when it reflects what has been found, including scanned documents and images.
3. Align access with classification. Once you know where sensitive data sits, review who can reach it. Broad "anyone in the organisation" permissions on old SharePoint sites and large Teams channels are a common place to start.
4. Reduce the data itself. Delete what has passed its retention period or no longer has a legal basis. This is a GDPR obligation, and it also shrinks what an attacker could take, which supports the risk reduction NIS2 is built on.

The first three layers belong to NIS2 work and benefit GDPR. The fourth belongs to GDPR and benefits NIS2. An organisation that does them in one pass avoids doing the discovery twice.

How to get started with a small team

A small team cannot review hundreds of systems by hand. The starting point has to be narrower and, where possible, automated.

1. Get an overview of where personal data sits

Start with the Microsoft 365 environment, since that is where copies and exports tend to collect. You need to know which mailboxes, drives, sites and chats contain personal data, including in attachments and scanned files.

2. Prioritise the most sensitive categories

A name in an email signature carries little risk. Personal ID numbers, health information, HR cases, financial details and information about children carry a lot. Focus on the categories that would cause the most harm if leaked, and leave the rest for later.

Accuracy matters here. A tool that returns thousands of false positives creates a review task that a small team cannot finish.

3. Let employees clean up their own data

The person who created or received a file usually knows whether it is still needed. Giving employees a simple way to review findings in their own mailbox or OneDrive spreads the work across the organisation. It also builds the everyday awareness that both frameworks depend on.

4. Document what you find

Record where sensitive data was found, what was done with it and who is responsible for the remaining stores. That documentation can support the NIS2 asset inventory and GDPR's accountability requirement at the same time.

5. Repeat it

New exports and attachments appear every week. A one-off clean-up drifts out of date quickly, so regular scans keep the inventory close to reality.

NIS2 and personal data readiness checklist

Alongside an NIS2 gap analysis, any organisation can test its asset picture with a few questions:

• Does the asset inventory include information stored in email, OneDrive, SharePoint and Teams, or only the systems behind it?
• Can you say which mailboxes or drives contain personal ID numbers or health information today?
• Is sensitive information classified based on what it contains, rather than where it is supposed to be?
• Are permissions on old SharePoint sites and large Teams channels still appropriate?
• If an employee account were compromised tomorrow, could you assess what personal data it gave access to?
• Has personal data past its retention period been reviewed and deleted?
• Can IT and compliance find high-risk data without reviewing thousands of files by hand?
• Is there a recurring process, or does the clean-up depend on someone finding time?

These questions do not cover NIS2 as a whole. They cover the part of it that depends on knowing your data.

Compliance challenges

"We have to finish the NIS2 gap analysis first." That is often the right order for the inspection. It does not have to stop the discovery work, because an overview of where personal data sits feeds directly into the asset inventory the gap analysis will ask about.

"Personal data is barely mentioned in our NIS2 work." Often true, since NIS2 work starts with resilience. The data still counts as an information asset, and it is still what attackers look for when they move from encryption to extortion.

"There are two of us. We can't take on another project." Then the work has to be shared and automated. Discovery tools can do the searching, and employees can decide on their own files. The compliance team's job becomes following up and documenting.

"Employees already see NIS2 as one more set of rules." Asking people to clean up their own mailbox with a clear list of findings is a concrete, small task. It also shows them what sensitive data looks like in their daily work, which is the awareness both frameworks depend on.

"We're not in scope for NIS2." Check your customers. If you supply an organisation that is in scope, its supply chain requirements will likely reach you through contracts and security questionnaires. Being able to show where your own sensitive data sits makes those questionnaires easier to answer.

Frequently asked questions about NIS2 and personal data

Does NIS2 require data minimisation? No. Data minimisation is a GDPR principle (Article 5(1)(c)). NIS2 requires entities to manage risk to their information systems, and holding less sensitive data is one way to lower that risk.

Is personal data an information asset under NIS2? Yes, in the sense that NIS2's asset management covers information as well as systems. The Implementing Regulation (EU) 2024/2690 refers explicitly to classifying all assets, including information.

Does GDPR compliance count towards NIS2? Partly. Security measures under GDPR Article 32, such as access control, encryption and an overview of processing, overlap with NIS2 measures. NIS2 goes further on resilience, incident handling, suppliers and management responsibility.

When does NIS2 apply? Member states had to transpose NIS2 by 17 October 2024, but several were late. As of August 2026, 21 of the 27 member states had their national law in force. Obligations start when the national law takes effect, so the date depends on where a company operates.

Does a data discovery tool make an organisation NIS2 compliant? No. It can support the parts of NIS2 that depend on knowing where sensitive data sits, such as the asset inventory, classification and access reviews. Risk management, incident handling, backup, logging and supplier management need their own work.

You can't protect what you can't find

NIS2 is getting attention because the first inspections are underway and the threat level is high. Underneath it sits a problem most organisations already know from GDPR: years of personal data spread across mailboxes, drives and chats, much of it outside any register.

GDPR asked organisations to delete that data. NIS2 asks them to know what they hold and protect it according to its sensitivity. Both start from the same overview, so the two pieces of work can share it.

This has a practical consequence for planning. An NIS2 gap analysis or a customer's supplier questionnaire is also a good moment to check where personal data sits. Treating the frameworks as connected keeps the GDPR clean-up from waiting indefinitely behind the next NIS2 deadline.

Where Sheltr fits in

Sheltr is not an NIS2 solution. It does not handle risk management, incident reporting, logging, backup or supplier oversight.

What Sheltr Data Discovery does is find personal data across Exchange, OneDrive, SharePoint and Teams, including in scanned documents and images. It gives employees a simple way to review and delete what should no longer be there, and gives the compliance team documentation of what was found and cleared. For organisations in or around NIS2's scope, that covers the overview NIS2's asset work depends on and the data minimisation GDPR requires. See how it works.