A cyber security strategy should seek for the right balance between these two concepts. Moreover, the European Commission has provided the regulatory tools to support the Member States in facing this challenge. For this reason, every Member State should take seriously into account the right of citizens’ privacy. Finally, privacy is a horizontal issue that cuts across most of the activities relevant to cyber security strategy.
Belgian Data Protection Authority supervision and enforcement: The Belgian Data Protection Authority (APD/GBA) provides independent oversight of GDPR and national data-protection requirements. Individuals can submit complaints or request mediation, while the Authority can investigate alleged infringements, issue guidance and take corrective or sanctioning decisions through its enforcement structure. These functions provide an operational safeguard where cybersecurity, surveillance or public-security measures involve personal-data processing.
Sources: https://www.dataprotectionauthority.be/citizen/homepage
https://www.dataprotectionauthority.be/
Personal-data-breach notification and management: Belgium operates a dedicated GDPR data-breach process through the APD/GBA. Controllers must assess and document personal-data breaches, notify the Authority within the applicable GDPR deadline when a breach presents a risk to individuals, and communicate with affected persons where the breach is likely to create a high risk. The Authority provides a formal notification and management channel for organisations.
Sources: https://www.dataprotectionauthority.be/professional/actions/data-breach
Croatian Personal Data Protection Agency (AZOP): Croatia's independent data protection authority and the framework it enforces. Privacy is protected in the Constitution; the GDPR applies directly, supplemented by the national Act on Implementation of the GDPR (NN 42/2018), with police/prosecutor processing covered separately under the Law Enforcement Directive. AZOP is the sole supervisory authority - it handles public complaints, inspects organisations, issues fines, and runs the 72-hour breach-notification system.
Sources: https://azop.hr/
https://azop.hr/naslovna-english/
https://azop.hr/national-legislation/
https://narodne-novine.nn.hr/clanci/sluzbeni/2018_05_42_805.html
Danish Data Protection Agency (Datatilsynet): The Data Protection Agency is the national independent supervisory authority in Denmark with responsibility for upholding the fundamental right of data protection. The DPA’s statutory powers, functions and duties derive from the Data Protection Act, General Data Protection Regulation, Law Enforcement Directive, The Danish Law Enforcement Act as well as the Danish TV Surveillance Act.
Sources: https://www.datatilsynet.dk/
https://www.datatilsynet.dk/english
Personal Data Breach Reporting Mechanism: Data breach reporting official guidance provided by the Danish Data Protection Agency (Datatilsynet).
Sources: https://www.datatilsynet.dk/english/report-a-breach
https://www.datatilsynet.dk/sikkerhedsbrud/anmeld-sikkerhedsbrud
GDPR Rules and Guidance ((Regler og vejledning)): In order to ensure a high level of protection of the personal data of Danes, it is crucial that authorities and private companies, etc., know and comply with the rules for the processing of personal data, while citizens understand their rights and how to make use of them. The Danish Data Protection Agency makes this possible through visible advice and guidance, dialogue and control. It is the task of the Danish Data Protection Agency to advise on the registration, disclosure and other processing of personal data and to supervise that authorities, companies and other data controllers comply with the rules for data protection. The Danish Data Protection Agency regularly updates and produces guidelines.
Privacy, rights, and data-protection safeguards in threat analysis: Estonia's cybersecurity strategy requires national threat analysis to respect privacy, fundamental rights and the freedom to conduct business. In practice, data provided by internet service providers for the national threat picture must be anonymised. Information held by CERT-EE is also protected under the Cybersecurity Act and the Public Information Act.
Sources: https://www.mkm.ee/sites/default/files/documents/2024-07/Kyberturvalisuse%20strateegia%202024-2030_labivalt_IT_vaatlik_Eesti.pdf
https://www.enisa.europa.eu/sites/default/files/ncss-map/strategies/reports/EE_NCSS_2024_en.pdf
Cooperation with the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto): Finland's independent supervisory authority for data protection. It oversees compliance with the GDPR and the national Data Protection Act, handles personal-data-breach notifications, and safeguards the balance between security-driven data processing and individuals' privacy rights. Close cooperation between the NSCS-FI and the Office of the Date Protection Ombudsman. Interpreting GDPR, NIS2 legislation and providing counselling thereof for the supervised organisations.
Sources: https://tietosuoja.fi/en/home
Providing guidance to help victims of leaked personal data: Suomi.fi/DVV guidance helps victims block misuse of leaked personal data.
Federal Commissioner for Data Protection and Freedom of Information (BfDI): The independent federal supervisory authority for data protection. It oversees compliance of federal public bodies and telecommunications/postal providers with the GDPR and national data-protection law, advises legislators, and safeguards the balance between security measures and the fundamental right to informational self-determination.
Sources: https://www.bfdi.bund.de/
https://www.bfdi.bund.de/EN/Home/home_node.html
Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG): Germany's national data-protection statute, which complements and specifies the GDPR. It sets rules for the processing of personal data by public and private bodies, including provisions for law-enforcement and security contexts, and thereby frames how security-driven data processing is reconciled with privacy protection.
Sources: https://www.gesetze-im-internet.de/bdsg_2018/
https://www.gesetze-im-internet.de/englisch_bdsg/
Hellenic Data Protection Authority (HDPA)
The Hellenic Data Protection Authority is a constitutionally established independent public authority, which has as its mission the supervision of the application of the General Data Protection Regulation (GDPR), national laws 4624/2019 and 3471/2006, as well as other regulations concerning the protection of the individual from the processing of personal data.
Sources: https://www.dpa.gr/en
Law 4624/2019 (Implementation of GDPR in Greece): Law 4624/2019 establishes measures for implementing Regulation (EU) 2016/679 (GDPR) in Greece, defines the national framework for the protection of personal data, and provides the legal basis for safeguarding privacy rights when personal data is processed.
Sources: https://www.dpa.gr/sites/default/files/2020-08/LAW%204624_2019_EN_TRANSLATED%20BY%20THE%20HDPA.PDF
National Authority for Data Protection and Freedom of Information (NAIH): Hungary's independent data protection authority and the law it enforces. The right to data protection has constitutional rank (Article VI of the Fundamental Law); the GDPR applies directly and is supplemented by Act CXII of 2011 (the Privacy Act / "Info Act"), which adds national procedural rules and transposes the Law Enforcement Directive (EU) 2016/680 covering processing by police, national security and defence bodies. NAIH is the sole supervisory authority: it handles individuals' complaints (via a formal data protection authority procedure or an inquiry procedure), inspects controllers, issues orders and processing bans, imposes GDPR fines up to EUR 20 million or 4% of turnover, and operates the 72-hour breach-notification regime.
Sources: https://www.naih.hu/about-the-authority
https://www.naih.hu/
https://www.naih.hu/adatkezeles-erintettjekent-fordulok-a-hatosaghoz/adatvedelmi-hatosagi-eljaras-gdpr
https://njt.jog.gov.hu/jogszabaly/en/2011-112-00-00
Data Protection Laws: Liechtenstein maintains a comprehensive data-protection framework consisting of the Data Protection Act (DSG) and the Data Protection Ordinance (DSV), administered through the national Data Protection Authority. The framework implements the GDPR and the Law Enforcement Data Protection Directive and establishes legal safeguards governing the processing of personal data by public and private entities. It provides the legal basis for balancing cybersecurity, public-security requirements and the protection of privacy and fundamental rights.
Sources: https://www.datenschutzstelle.li/rechtsgrundlagen/nationale-gesetze
Data Protection Office Liechtenstein: Liechtenstein maintains an independent Data Protection Authority responsible for supervising compliance with data-protection legislation, handling complaints, publishing guidance, supporting organisations and citizens, and promoting awareness and training on privacy-related matters.
Information and Data Protection Commissioner: The Office of the Information and Data Protection Commissioner is the national supervisory authority responsible for monitoring and enforcing the GDPR and the Data Protection Act. This Office is also responsible to enforce the provisions of the Freedom of Information Act and ensure that public authorities observe the requirements thereof. Organisations can notify personal data breaches to the IDPC and use compliance support tools made available by the authority.
Sources: https://idpc.org.mt/
Designation of IDPC under the AI Act: The AI Act designates data protection supervisory authorities (IDPC) as Market Surveillance Authorities (MSA) for certain high-risk AI systems concerning law enforcement, migration & border control, and justice & democracy.
Sources: https://idpc.org.mt/artificial-intelligence/
Fundamental Rights Authority (FRA) role under the AI Act: As a data protection supervisory authority in terms of the GDPR, the IDPC has also been designated as a fundamental rights authority ('FRA') under the AI Act, specifically concerning the protection of personal data.
Sources: https://idpc.org.mt/artificial-intelligence/
EU AI Act implementation updates: The IDPC has published guidance concerning revised EU AI Act timelines and implementation developments.
Independent oversight of intelligence and security services: Alongside the existing privacy safeguards provided by the GDPR, the Netherlands has specific independent oversight of its intelligence and security services through the CTIVD. The latter reviews whether special powers used in cyber operations are lawful, necessary and proportionate. This oversight helps ensure that national-security measures remain consistent with privacy and fundamental rights.
Source: https://www.ctivd.nl/
Personal Data Protection Office (UODO): The Personal Data Protection Office independently supervises compliance with the GDPR and Polish data-protection law. Through oversight, guidance and corrective powers, it ensures that cybersecurity and public-security measures remain compatible with privacy and personal-data safeguards.
Sources: https://uodo.gov.pl/en
National Data Protection Authority: The National Data Protection Commission (CNPD) is Portugal's independent supervisory authority for personal data protection. CNPD monitors and supervises compliance with data protection legislation, exercises enforcement powers, handles complaints, cooperates with other European data protection authorities and safeguards the rights and freedoms of individuals in the processing of personal data.
Sources: https://www.cnpd.pt/
Portuguese Data Protection Law (Lei n.º 58/2019) and GDPR Implementation: Portugal applies the General Data Protection Regulation (GDPR) and complements it through Law no. 58/2019 of 8 August - Portuguese Data Protection Law on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (transposing Directive 2016/679 of the European Parliament and of the Council of 27 April 2016).
Sources: https://cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-security-laws/portugal
https://www.pgdlisboa.pt/leis/lei_mostra_estrutura.php?tabela=leis&artigo_id=3118A0002&nid=3118&nversao=&tabela=leis&so_miolo=
https://cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-security-laws/portugal?format=pdf&v=7
https://cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-security-laws/portugal?format=pdf&v=7%20(document%20summarising%20all%20data%20protection%20laws%20in%20Portugal
Act No. 18/2018 Coll. on Personal Data Protection: National data protection legislation implementing GDPR requirements in Slovakia. The Act on Personal Data Protection establishes rules for lawful processing of personal data, protection of data subjects' rights and safeguards relating to the processing of personal information.
Sources: https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2018/18/?ucinnost=15.11.2024
https://dataprotection.gov.sk/en/legislation/legislation-case-law/national-legislation/
Office for Personal Data Protection of the Slovak Republic (ÚOOÚ SR): The Office for Personal Data Protection is a state administration body with national jurisdiction over the territory of the Slovak Republic, that participates in the protection of fundamental rights of natural persons in relation to processing of personal data and executes data protection supervision, including supervision of personal data protection by competent authorities for performance of the task for the purposes of criminal proceedings.
Sources: https://dataprotection.gov.sk/sk/
https://dataprotection.gov.sk/en/
Data Protection Impact Assessment Framework (Decree No. 158/2018 Coll.): Establishes the procedure for conducting Data Protection Impact Assessments (DPIAs) for planned processing operations.
Sources: https://dataprotection.gov.sk/en/legislation/legislation-case-law/national-legislation/
https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2018/158/?ucinnost=17.09.2025
Information Commissioner Oversight Framework (Informacijski pooblaščenec): The Information Commissioner is Slovenia’s independent supervisory authority for personal data protection. The authority oversees compliance with the General Data Protection Regulation (GDPR) and the Personal Data Protection Act (ZVOP-2), investigates complaints, conducts inspections, issues guidance and promotes awareness of privacy rights and obligations. This provides the principal institutional mechanism for ensuring that cybersecurity measures remain compatible with privacy and data protection requirements.
Sources: https://www.ip-rs.si/
Personal Data Security and Risk Based Protection Framework (Varnost osebnih podatkov): Slovenia applies a risk based approach to protecting personal data. Official guidance explains that security measures must protect the confidentiality, integrity and availability of personal data and be proportionate to the risks associated with processing activities. Amendments linked to the Information Security Act (ZInfV-1) align cybersecurity risk management requirements with personal data protection obligations.
Personal Data Breach Notification and Reporting System: Organisations experiencing a personal data breach have access to official reporting procedures and guidance from the Information Commissioner. The framework supports risk assessment, notification of the supervisory authority, communication with affected individuals when required and provision of practical reporting guidance.
Sources: https://www.ip-rs.si/varstvo-osebnih-podatkov/klju%C4%8Dna-podro%C4%8Dja-uredbe/prijava-kr%C5%A1itev
Joint SI-CERT and Information Commissioner Data Breach Guidance and Training: SI-CERT and the Information Commissioner jointly provide practical training on personal data breaches, including detection, incident response, risk assessment, reporting obligations and notification of affected individuals. The programme is intended to help organisations address cybersecurity incidents while respecting data protection rules.
Sources: https://www.cert.si/spletni-seminar-krsitev-varnosti-osebnih-podatkov-zaznava-ukrepi-in-porocanje/
National Information Security Framework with Personal Data Protection Safeguards: Slovenia’s Information Security Act explicitly states that personal data processing under the law must be carried out in accordance with personal data protection legislation. This ensures that cybersecurity measures implemented under the national cybersecurity framework are subject to privacy safeguards and data protection obligations.
Sources: https://pisrs.si/pregledPredpisa?id=ZAKO8934 (Article 50)
Spanish Data Protection Agency (AEPD): The AEPD supervises GDPR compliance in Spain and safeguards the balance between security measures and the protection of personal data and privacy.
Sources: https://www.aepd.es/en
Personal-data-breach notification (GDPR / LOPDGDD): Controllers must notify personal-data breaches to the AEPD under the GDPR and the Spanish data-protection law (LOPDGDD).
Sources: https://www.aepd.es/en/rights-and-duties/fulfill-your-duties/measures-compliance/communication-of-a-personal-data-breach-data
https://www.aepd.es/en
Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) Supervision and Guidance: IMY is Sweden's data protection authority and supervises compliance with the General Data Protection Regulation (GDPR). The authority provides guidance on processing personal data, information security, lawful monitoring and protection of individual rights. Organisations implementing cybersecurity measures must ensure compliance with IMY guidance and GDPR requirements.
Sources: https://www.imy.se/
Data Protection Officer Requirements (Dataskyddsombud): Under GDPR, many public authorities and organisations carrying out specific categories of data processing must appoint a Data Protection Officer. Data Protection Officers help organisations ensure that security measures, monitoring practices and information management activities comply with privacy requirements.
Sources: https://www.imy.se/
Data Protection Impact Assessments (DPIA): Organisations must carry out Data Protection Impact Assessments where processing activities are likely to result in high risks to individuals. DPIAs are used to assess risks and identify safeguards before introducing systems involving extensive monitoring, security controls or large scale processing of personal data.
Sources: https://www.imy.se/
GDPR Implementation Framework: Sweden applies the EU GDPR framework governing processing of personal data. The framework requires organisations to ensure that security measures are proportionate, necessary and compliant with fundamental privacy principles.
Sources: https://www.imy.se/
Stay updated with ENISA! Sign up for email alerts on publications, events, vacancies, and more.