meta_id 2983656

On March 19, 2026, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted a joint opinion on the European Commission's proposals for a Cybersecurity Act 2 (CSA2) and targeted amendments to the Network and Information Security 2 (NIS2) Directive. The Commission published the cybersecurity package proposal on January 20, 2026, to strengthen cybersecurity across Europe while streamlining compliance for organisations. The EDPB and EDPS support the general objectives of the CSA2 proposal, including strengthening the role of the European Union Agency for Cybersecurity (ENISA), facilitating cybersecurity certification uptake, and addressing risks to information and communications technology (ICT) supply chains. The authorities welcome ENISA's clarified support mechanisms and recommend that ENISA's advice be issued upon prior request from the EDPB to ensure clear coordination. They further suggest adding the EDPS as a possible requestor of advice from ENISA. The joint opinion emphasises that any additional measures adopted by ENISA's Management Board should be limited to technical details related to personal data processing and require prior consultation with the EDPS. Regarding cybersecurity certification, the EDPB and EDPS recommend clarifying the scope of the European Cybersecurity Certification Framework and its relationship with General Data Protection Regulation (GDPR) certification. ENISA should consult with the EDPB before adopting certification schemes relating to personal data security. The authorities also support establishing a single-entry point for personal data breach notifications to reduce administrative burden. Additionally, they welcome the designation of European Digital Identity Wallets and European Business Wallets providers as essential entities under the NIS2 amendments. The joint opinion underscores that cybersecurity and data protection are reciprocal and interconnected, emphasising that security controls must not undermine individuals' fundamental rights.