meta_id 3069599

On 18 March 2026, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted a joint opinion on the European Commission's proposals for a Cybersecurity Act 2 (CSA2) and amendments to the Network and Information Security 2 Directive (NIS 2 Directive). The proposals were formally consulted on 21 January 2026 following the Commission's issuance of the CSA2 Proposal on 20 January 2026. The EDPB and EDPS support the proposals' general objectives to strengthen the European Union Agency for Cybersecurity (ENISA) role, facilitate cybersecurity certification uptake, and address information and communications technology (ICT) supply chain security risks. The authorities particularly welcome the establishment of a single-entry point for personal data breach notifications, which would reduce administrative burden for organisations without diminishing data subject protection. The joint opinion provides specific recommendations across several areas. Regarding ENISA's cooperation framework, the EDPB and EDPS recommend adding the EDPS as an explicit requestor for cybersecurity advice under Article 5(1)(h) CSA2 and recommend amending Article 68 to explicitly reference the EDPS as a Union body for cooperation purposes. On the European Cybersecurity Skills Framework, they recommend expanding Article 19(2) to include profiles for general workforce and citizens, not exclusively cybersecurity professionals. For the European Cybersecurity Certification Framework, they recommend clarifying Article 80(1)(w) CSA2's relationship to GDPR certification requirements and requiring ENISA to consult the EDPB before adopting certification schemes. The authorities welcome the designation of European Digital Identity Wallets and European Business Wallets providers as essential entities under the NIS 2 amendments, and support enhanced ransomware attack reporting measures. They recommend specifying applicable data protection safeguards in implementing acts addressing ransomware incident reporting. REFERENCES: European Data Protection Board and European Data Protection Supervisor Joint Opinion [4/2026] on the Proposal for a Cybersecurity Act 2 and the Proposal on amendments to the NIS 2 Directive, adopted 18 March 2026. Available at: https://www.edpb.europa.eu/