Since January 2025, EU banks, insurers, and payment firms must comply with DORA alongside GDPR - a separate regime covering ICT risk, incident reporting, and resilience testing.