Where do Data Act and DORA overlap?

In 3 article-level pairings recorded in the Fontvera corpus. The table above lists each pair with the specific articles and a plain-language description.

Where do Data Act and DORA conflict?

In 1 article-level conflicts. The most concrete ones are summarised in the Conflicts explained section.

Which regulation prevails in a conflict between Data Act and DORA?

Neither regulation resolves the conflict on its face. Conflicts are typically resolved by the more specific provision or by regulator guidance — a legal-judgement call, not a mechanical rule.

§ Data Act · DORA COMPARISON

Data Act vs DORA: Where They Overlap and Conflict

3 overlaps, 1 conflicts and 1 gaps mapped between Data Act and DORA in the Fontvera regulatory corpus.

Summary

Data Act and DORA both apply across European business activity, but they were drafted at different times with different policy goals. This page summarises every article-level crossref between the two in the Fontvera corpus.

3 overlaps mean the same conduct triggers obligations in both regimes — design controls once, document twice. 1 conflicts mean the two regulations push in opposite directions on a specific question. 1 gaps mean one regulation leaves something on a topic the other addresses.

Who this applies to

Compliance teams who need to map a single control framework onto both Data Act and DORA.

Compliance deadline

§ Detail

In depth

Summary statistics

Overlaps: 3 · Conflicts: 1 · Gaps: 1

5 article-level crossrefs catalogued between Data Act and DORA from the Fontvera EU regulatory corpus. Article numbers are verbatim from the underlying obligation_crossrefs table; descriptions are extracted, not paraphrased.

All crossrefs between these regulations

Article (A)	Article (B)	Type	Severity	Description
DORA Art 10	Data Act Art 11	overlap	medium	[entity affected: Financial entities acting as data holders or recipients] Both regulations require entities to implement technical and organizational measures to detect anomalies or unauthorized acce
DORA Art 14	Data Act Art 11	overlap	medium	[entity affected: Financial entities acting as data holders] Both regulations mandate communication obligations in the event of an incident, with DORA focusing on crisis communication for ICT incident
DORA Art 12	Data Act Art 19	overlap	low	[entity affected: Financial entities acting as data holders] Both regulations require the implementation of measures to ensure data integrity and confidentiality, including backup policies in DORA and
DORA Art 18	Data Act Art 18	conflict	high	[entity affected: Financial entities acting as data holders] DORA requires classification and reporting of ICT incidents based on specific criteria, while the Data Act requires anonymization or pseudo
DORA Art ?	Data Act Art ?	gap	medium	[entity affected: Financial entities using third-party data processing services] Neither regulation clearly defines the liability split for data loss during a switching process between data processing

Conflicts explained

The 1 article-level conflicts between Data Act and DORA mean a control that satisfies one can pull the wrong way on the other:

DORA Art 18 vs Data Act Art 18 — [entity affected: Financial entities acting as data holders] DORA requires classification and reporting of ICT incidents based on specific criteria, while the Data Act requires anonymization or pseudonymization of data before sharing with public bodies, potentially conflicting if incident data contains personal data that must be preserved for forensic analysis under DORA.

Which regulation takes precedence

EU law does not lay down a universal precedence rule between Data Act and DORA. In practice three resolution approaches apply: lex specialis (the more specific provision wins when both purport to govern the same conduct); regulator guidance (EDPB, EBA, ESMA and the AI Office have all issued joint readings on overlapping articles — check the most recent applicable opinion); and document the choice (when the regulations leave the call to the controller, the audit defence is your written reasoning, not the regulator's silence). Where the corpus surfaces a conflict rather than an overlap, treat that as an escalation path to legal — not a control-design question.

What this means for your compliance team

Treat the 3 overlaps as design opportunities — one control, two regulatory anchors. Treat the 1 conflicts as escalation paths to legal: the regulations themselves don't resolve them, you do, and you document the reasoning. The 1 gaps point at scenarios where one regulation is silent while the other speaks — assume the regulator who has the explicit rule will win.