Where do DORA and ePrivacy Directive overlap?

In 3 article-level pairings recorded in the Fontvera corpus. The table above lists each pair with the specific articles and a plain-language description.

Where do DORA and ePrivacy Directive conflict?

In 2 article-level conflicts. The most concrete ones are summarised in the Conflicts explained section.

Which regulation prevails in a conflict between DORA and ePrivacy Directive?

Neither regulation resolves the conflict on its face. Conflicts are typically resolved by the more specific provision or by regulator guidance — a legal-judgement call, not a mechanical rule.

§ DORA · ePrivacy Directive COMPARISON

DORA vs ePrivacy Directive: Where They Overlap and Conflict

3 overlaps, 2 conflicts and 2 gaps mapped between DORA and ePrivacy Directive in the Fontvera regulatory corpus.

Summary

DORA and ePrivacy Directive both apply across European business activity, but they were drafted at different times with different policy goals. This page summarises every article-level crossref between the two in the Fontvera corpus.

3 overlaps mean the same conduct triggers obligations in both regimes — design controls once, document twice. 2 conflicts mean the two regulations push in opposite directions on a specific question. 2 gaps mean one regulation leaves something on a topic the other addresses.

Who this applies to

Compliance teams who need to map a single control framework onto both DORA and ePrivacy Directive.

Compliance deadline

§ Detail

In depth

Summary statistics

Overlaps: 3 · Conflicts: 2 · Gaps: 2

7 article-level crossrefs catalogued between DORA and ePrivacy Directive from the Fontvera EU regulatory corpus. Article numbers are verbatim from the underlying obligation_crossrefs table; descriptions are extracted, not paraphrased.

All crossrefs between these regulations

Article (A)	Article (B)	Type	Severity	Description
DORA Art 10	ePrivacy Directive Art 4	overlap	medium	[entity affected: Financial entities providing electronic communications services] Both regulations require entities to implement technical and organizational measures to detect anomalies and safeguar
DORA Art 17	ePrivacy Directive Art 4	overlap	medium	[entity affected: Financial entities providing electronic communications services] Both regulations mandate the establishment of processes to manage, record, and respond to security incidents or breac
DORA Art 14	ePrivacy Directive Art 4	overlap	medium	[entity affected: Financial entities providing electronic communications services] Both regulations require entities to inform users or subscribers about security risks, breaches, or incidents that ma
DORA Art 10	ePrivacy Directive Art 5	conflict	high	[entity affected: Financial entities providing electronic communications services] DORA requires monitoring of user activity and ICT anomalies, which may conflict with ePrivacy's strict prohibition on
DORA Art 12	ePrivacy Directive Art 6	conflict	high	[entity affected: Financial entities providing electronic communications services] DORA mandates backup and retention of data for business continuity, while ePrivacy requires traffic data to be erased
DORA Art ?	ePrivacy Directive Art ?	gap	medium	[entity affected: Financial entities using third-party cloud providers for communications] Neither regulation clearly defines the liability split for security incidents occurring within the infrastruc
DORA Art ?	ePrivacy Directive Art ?	gap	high	[entity affected: Financial entities processing metadata for AI-driven fraud detection] There is a gap in guidance on how to reconcile DORA's requirement for comprehensive incident detection and loggi

Conflicts explained

The 2 article-level conflicts between DORA and ePrivacy Directive mean a control that satisfies one can pull the wrong way on the other:

DORA Art 10 vs ePrivacy Directive Art 5 — [entity affected: Financial entities providing electronic communications services] DORA requires monitoring of user activity and ICT anomalies, which may conflict with ePrivacy's strict prohibition on interception or surveillance of communications without user consent.
DORA Art 12 vs ePrivacy Directive Art 6 — [entity affected: Financial entities providing electronic communications services] DORA mandates backup and retention of data for business continuity, while ePrivacy requires traffic data to be erased or anonymized once no longer needed for transmission, creating tension over retention periods.

Which regulation takes precedence

EU law does not lay down a universal precedence rule between DORA and ePrivacy Directive. In practice three resolution approaches apply: lex specialis (the more specific provision wins when both purport to govern the same conduct); regulator guidance (EDPB, EBA, ESMA and the AI Office have all issued joint readings on overlapping articles — check the most recent applicable opinion); and document the choice (when the regulations leave the call to the controller, the audit defence is your written reasoning, not the regulator's silence). Where the corpus surfaces a conflict rather than an overlap, treat that as an escalation path to legal — not a control-design question.

What this means for your compliance team

Treat the 3 overlaps as design opportunities — one control, two regulatory anchors. Treat the 2 conflicts as escalation paths to legal: the regulations themselves don't resolve them, you do, and you document the reasoning. The 2 gaps point at scenarios where one regulation is silent while the other speaks — assume the regulator who has the explicit rule will win.