The Digital Operational Resilience Act Explained

Google the words ‘DORA’ and it’s like that images of the cartoon character ‘Dora the Explorer’ will appear amongst your search offerings.

But there’s now a new DORA around – the Digital Operational Resilience Act, an EU piece of regulation which came into effect this month. Although the act does not directly apply to the UK as we are no longer part of the EU, it does impact British companies that have business relationships or operations in the European Union.

Lifeline IT has worked on DORA with a number of our European financial clients to ensure they are compliant with this new legislation. And whilst it may not impact your business specifically, it’s good to be aware of DORA as you may have customers or business contacts who are affected by it.

We run through some of the key points around DORA.

• In essence, DORA is legislation to make financial companies pay more attention to IT security and data management. In many ways it is similar to GDPR (General Data Protection Regulation) that was introduced in 2018, although this applied to all businesses, whilst DORA only affects the financial sector.
• Its aim is to improve the digital operational resilience of EU companies and their ICT (information and communications technology) suppliers, in order to reduce the risk of cyber threats. It’s also hoped that through DORA regulation, it will bring synergy to the security of IT systems in the financial sector, which in turn will hopefully strengthen the European financial market against cyber attacks.
• DORA was officially introduced on 17 January 2025.
• There are five main areas to DORA: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third party risk, information sharing.
• To find out more, visit the EU’s website.