NIS2 readiness
Scope assessment, legal gap analysis, governance, policies, accountability, supply chain and reporting flows.
Italian legal counsel · Cyber & Data
Cybersecurity and data governance
Security, data and incident governance connecting regulatory duties, internal organisation and accountability across the supply chain.
01 / Scope
Issues we address
Legal analysis begins with the operating facts. These are recurring questions, but scope and priorities are defined for each project.
- 01Determining NIS2 scope and coordinating management accountability, risk assessment and applicable safeguards.
- 02Handling a data breach or cyber incident across different reporting windows without undermining investigation and evidence.
- 03Governing cloud, MSP, software and data-processing suppliers through measurable duties, audit rights and transparent subcontracting chains.
- 04Building data governance that distinguishes ownership, privacy roles, access, retention, reuse and international transfers.
02 / Services
Legal services
The work may cover one issue or coordinate several workstreams. Scope, assumptions and deliverables are agreed before the engagement.
GDPR and privacy
Roles, notices, records, contracts, DPIAs, transfers and data-subject rights.
Incident response
Legal playbooks, reporting assessments, technical coordination and communications with authorities and affected persons.
Cybersecurity contracts
Security requirements, service levels, audit, subcontractors, incident cooperation and liability.
Data governance
Data classification, access and reuse rules, retention, sharing and records of decisions.
Regulatory response
Authority requests, complaints, audits, contractual disputes and preservation of evidence.
03 / Framework
Essential legal framework
The applicable framework depends on the activity, parties and jurisdictions. The following sources are a starting point, not an exhaustive list.
Directive (EU) 2022/2555
NIS2 strengthens governance, cybersecurity risk management, incident reporting and supply-chain security.
Regulation (EU) 2016/679
GDPR regulates processing, accountability, security, personal-data breaches, impact assessments and transfers.
DORA and sector rules
Financial services and other regulated sectors add specific resilience and outsourcing requirements.
Data Act and Data Governance Act
Data access, sharing and portability create new contractual relationships and limits on reuse.
04 / Method
A method built around the matter
The Firm combines legal analysis with an understanding of the operational context. Advice identifies assumptions, dependencies and decisions rather than presenting regulation in the abstract.
Map the facts
We identify the operating model, parties, documents, technologies, decisions and deadlines.
Define the framework
We distinguish binding duties, contractual choices, uncertainties and issues requiring technical input.
Set priorities
Options are presented with consequences, dependencies and a sequence that the organisation can execute.
Support execution
We assist with documents, negotiations, internal decisions and engagement with counterparties or authorities.
05 / Connections
Related practices and analysis
06 / FAQ
Frequently asked questions
Does NIS2 apply only to major infrastructure?
No. Scope depends on size, sector and the organisation's role under EU rules and the relevant Italian implementing framework.
Must every cyber incident be reported?
Not necessarily. Threshold, impact, applicable regime and deadlines require rapid, documented assessment.
Does a data-processing agreement fully address cyber risk?
Only partly. Security specifications, audit, cooperation, continuity, subcontracting and tailored remedies are often needed.
Who should take part in incident response?
Management, technical, privacy, legal and communications functions, together with relevant suppliers, under roles agreed before an emergency.
Discuss the Italian or EU dimension of your project.
Describe the activity, the decision to be made and any deadline. An initial exchange helps identify conflicts, scope and the information required. Sending an enquiry does not create a lawyer-client relationship.