DORA European regulations introduce new standards for data resilience

DORA European regulations are EU laws requiring financial and ICT firms to ensure the resilience, security, and integrity of their systems and data. 

What is DORA and why was it introduced? 

The Digital Operational Resilience Act (DORA) is a set of EU regulations designed to strengthen the digital resilience and operational risk management of financial institutions. While GDPR focuses on data privacy and protection, DORA is broader, concentrating on the resilience, security, availability, and integrity of Information and Communication Technology (ICT) systems and the data they manage.

DORA came into effect in early 2025 and applies to a wide range of enterprises, including: 

• Banks, investment firms, and insurance companies 

• Payment institutions, and crypto-asset service providers 

• ICT service providers, including cloud and software vendors 

Unlike previous rules, DORA explicitly requires these entities to protect not just customer data, but ALL data and systems to ensure business continuity. DORA also impacts non-EU companies (in the UK, for instance) that provide IT services to the EU financial sector, making it global in scope. 

Source: K2view 

The K2view 2025 State of Test Data Management report underscores the need for DORA European regulations, with 93% of the 300 data pros surveyed admitting that their companies were not fully compliant with data privacy laws. 

DORA vs GDPR with data always under the surface 

How do DORA European regulations connect to the more familiar GDPR regulations? While GDPR’s domain is more personal, emphasizing consumer data protection and privacy, DORA is more general, focusing on ICT and operational risk and how to minimize it.  

However, the two share several guiding principles, such as the need for solid processes and ongoing management of risk, data security, and resilience.

One critical difference is that DORA’s obligations are enterprise-wide and ongoing, requiring regular attention to ICT risks, not just ticking off the boxes in a one-off compliance checklist.

The 5 key DORA mandates are: 

1. ICT risk management 

   All firms must establish frameworks to identify, assess, and manage ICT risks across all environments and processes – from production to development and testing. 

2. Incident reporting 

   Any significant ICT or data incident must be reported promptly (within hours for critical events). 

3. Resilience testing 

   Firms must regularly test digital resilience, including how quickly and completely data can be restored after a disruption. 

4. Third-party risk 

   All service providers, including cloud and hosting companies, must align with DORA standards for data security and operational reliability. 

5. Information sharing 

   Firms are encouraged to share cyber threat intelligence with industry peers to bolster overall resilience. 
   
   

Why non-production data draws so much attention 

While DORA does not specifically call out non-production environments, its rules clearly cover all ICT systems and the data within them, including those used for software development, testing, reporting, and internal analytics.

Non-production systems often contain real customer data copied from live systems, either for convenience or testing accuracy. This practice, however, creates unnecessary risk – accidental leaks, unauthorized access, or even breaches during development, testing, or QA cycles. 

Source: K2view 

The K2view TDM survey shows just how real this risk is, with 40% of respondents claiming their top challenge in managing and provisioning test data is the discovery and masking of Personally Identifiable Information (PII). And organization-wide PII masking is now a must according to DORA.

Enterprise data masking addresses this challenge by replacing sensitive data in non-production datasets with masked values – delivering realistic, useful results for dev and test teams while keeping the actual data safe. Enterprise data masking lets you: 

• Reduce DORA and GDPR compliance risks 

• Support ongoing digital resilience testing 

• Protect sensitive information across all environments (not just production) 

• Ensure that data used for AI, analytics, or software development can never be traced back to individual customers or other business entities 

These controls help your organization confidently implement both structured data masking (from a database) and unstructured data masking (from a doc, email, or PDF) inflight and at scale, and fully compliant with DORA requirements. 

Practical tips for DORA-compliant data handling 

With DORA, compliance is an ongoing journey. Here are the first steps we recommend you take: 

• Map all data flows 

  Understand where data moves – production, dev, test, and reporting – and document it in a data catalog. 

• Automate data masking 

  Use enterprise-grade data masking technology that masks data before it leaves production and preserves referential integrity. 

• Test regularly 

  Include data resilience checks in digital operational resilience testing. 

• Educate your teams 

  Train developers, testers, and business analysts on secure data practices. 

Addressing DORA requirements brings together: 

• ICT security and risk management leads 

• Privacy and compliance officers 

• DevOps, QA, analytics, and IT operations teams 

• Business unit owners 

Cross-domain collaboration ensures compliance processes are thorough and reach every corner of your ICT and data environment. 

DORA-proof your firm with enterprise data masking 

K2view provides a robust and effective way to protect multi-source enterprise data in any environment. The K2view Enterprise Data Masking solution enables you to: 

• Mask data from all sources at scale. 

• Ensure up-to-date, just-in-time data access for resiliency and reporting. 

• Protect data privacy, limit access, and enforce security guardrails. 

• Comply with DORA risk and incident reporting demands. 

As the DORA European regulations mandate, resilience is now required for all environments including dev, test, and analytics. Enterprise data masking is the quickest route to compliance and risk mitigation. K2view puts these controls at your fingertips, enabling safer, more agile financial innovation. 

Protect your data, and comply with DORA,
with K2view Enterprise Data Masking tools.