Cloud compliance in the DACH region isn't just about ticking boxes. GDPR set the baseline, but NIS2 and DORA are raising the bar significantly—with real architectural implications that many enterprises are only now discovering. Here's what these regulations actually mean for your cloud strategy.
The Regulatory Landscape in 2026
DACH enterprises now operate under a layered compliance framework that affects cloud architecture decisions at every level:
- GDPR: The foundation—data protection and privacy requirements
- NIS2: Network and information security for essential and important entities
- DORA: Digital operational resilience for financial services
- National laws: German IT Security Act, Austrian NIS Act, Swiss FADP
Each regulation adds requirements. Together, they demand a fundamentally different approach to cloud architecture than what worked five years ago.
Compliance is no longer a checklist—it's an architectural constraint that shapes every cloud decision.
GDPR: Beyond the Basics
Most DACH enterprises have addressed obvious GDPR requirements. But cloud architecture continues to evolve, and enforcement has become more sophisticated. Areas requiring attention:
Data Residency Realities
Storing data in EU regions isn't always sufficient. Sub-processors, support access, and technical operations can expose data to non-EU jurisdictions. Cloud providers have improved, but due diligence remains essential.
- Backup locations: Where does disaster recovery data live?
- Support access: Can support engineers from non-EU countries access your data?
- Managed services: What data leaves your region for analytics or ML features?
Right to Deletion in Distributed Systems
Deleting data from a monolith is straightforward. Deleting it from distributed cloud systems—with caches, replicas, backups, and analytics pipelines—is architecturally challenging. Many cloud architectures make true deletion nearly impossible.
Data Processing Agreements
Cloud provider DPAs cover their services but not your architecture decisions. If you build a system that processes data in non-compliant ways, the provider's DPA doesn't protect you.
NIS2: The Security Game-Changer
NIS2 significantly expands the scope and requirements of EU cybersecurity regulation. If your organization falls under NIS2 (and the scope is broad), your cloud architecture must address:
Supply Chain Security
NIS2 explicitly requires supply chain risk management. In cloud terms, this means:
- Third-party risk assessment: Document and assess all cloud providers and services
- Contractual security requirements: Cloud contracts must include security obligations
- Continuous monitoring: Ongoing assessment of provider security posture
Incident Reporting Requirements
NIS2 mandates incident reporting within 24 hours (initial notification) and 72 hours (full report). Your cloud architecture must support:
- Detection capabilities: You can't report what you can't detect
- Logging and audit trails: Forensic capability across cloud services
- Clear incident ownership: Who's responsible when the cloud provider has an incident?
Business Continuity and Crisis Management
NIS2 requires tested business continuity plans. For cloud architectures, this means multi-region or multi-cloud capabilities that are actually tested, not just designed.
DORA: Financial Services Under Pressure
If you're in financial services (or serve financial services clients), DORA adds another layer of requirements. DORA became fully applicable in January 2025 and has teeth.
ICT Third-Party Risk Management
DORA requires financial institutions to maintain detailed registers of all ICT third-party providers—including cloud services. This isn't just documentation; it requires:
- Criticality assessment: Which cloud services support critical functions?
- Concentration risk: Are too many critical functions on one provider?
- Exit strategies: Documented and tested plans for leaving critical providers
Digital Operational Resilience Testing
DORA mandates threat-led penetration testing (TLPT) for significant financial institutions. Cloud architectures must be designed with testability in mind—many aren't.
Information Sharing
DORA encourages threat information sharing between financial institutions. Your cloud architecture should support secure information sharing without exposing sensitive operational data.
Architectural Implications
These regulations collectively push cloud architecture in specific directions:
Multi-Region Becomes Mandatory
Business continuity requirements under NIS2 and DORA effectively require multi-region deployments. Single-region architectures no longer meet compliance thresholds for covered organizations.
Observability Is Non-Negotiable
Incident detection and reporting requirements demand comprehensive observability. Cloud-native monitoring isn't optional—it's a compliance requirement.
Exit Planning Is Required
Both NIS2 (supply chain management) and DORA (third-party risk) effectively require exit strategies. The architecture that's easy to build but impossible to leave is now a compliance problem.
Documentation Must Be Operational
Regulators expect living documentation of cloud architecture, not PowerPoint slides from three years ago. Architecture decision records, current diagrams, and tested runbooks are baseline expectations.
Practical Steps for Compliance
If you're assessing your cloud compliance posture:
- Scope determination: Which regulations apply to your organization?
- Gap analysis: Where does your current architecture fall short?
- Provider assessment: Do your cloud providers support your compliance requirements?
- Architecture review: What changes are needed for compliance?
- Implementation planning: Prioritize based on risk and regulatory timelines
Compliance as Competitive Advantage
Compliance requirements are burdensome, but they're also a competitive filter. Organizations that build compliant cloud architectures can serve customers that others can't. In regulated industries, compliance capability is a market differentiator.
Need help navigating cloud compliance in the DACH region? Our team has designed compliant cloud architectures for financial services, healthcare, and critical infrastructure organizations. We can help you build cloud systems that meet regulatory requirements without sacrificing agility.