What DORA Requires
DORA became EU law in January 2025. Banks, insurers, investment firms, and payment firms must now manage risk from every tech supplier they use. Three rules stand out.
Mandatory contract terms (Article 30). Each contract with a tech provider must cover four points: audit rights, incident alerts, exit plans, and performance targets. These clauses are not optional.
Annual reviews (Article 28). Firms must check every key supplier at least once a year. A provider is "key" if its failure would stop normal work. Anonymization tools used in compliance tasks fall into this group.
Supplier register (Article 28(3)). Firms must keep a live list of all key third-party contracts. The list must include security records for each one.
Running yearly reviews for dozens of providers takes time. One custom review — done from scratch — takes an estimated 40–80 hours per provider. A Dutch bank with 50 key suppliers faces up to 4,000 hours of review work each year. That is two full-time staff working on reviews and nothing else.
ISO 27001 Cuts Review Hours
ISO 27001 certification gives firms a faster route through DORA's yearly review rule. The certification body runs a check audit every year and a full audit every three years. The certificate has an end date. It stays valid only while annual checks pass.
Under DORA's yearly review rule, a firm can pull the provider's current ISO 27001 certificate once a year and check the date. A valid date means an outside audit body checked the provider's 93 security controls in the past twelve months. The firm logs this in the supplier register. The review is done.
The time gain is real. A Dutch bank checking a certified anonymization tool spends a few hours on the review. The same review done from scratch takes weeks. Across 20 certified third parties, the yearly saving can reach 1,200 hours. That time can go to other work.
Why Privacy Tools Are in Scope
Privacy and anonymization tools fall under DORA when a firm uses them to handle client data, meet GDPR rules, or process KYC files. If the tool goes down and the firm cannot produce GDPR-safe output, the tool is a key third party under DORA. It must be reviewed each year.
Our GDPR compliance guide explains data minimization rules. See also ISO 27001 downstream compliance value and ISO 27001 vendor assessment shortcuts for more on how certification cuts compliance work.