The Definitive Guide to DORA Compliance & Encryption

DORA recognizes the need to combat the gap within financial services related to the management of privacy and controlled data. Resiliency is a key component to maintaining control and access to critical data throughout the data lifecycle and active threat.

DORA also aligns with the adoption of outsourced business operations within the financial services market. Many financial services organizations outsource key pieces of their operations to third-party platforms due to their expertise and efficiency. Examples of where private and controlled data may be outsourced include but are not limited to: operational platforms, AI, data archiving, analytics, application processing, lead or business development, log management, monitoring, payroll, transparency, etc.

Paperclip developed the SAFE® technology to secure private and controlled data throughout the third-party data supply chain. Click for more information on how SAFE helps organizations comply with DORA.

Specifically, within Article 9, paragraph 2, DORA requires encryption of private and controlled data as a fundamental element of operational resilience. As per DORA, “Financial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems, in particular for those supporting critical or important functions, and to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit.”.

Paperclip SAFE meets DORA requirements by assuring that confidentiality, availability, and integrity of data is protected through SAFE’s data encryption technology. Utilizing SAFE, the data is always encrypted in use, in transit and at rest.

Technically, yes. Paperclip suggests that you consult with your compliance lead and legal team to perform a risk assessment and develop a plan to ensure compliance. Based on analyst estimates, 99% of applicable financial entities are not prepared for DORA’s compliance requirements as of 17 January, 2025.

It appears that the priority of regulators now is for organizations to demonstrate a path to meeting DORA compliance. Paperclip can assist with aligning to DORA data encryption, security, and resilience compliance expectations through developing a SAFE implementation plan. For example, implementing SAFE Archive™ for your structured archive data can be an entry-level path to rolling out data encryption throughout your operational environment.

This is a complicated question that depends on your business model. If you’re a U.S. based operation, DORA may not have direct regulatory authority over your operations. However, DORA may reach beyond the borders of the EU participating countries in some cases.

Here is a brief breakdown of how your organization may or may not be impacted. (always consult with your compliance lead and legal team before making final decisions related to any compliance mandates):

• NOT DORA ACCOUNTABLE: If you are based in the U.S. and are not a financial services provider, and you are not classified as an ICT services organization providing services to a EU financial services organization. Even in this case, it is recommended that your organization is prepared to respond to DORA related questions that may appear on a third-party risk assessment.
• DORA ACCOUNTABLE: If you are based in the U.S. and you are a financial services provider with offices located within an EU participating country—OR—if you are based in the U.S. and you are not a financial services provider, but you are an ICT or an organization that provides services to an EU based financial services provider.

Regardless of whether your organization is accountable today, it is expected that the operational resilience requirements will become the new standard across industries. At Paperclip, we see this following a path that is very similar to the General Data Protection Regulation (GDPR) following its introduction in the EU in 2018.

It’s important to note that while EU regulators may not have direct authority over you, your clients ( financial entities) will be regulated. They may fail a DORA audit and face penalties if your organization, as an ICT provider, do not meet any part of the DORA framework. In this case, your client may fall out of compliance, and your organization may lose the business relationship you have with your client.

• DORA is focused on resilience related to operational use of private and controlled data.
• DORA follows resiliency through to the ICT or third-party risk and holds the governed financial services organization accountable for the risk posture of the ICTs they partner with. Despite of where the ICT is located (inside or outside of an EU country).
• DORA identifies the need for data-in-use encryption, beyond standard encryption of data at rest and data in transit. DORA also identifies three states of database encryption: Data at Rest, Data in Transit, and Data in Use. Click for more information related to data-in-use encryption.

Core Definition

ICT under DORA refers to all digital technologies used for:

• Storage, processing, and transmission of financial entity data
• Supporting the continued provision of financial services
• Maintaining operational integrity and reliability

Key Components

ICT systems under DORA include:

• Cloud computing services
• Digital networks
• Traditional IT infrastructure
• Digital platforms used for:
  • Financial operations
  • Customer interactions
  • Data analytics

Scope of Coverage

DORA’s ICT definition encompasses:

• Hardware as a service
• Hardware services including technical support
• Software and firmware updates
• Digital and data services provided to internal or external users
• Network and information systems supporting business processes