Does NIS2 apply to small businesses?

NIS2 is mainly aimed at medium-sized and large organisations in certain sectors. Small businesses can be affected indirectly if they work for such organisations and those pass requirements on to their suppliers. Whether that applies to you is best clarified with your data protection or legal adviser.

What's the difference between NIS2 and GDPR?

The GDPR protects personal data, meaning information about people. NIS2 is about the security of IT systems overall, so that important services keep running reliably. The two complement each other well.

Do I have to switch to open source for NIS2 or GDPR?

No. Neither framework prescribes specific software. Open source can help, though, because you know exactly where your data is and who has access. That often makes documentation easier.

Snowblueyour IT service for open source

Write to me

Data Protection·May 20, 2026

NIS2 and GDPR, Calmly Explained – What Small Businesses Should Know

NIS2 and GDPR sound like a lot of paperwork. Here's a calm, clear look at what they're about and how open source helps you stay organised.

Michael Wolf

NIS2 and GDPR – two acronyms that make many people take a deep breath first. Yet behind both is a sensible idea: data should be well protected, and IT should work reliably. In this article I'll calmly explain what they're about and how you can bring some order into things with little effort.

Since 2018, the General Data Protection Regulation has governed how personal data is handled across the EU. That means anything that can be linked to a person: names, addresses, emails, photos, health data. The key ideas are transparency, keeping data to a minimum and appropriate protection.

NIS2 in one sentence

NIS2 is an EU directive for better cybersecurity. It requires organisations in important sectors – like energy, health, transport or digital services – to have good security management. Germany implemented it through its own law. It mainly applies directly to medium-sized and larger organisations.

What does this mean for small businesses?

Many small businesses aren't directly affected by NIS2. Still, it's worth adopting the basic ideas – simply because they make sense:

Know what you have: Which devices, programs and services do you use?
Protect logins: Strong passwords and two-factor login.
Stay up to date: Install updates promptly.
Backups: Back up regularly – and occasionally check that restoring actually works.
Be prepared: Briefly write down what to do in an emergency.

And if you work for clients who fall under NIS2 themselves, they may ask about exactly these points. Then you'll have the answers ready.

How open source helps

Neither framework prescribes specific software. But open source has a few practical advantages that can make life easier:

Advantage	What it gives you
You choose the server	You know exactly where your data is
Open code	Experts can check what the software does
Open formats	Data can be exported at any time
Clear responsibility	You or your provider control updates and backups

Typical building blocks are Nextcloud for files, Element for chat, Vaultwarden as a password manager and Keycloak for a single login. You'll find more examples under Alternatives.

A small checklist to get started

Make a list of all programs and online services
Note which data each service holds
Turn on two-factor login wherever possible
Introduce a password manager for the whole team
Set up backups and do a test restore once
Summarise everything on one or two pages

This isn't a big project – more like a relaxed afternoon – and afterwards you'll feel really good about it.

What a small emergency plan should include

An emergency plan sounds big, but it often fits on one page. Useful contents:

Important phone numbers: IT provider, internet provider, bank, insurer.
First steps in an incident: For example, disconnect the affected device from the network, change passwords, inform your provider.
Where are the backups? And who knows how to restore them?
Who decides? One person who keeps the overview if it comes to it.
Reporting channels: Data protection incidents come with reporting obligations to the supervisory authority. Note down who you can ask in that case.

It's best to print the plan and keep it somewhere everyone knows – in an emergency, the computer might be exactly what isn't working.

Typical everyday questions

What is a record of processing activities? An overview required by the GDPR of which personal data you process and why. For many small businesses, it's a manageable table.

How often should I test backups? Once a quarter is a good rhythm. What matters is that you actually restore a file, not just check that the backup is running.

Do I need cyber insurance? That's an individual decision. Insurers often ask about exactly the basics from the checklist above – if you've put them in place, you're well prepared.

A note on the legal side

I'm an IT service provider and external information security officer, but not a lawyer. If you want to know exactly which obligations apply to your business, please talk to a legal adviser. I'm happy to help with the technical and organisational side – more under Consulting.

Conclusion

NIS2 and GDPR are no reason to worry. With a clear overview, a few good habits and software where you know where your data lives, you're in good shape.

If you'd like to give it a try, I'm happy to help – just drop me a line.

Microsoft 365 or Open Source? How to Work Out the Real Costs

What does your office software really cost? A simple guide to comparing Microsoft 365 and open-source alternatives fairly.

BSI IT-Grundschutz, Simply Explained – and How Open Source Helps

The BSI's IT-Grundschutz is a proven guide to information security. What it's about and what small businesses can take from it.