// NIS2 · KSC · DORA · GDPR · incidents · disputes
NIS2, DORA and GDPR compliance, technology contracts, incident handling and disputes after cyberattacks. The Tax Fin Law team handles the legal side of your company's security, from policies and contracts to proceedings before authorities and courts in Poland.
Firm e-mail: kontakt@taxfinlaw.pl
Didn't apply for entry in the register because you didn't know the act covers you? The application still has to be filed after the deadline. We start by assessing whether, and in which category, the act applies to you.
quick check →From regulatory compliance, through contracts and incidents, to disputes and criminal proceedings. The technical part is handled by your IT team or a chosen auditor; we agree the scope with them so that it meets legal requirements.
From assessing whether the act applies to you to audit readiness.
Compliance, documentation and dealings with UODO, the Polish data protection authority.
For finance, software and hardware makers, and AI providers.
NIS2 and DORA require supplier risk management. That is a job for contracts.
When an attack, leak or ransomware hits.
After an attack, a fast legal response matters.
Responsibility for cybersecurity rests with the board.
Most leaks start inside the company.
// who we serve
Energy, transport, health, water, digital infrastructure, manufacturing and other sectors covered by the act.
Financial sector firms and their ICT service providers.
Makers of software, devices and AI systems sold in the EU.
Mid-sized firms where the board itself is responsible for security.
Reporting deadlines under the NIS2 Directive and the GDPR. They run from the moment you become aware of a significant incident or a personal data breach.
Securing evidence and logs, establishing the scope, deciding whether the incident is significant. This is the best moment to contact a lawyer.
internal procedureFirst notification to the competent CSIRT, stating whether the incident may have been caused by unlawful action.
Art. 23(4)(a) NIS2A fuller notification to the CSIRT. If personal data is affected, a notification to the President of UODO within the same deadline.
Art. 23(4)(b) NIS2 · Art. 33 GDPRDescription of the incident, root cause, measures applied and cross-border impact.
Art. 23(4)(d) NIS2Where a breach is likely to result in a high risk to individuals, they must also be informed without undue delay (Art. 34 GDPR). The Polish KSC act designates the competent CSIRT and the form of notification. We establish this together in the first hours.
Write to: kontakt@taxfinlaw.plNIS2 shifts responsibility for cybersecurity from the IT department to the board.
Maximum fine level for essential entities under the directive. For important entities: EUR 7m or 1.4% of turnover. In Poland, fines may be imposed two years after the act enters into force.
Art. 34 NIS2Management bodies approve risk management measures, oversee their implementation and must undergo training.
Art. 20 NIS2An entity covered by the act assesses the security of its suppliers. Companies outside the act will receive these requirements in contracts from their clients.
Art. 21(2)(d) NIS2Three questions, instant result. The check gives an indication, not a legal classification. A final assessment requires analysing your business and group structure.
The result appears here as soon as you select your answers. You will see whether the act is likely to apply and what the next deadline is.
Discuss the result: kontakt@taxfinlaw.plSome entities are covered regardless of size, e.g. DNS service providers, domain registries, trust service providers. The authority may also designate an entity individually.
You get a quote for each stage before work begins.
We establish whether, and in which category, the act applies, and what is already in place.
We compare the legal requirements with your documentation and contracts. You get a prioritised task list.
We draft policies, procedures, board resolutions and amendments to supplier contracts.
Updates after legal changes, incident support and audit preparation.
I am a Polish attorney-at-law (radca prawny) and the founder of Tax Fin Law. I am responsible for case strategy and client contact. Behind Paragraf72 is the firm's team, which prepares analyses, documentation, contracts and court pleadings.
I started at the Tax Administration Chamber in Warsaw, then spent years advising corporate clients. I know proceedings, inspections and how the authority thinks. That helps when a company deals with a CSIRT, the President of UODO or a supervisory authority.
Day to day I advise companies in regulated sectors: data protection, contracts with IT, cloud and AI suppliers, compliance, corporate governance. I also represent companies as injured parties in criminal proceedings.
Cybersecurity connects all these areas. Most obligations under NIS2, DORA or the GDPR are met through documents, contracts and board decisions, in other words through law.
I see most of the risk not in the server room, but in contracts, procedures and whether the board knows what to report and by when.Daniel Borzym
No. We handle legal obligations, documentation, contracts and dealings with authorities. The technical part is done by your IT team or an auditor of your choice; we agree the scope with them so that it meets the requirements of the act.
The application for entry in the register must be filed regardless of the deadline having passed. First we confirm whether the act applies and as what type of entity, then we file the application and plan implementation before April 2027.
As a rule, the act covers medium-sized and large entities in the listed sectors, and size is calculated taking group links into account. There are exceptions, e.g. DNS or trust service providers. Even outside the act, NIS2 requirements may reach you through contracts with clients who are covered.
Act immediately: notify your bank and the recipient's bank asking them to freeze the funds, secure the correspondence and report the crime. In parallel we assess claims against the bank, the counterparty and the insurer. The chances of recovering the funds shrink with every hour.
Don't shut systems down without consulting IT, secure logs and communications, record the time of detection and contact a lawyer. The 24- and 72-hour reporting deadlines run from that moment.
It depends on the size of the company, the number of companies in the group and the state of the documentation. We provide a quote after the first conversation and assessment, before work begins.
The first conversation is for assessing the situation and agreeing the scope. In case of an incident, write straight away with a short description.
507 954 406
ul. Solec 38, Warsaw
Tax Fin Law Kancelaria Radcy Prawnego Daniel Borzym
ul. Malborska 16F lok. 24, 03-286 Warszawa
Tax ID (NIP) 5691838055