Should the documentation implementing NIS provisions be separate, even though most of the information is already contained in GDPR documentation?

ANSWER

Yes, the documentation implementing NIS provisions should be integrated with GDPR documentation, taking into account both shared and specific elements. Integration makes it possible to avoid duplication of information, enables better management of obligations, and supports a more coherent approach to risk management as well as technical and organisational safeguards. Within such documentation, common elements – such as incident management or security policies – may be unified, while separate requirements specific to NIS and GDPR should be described in dedicated sections.

This approach enables greater operational efficiency and ease of compliance with both sets of regulatory requirements.