Lilshira
EU DORA forces hotels to report ICT incidents within four hours
The EU’s Digital Operational Resilience Act now obliges hotels to report ICT incidents within four hours, followed by updates at 24 hours, 72 hours and one month. The rule took effect on 17 January 2025 and applies to hotel operators using centralized cloud services across the European Union.
Dans cet article
Cette actualité n’a pas encore été traduite dans votre langue ; elle est affichée en anglais.
L’essentiel
- What changes
- Hotels must notify national authorities of ICT incidents within four hours, then at 24‑hour, 72‑hour and one‑month intervals
- Timing
- DORA became fully enforceable on 17 January 2025 and reporting windows apply from that date
- Who is affected
- Hotel operators using SaaS‑based property management, booking or payment systems in the EU
Les détails
- Annoncé par
- European Union
- Entrée en vigueur
- 17 January 2025
- Règle précédente
- Before DORA, ICT disruptions in hotels were treated as private business inconveniences without mandatory rapid reporting.
- Nouvelle règle
- DORA treats ICT disruptions as systemic economic hazards, requiring hotels to notify authorities within four hours and provide further updates within 24 hours, 72 hours and one month.
Regulatory background
The Digital Operational Resilience Act (DORA; Regulation (EU) 2022/2554) became fully enforceable on 17 January 2025, extending its strict incident‑reporting regime to the hospitality sector. Simultaneously, the General Data Protection Regulation (GDPR) continues to demand breach notification within seventy‑two hours, creating overlapping obligations for hotel operators.
- DORA enforcement date: 17 January 2025
Reporting obligations for hotels
Under DORA Article 19, hotels must submit an initial incident notification to the national competent authority within four hours of classifying the disruption, and no later than twenty‑four hours after awareness. An intermediate report is required within seventy‑two hours, and a comprehensive forensic evaluation must be delivered within one month.
- Initial notification: within four hours of incident classification
- First update: no later than twenty‑four hours after awareness
- Intermediate submission: within seventy‑two hours
- Final forensic report: within one month
Operational implications for hospitality providers
The new timelines force hotel management to treat technical outages as regulatory events rather than routine maintenance. Failure to meet DORA deadlines can trigger substantial administrative fines, while GDPR still requires notification of any personal data impact within seventy‑two hours. Hotels must align SaaS contracts with DORA Article 30 and ensure third‑party providers are designated as critical ICT providers.
- Review SaaS contracts for DORA‑compliant recovery objectives
- Implement automated alerts to meet four‑hour reporting window
- Train staff on simultaneous DORA and GDPR breach procedures
Ce que cela change pour les voyageurs
Préparation du voyage
- Existing bookings remain valid; however, guests may experience service interruptions during cloud outages.
- Travel agents should monitor hotel communication channels for potential delays caused by incident reporting.
Coût et documents
- No new fees are introduced by DORA, but hotels may incur costs to upgrade incident‑response systems.
- Hotels must retain detailed incident logs and forensic reports for up to one month as evidence.
Ce que vous devez faire
- Hotel operators must integrate a four‑hour notification process into their incident‑response plans.
- Staff must be trained to differentiate DORA reporting from GDPR breach notifications.
- Review and amend SaaS contracts to include DORA Article 30 compliance clauses.
- Establish continuous monitoring of cloud service status to trigger timely alerts.
Qui est concerné
-
Hotels using cloud‑based property management systems
These systems are centralised SaaS platforms that fall under DORA’s third‑party operational dependency rules.
À faire Implement four‑hour incident notification and subsequent reporting timelines.
-
Hotel chains with centralized booking engines
Integrated financial channels trigger DORA obligations for rapid disclosure of service disruptions.
À faire Align booking engine contracts with DORA Article 30 and ensure rapid reporting capability.
-
Third‑party SaaS providers serving hotels
Designated as critical ICT third‑party providers under DORA, they are subject to supervisory oversight.
À faire Provide hotels with required data and support to meet DORA reporting deadlines.
Questions fréquentes
When did DORA become enforceable for hotels?
DORA became fully enforceable on 17 January 2025, at which point its incident‑reporting requirements started applying to hotel operators across the EU.
What are the DORA reporting deadlines for hotel ICT incidents?
Hotels must submit an initial notification within four hours of classifying an incident, a first update no later than twenty‑four hours after awareness, an intermediate report within seventy‑two hours, and a final forensic evaluation within one month.
How does DORA reporting differ from GDPR breach notification?
DORA focuses on any ICT disruption, requiring notification within four hours, while GDPR only mandates reporting of personal data breaches within seventy‑two hours, meaning hotels may need to file two separate notifications for the same event.
Do hotels need to change their contracts with cloud providers because of DORA?
Yes, contracts should be reviewed to include DORA Article 30 clauses such as minimum recovery time objectives, penetration testing participation and data extraction rights to ensure compliance with the new reporting regime.
What penalties can hotels face for missing DORA reporting timelines?
Failure to meet DORA’s strict notification windows can result in substantial administrative financial sanctions, as regulators treat prolonged unplanned system inaccessibility as a breach of the act’s resilience obligations.
Which EU authorities oversee DORA compliance for hotels?
National competent authorities designated by each member state supervise DORA compliance, with guidance from European supervisory bodies such as the European Data Protection Board and the European Supervisory Authorities.
