On March 17, 2026, the European Parliament published a briefing signalling continued momentum toward the creation of an EU‑wide Single Entry Point (SEP) for security incident reporting. The initiative is part of the European Commission’s proposed Digital Omnibus legislative package and is intended to simplify how organizations report incidents – including personal data breaches – under multiple EU legal frameworks.
What is the Single Entry Point?
The SEP would take the form of a centralized, fully digital reporting platform managed by ENISA, the EU Agency for Cybersecurity. Through this platform, organizations would be able to submit security incident notifications required under a range of EU laws – including the GDPR, NIS2, DORA, the Cyber Resilience Act, and others – using harmonized templates and a single interface, rather than navigating multiple national authorities and reporting channels.
What the SEP would (and would not) change
Importantly, the SEP is designed to streamline how incident reports are submitted – not what must be reported or when. Existing notification deadlines and substantive requirements under EU law would remain unchanged. ENISA would act as a routing mechanism, forwarding notifications to the competent national or EU authorities for assessment.
One notable proposed change, confirmed in the Parliament’s briefing, is an extension of the GDPR personal data breach notification deadline from 72 hours to 96 hours.
If the SEP platform is unavailable, organizations would be required to use alternative reporting channels.
What happens next?
The European Parliament expects the SEP to become operational within 18 months of the Digital Omnibus package entering into force, with a possible extension to two years if additional time is needed to ensure the platform’s security or functionality.
While the proposal is still subject to the EU legislative process, the briefing reflects a strong policy commitment to reducing the operational burden of multi‑regime incident reporting. Organizations subject to EU security and data incident notification obligations should monitor developments and consider how a centralized reporting mechanism may affect their internal incident response processes.
For questions or further analysis, the Alston & Bird Privacy, Cyber & Data Strategy teams are available to assist.
