What is Consistency control?

A documented review process that compares material factual assertions, terminology, confidence levels and commitments across submissions.

What is Information sharing?

The lawful exchange or comparison of relevant information between authorities; it is not necessarily automatic or unlimited.

What is Authority cooperation?

Structured coordination or assistance between competent authorities under applicable EU and national legal frameworks.

What is Regime-specific analysis?

Legal analysis tailored to the statutory question, powers and remedies of the authority receiving it, without altering the underlying facts.

What is Common factual chronology?

A controlled, dated and source-linked account of material events, decisions, actions and unresolved issues.

Keep Parallel Authorities on One Factual Spine — Cyber Enforcement Counsel: From Regulatory Contact to Defensible Outcome

1. Treat the incident record as a shared asset

Build one factual spine

Create one approved account of what happened, when, what was affected, what was known, and what was done. Do not create separate incident stories for separate authorities.

Separate facts from conclusions

The spine records source-backed facts, confidence levels, and open questions. It does not label the event a legal breach, security failure, or product non-compliance.

Why consistency matters

Under Article 35 of NIS2, a competent authority must inform the relevant GDPR supervisory authority without undue delay in specified supervision or enforcement circumstances involving a potentially notifiable personal-data breach. NIS2 also provides for cross-border assistance among competent authorities.

2. Start with a chronology, not three drafts

Use dated, sourced entries

Record each material event with a timestamp, source, and confidence level. Example: access logs may establish authentication; audit logs may establish that an export was generated.

State uncertainty accurately

If the company cannot establish whether a file left a device, record that as unresolved. Do not convert missing proof into a definitive statement that no disclosure occurred.

3. Add a claim-control layer

Use four labels

Classify each material statement as a confirmed fact, technical inference, company position, or open issue. The label determines how confidently it can be stated.

Avoid false inconsistency

A GDPR response must not present certainty where the NIS2 response says the point is still being investigated. One claim register keeps the two submissions aligned.

4. Thought exercise: identify the unsafe sentence

Choose the statement that needs correction

The forensic team confirms an export was created but cannot determine whether it was transferred outside the contractor's managed device.

Which statement is unsafe for the factual spine?

"An export was generated from the portal on 4 June."
"The company has not established whether the export was transferred onward."
"No customer information left the contractor's device."

The third statement is unsafe because it asserts a negative fact that the available evidence does not establish. Replace it with the confirmed event, the current investigative limit, and the next validation step.

5. Tailor the analysis, not the event

GDPR lens

A data-protection authority may focus on personal-data categories, affected people, safeguards, and impact on rights and freedoms. Its powers and cross-border cooperation framework are set by the GDPR.

NIS2 lens

A NIS2 authority may focus on service continuity, identity controls, incident handling, and risk-management measures. National transposition law shapes the immediate procedure.

Same event; different analysis

Keep the underlying chronology identical. Tailor the legal question, requested evidence, and remedy discussion. Do not tailor facts to make a regime-specific argument easier.

6. Assume cooperation, but do not speculate about sharing

Do not promise regulatory silos

Article 35 of NIS2 establishes a specific duty to inform the relevant GDPR supervisory authority in defined supervision or enforcement circumstances. Authorities may also cooperate under other applicable provisions. Do not assure a business team that a statement to one authority will remain isolated.

Cooperation has limits

Cooperation does not make every document automatically shareable or every authority's powers interchangeable. Check confidentiality, purpose, and applicable national procedure.

Maintain one contact log

Track the recipient, legal basis, version, factual assertions, reservations, and commitments for each contact. Compare every new filing against the existing regulatory record.

7. Run a consistency review before signature

Check meaning, not only wording

Test dates, technical terms, confidence levels, remediation status, and disclosed limitations. A shared phrase can still mislead if it means something different in each filing.

Correct transparently

When new evidence changes a prior account, preserve the original basis and record when the company learned more. Consider correction or supplementation rather than silently rewriting the record.

Check understanding

Application question

A company tells its GDPR authority that an export was transferred outside a managed device. Its draft NIS2 response says only that "an export was generated." Both statements rely on the same audit record, which establishes generation but not onward transfer. What is the best next step?

What is the best next step?

Reconcile both factual descriptions with the audit record, state that onward transfer is unresolved, and preserve any difference in legal analysis or requested remedy.
Keep the narrower NIS2 wording because each regulator should receive a separate narrative.
Remove the GDPR statement without documenting the correction so that the submissions no longer appear inconsistent.

Show Answer

Answer: A) Reconcile both factual descriptions with the audit record, state that onward transfer is unresolved, and preserve any difference in legal analysis or requested remedy.

The company should reconcile both factual accounts against the source record. The audit record establishes that an export was generated, not that it was transferred onward. The authorities may receive different legal analyses, but the underlying event should not be described inconsistently without an evidence-based reason.

Key Terms

Consistency control: A documented review process that compares material factual assertions, terminology, confidence levels and commitments across submissions.
Information sharing: The lawful exchange or comparison of relevant information between authorities; it is not necessarily automatic or unlimited.
Authority cooperation: Structured coordination or assistance between competent authorities under applicable EU and national legal frameworks.
Regime-specific analysis: Legal analysis tailored to the statutory question, powers and remedies of the authority receiving it, without altering the underlying facts.
Common factual chronology: A controlled, dated and source-linked account of material events, decisions, actions and unresolved issues.