Cyber and Privacy Regulator Directory: every national authority and its official site

When an incident crosses borders, the first hour is often lost finding out which authority to notify and where its official reporting page lives. This directory lists the national data protection authorities and national cybersecurity agencies for the EU and EEA and for the main jurisdictions outside Europe, with each body's official site. It is a source-site layer: use it to reach the regulator's own guidance, breach forms and enforcement decisions rather than relying on summaries. It is written for incident responders, privacy leads and compliance teams who need a starting point fast. For what each law requires, see the Global Privacy Regulatory Map and the Global Cybersecurity Regulatory Map; for notification deadlines, the Breach Notification Laws by Country Guide.

Source note: checked on 9 November 2026. EU and EEA data protection authorities and their sites are taken from the European Data Protection Board's member list. Other entries come from official government pages where we could read them, and from regulator sites already cited in our other guides; agencies are renamed and sites move, so confirm the address on a government domain before submitting anything.

Key takeaways

• Two authorities, two clocks: a personal data breach usually goes to the data protection authority, while a significant cyber incident at a regulated entity goes to the national CSIRT or cyber competent authority; many incidents need both.
• The EU has one privacy authority list: the European Data Protection Board publishes every member authority and its site, plus the EEA observers and the European Data Protection Supervisor for EU institutions.
• NIS2 authorities differ by country: each member state names its own competent authorities, CSIRTs and single point of contact, and the European Commission keeps a page per country.
• Federal countries split the role: Germany has a federal commissioner and state authorities; the United States has no national privacy authority, so the FTC, sector regulators and state Attorneys General fill the role.
• Bookmark the reporting page, not the home page: regulators move forms; record the exact breach or incident reporting URL in your incident playbook and recheck it every six months.

Regulations and frameworks at a glance

Main jurisdictions outside the EU, with the privacy authority, the national cybersecurity body and the laws they administer. Jurisdictions are listed alphabetically.

For the United States, state regulators matter as much as federal ones; see the US State Privacy Laws Guide.

EU and EEA data protection authorities

From the European Data Protection Board member list. Under the GDPR one-stop-shop, a controller with a main establishment in the EU deals mainly with its lead supervisory authority for cross-border processing, but a personal data breach is notified to the competent authority under Article 33, usually the lead authority. Germany also has data protection authorities in each federal state; the federal commissioner (BfDI) is listed here.

EU cybersecurity authorities under NIS2

NIS2 (Directive (EU) 2022/2555) requires each member state to designate one or more competent authorities, one or more CSIRTs and a single point of contact. Some states give all three roles to one body; others split them by sector. The European Commission publishes a NIS2 implementation page per country naming these bodies, and that page is the place to confirm who receives your 24-hour early warning. The examples below show the pattern; they are not a complete list.

Financial entities follow DORA instead of NIS2 for incident reporting and report to their financial supervisor; see the DORA ICT Third-Party Risk and Register of Information Guide. Sector regulators such as telecoms, energy and health authorities may also be competent authorities for their sector.

Choosing the right authority for an incident

Two authorities can be engaged by the same event. A ransomware attack on a hospital in an EU state can trigger a GDPR notification to the data protection authority and a NIS2 early warning to the CSIRT, each with its own clock and form. Prepare both in advance. See the Data Breach Notification Checklist.

Keeping the directory current in your playbook

1. Copy only the entries you need: list the jurisdictions where you have establishments, customers, employees or regulated services.
2. Record the reporting page: for each authority, store the direct URL of the breach or incident form, the language it accepts and whether an account must be created first; ANSSI and several other agencies require registration on a portal.
3. Verify the domain: confirm every address sits on a government or EU domain before use; regulator impersonation is a known phishing lure.
4. Recheck twice a year: agencies are reorganised (Japan opened its National Cybersecurity Office in July 2025; Switzerland converted its NCSC into a federal office), and NIS2 transposition is still changing designations.
5. Test in exercises: include "find the right authority and form" as an inject in tabletop exercises and time it.

Where identity fits

Regulator portals are another set of accounts: incident responders need working, named credentials before an incident. Keep portal accounts in a password manager or vault with at least two named owners, enable MFA where the portal offers it, and review access when responders leave. Never share a single login across a team. See the Incident Response Plan Template.

Standards and references

• European Data Protection Board: Members
• European Commission: NIS2 Directive implementation, country page (Lithuania)
• CSIRTs Network: Members
• Prime Minister's Office of Japan: Opening ceremony of the National Cybersecurity Office

Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Global Cybersecurity Regulatory Map · Breach Notification Laws by Country Guide · International Data Transfers Map. This guide summarises national cyber and privacy authorities and their official sites as checked on 9 November 2026 and is not legal advice.