DORA (Digital Operational Resilience Act, EU 2022/2554) entered full application on January 17, 2025. If you run an e-commerce store that processes payments, handles financial data, or supplies ICT services to financial entities, DORA likely affects you. This guide explains exactly what you need to do — and what you can safely ignore.
The Digital Operational Resilience Act is an EU regulation that requires financial-sector entities — and their critical third-party ICT providers — to:
Unlike GDPR, which is broad and principle-based, DORA is operational and prescriptive. It mandates specific testing, reporting, and governance practices — not just policies on paper.
The short answer: probably not directly — but almost certainly indirectly.
DORA applies directly to "financial entities": banks, investment firms, payment processors, insurance companies, and crypto-asset service providers. If your e-commerce store is none of those, you are not directly regulated by DORA.
However, DORA also applies to critical ICT third-party providers — companies that supply ICT systems, cloud infrastructure, payment processing, or data analytics to financial entities. If you handle payments, process transactions, or provide technology services to financial-sector clients, you are in scope.
| Scenario | DORA Applies? | Why |
|---|---|---|
| You run a Shopify store selling physical goods | ✗ Directly | DORA does not apply directly to non-financial merchants. But your payment processor (Stripe, Adyen) is regulated — and their DORA compliance affects your service continuity. |
| You operate a marketplace processing payments | ✗ Usually not | Unless you hold an e-money or payment-institution license. Most marketplaces route through a licensed PSP. |
| You are a payment gateway / PSP / fintech | ✓ Yes | All payment institutions are financial entities under DORA. Full scope applies. |
| You provide SaaS/ICT to banks or insurers | ✓ Yes as TPP | DORA designates critical ICT third-party providers. If you serve financial entities, expect contractual flow-down of DORA obligations. |
| Your store uses AI-driven fraud detection or credit scoring | ✓ Possibly | If your algorithms qualify as "ICT services" to financial entities, DORA's testing and documentation requirements apply. |
If you determine that DORA applies to your business — either directly or as a third-party provider — here is the practical checklist:
DORA mandates reporting of major ICT incidents to competent authorities. For financial entities, this means:
For third-party providers, the obligation is contractual — your financial-entity clients must flow these requirements down to you.
Financial entities must conduct regular testing:
This is where automated compliance monitoring becomes critical. If you cannot demonstrate continuous testing and oversight, you will fail a DORA audit.
DORA requires a documented ICT risk management framework that covers:
This is the part that ripples down to e-commerce operators and SaaS providers. Financial entities must:
If you provide services to financial entities, expect to sign contracts that include DORA-compliant vendor clauses — covering audit rights, incident notification, and service continuity guarantees.
For most e-commerce operators who are not directly in DORA scope, the practical impact is:
Stripe, Adyen, Mollie, and similar PSPs are all regulated under DORA. Ask your provider for their DORA compliance statement. If they suffer an ICT incident, your store's ability to process payments could be affected.
Identify who provides your hosting, CDN, payment processing, analytics, and email. You should have basic documentation of which third parties handle your data — this is also a GDPR requirement (Art. 28).
DORA's emphasis on "continuous resilience testing" applies upstream to e-commerce platforms as well. Run weekly or daily automated compliance scans covering HTTPS, security headers, and cookie consent. A free compliance scan takes 10 seconds.
Even if DORA does not require reporting for your store, keep a log of security incidents (downtime, data breaches, payment disruptions). When a client or regulator asks, you have a record — not a blank stare.
Many businesses confuse DORA with NIS2 (the revised Network and Information Security Directive). Here is the distinction:
| Aspect | DORA | NIS2 |
|---|---|---|
| Scope | Financial entities + their critical ICT providers | Essential and important entities across all critical sectors (energy, transport, health, digital infrastructure, public admin) |
| Effective date | January 17, 2025 | Member states must transpose by October 17, 2024. Enforcement varies by country. |
| Key obligations | Incident reporting, resilience testing, ICT risk management, third-party oversight | Risk management, supply chain security, incident reporting, governance accountability |
| Penalties | Up to 2% of annual turnover (for financial entities) | Up to €10M or 2% of annual turnover (whichever is higher) |
| Overlap | Both require incident reporting, risk management, and supply chain oversight. If you are in scope of both, you can align compliance programs. | |
Run a free compliance scan on your website — checks HTTPS, cookie consent, privacy policy, security headers, and more. Takes 10 seconds. No sign-up needed.
Run your free scan →Pro automatically re-scans your site every day, generates auditor-ready PDF reports, and emails you if your compliance score drops. $79/year — less than one hour of a consultant's time.
See Pro →Disclaimer: This guide is for informational purposes and does not constitute legal advice. DORA compliance requirements vary by entity type, jurisdiction, and specific circumstances. Consult a qualified legal professional for your specific situation.
How does EUComply compare with the established tools? See our head-to-head comparison — pricing, features and where each one falls short.