Personal data protection and cybersecurity under EU law: two sides of the same coin

This thesis examines the relationship between personal data protection and cybersecurity within the framework of European Union law, assessing whether these two regulatory domains operate as a coherent and mutually reinforcing system for governing digital risk. In this sense, the thesis conceptualizes personal data protection and cybersecurity as two interdependent sides of the same regulatory coin within EU digital governance, addressing common digital risks through distinct but interconnected legal regimes.The analysis focuses on the General Data Protection Regulation (GDPR) and the contemporary EU cybersecurity framework, in particular the NIS2 Directive, the Cybersecurity Act and the Digital Operational Resilience Act (DORA). The thesis demonstrates that, despite a clear convergence of regulatory objectives and principles such as risk-based regulation, accountability and security and privacy by design the two regimes remain legally and institutionally fragmented. This fragmentation generates significant compliance, governance and resilience challenges for organizations operating in complex and highly interconnected digital environments. To explore these dynamics empirically, the thesis analyses the 2025 Marks & Spencer cyberattack as an illustrative case. The incident highlights how weaknesses in cybersecurity governance, especially in relation to supply-chain oversight and incident detection, can cascade into personal data protection risks and compliance challenges under the GDPR. The case shows that formal compliance mechanisms alone are insufficient when underlying governance structures are fragmented. Overall, the thesis argues that effective compliance with EU digital regulation increasingly depends on integrated governance approaches that align data protection and cybersecurity within broader organizational risk management and resilience frameworks. Rather than treating the two regimes as separate compliance domains, organizations must develop coherent governance structures capable of managing overlapping regulatory expectations in practice.