Cybersecurity and Cybercrime Lawyers : NIS2, DORA, Cyberattacks
DELCADE, a practice dedicated to NIS2 and DORA compliance and the legal management of your cyber incidents and disputes
The cyber threat is more tangible than ever: ransomware, data breaches, attacks on critical infrastructure, incidents are multiplying and affect organisations of every size and sector. In response, the European regulatory framework has been considerably strengthened by the adoption of the NIS2 Directive and the DORA Regulation, which impose substantial obligations on the security of information systems and operational resilience.
Our lawyers in IT and Data advise companies, operators of essential services, financial-sector players and their suppliers on achieving compliance with these new requirements, managing cyber incidents from a legal standpoint and conducting the related litigation. We act upstream, to structure their contracts and prevention policy, and on an emergency basis when a crisis strikes.
Cyberattacks - Crisis Management and Legal Response
A cyberattack triggers several legal obligations at once and exposes the organisation to multiple risks: notification to the authorities, in particular where personal data is breached, contractual liability towards clients and partners, reputational harm and liability claims. The legal response must be as swift as the technical one.
Our lawyers operate within the crisis unit to manage:
- Legally qualifying the incident and assessing legal exposure
- Notifying ANSSI, the CNIL and the relevant sector-specific authorities
- Preserving and compiling digital evidence (legal forensics)
- Filing a criminal complaint and providing assistance during the investigation
- Managing communications to clients, partners and cyber insurers
- Helping to trigger cyber insurance cover and coordinating with experts
NIS2 Compliance - Security of Networks and Information Systems
The NIS2 Directive, as transposed into French law, considerably broadens the range of entities subject to cybersecurity obligations. Essential entities and important entities across eighteen sectors of activity are now required to put in place cyber risk-management measures, to notify significant incidents and to ensure the security of their supply chain.
Our NIS2 support covers:
- Identifying the company’s status (essential or important entity) and the applicable obligations
- Conducting a cyber-maturity audit and assessing the gaps against NIS2 requirements
- Setting up security policies, continuity plans and incident-management procedures
- Setting the legal framework for supply chain security (supplier due diligence)
- Preparing for inspections by the competent authorities (in particular ANSSI, the French national cybersecurity agency)
- Drafting cybersecurity clauses in supplier contracts
DORA Compliance - Operational Resilience in the Financial Sector
The DORA Regulation (Digital Operational Resilience Act), in force since January 2025, imposes a demanding framework for IT risk management and operational resilience on financial entities, banks, insurers, asset management companies and payment service providers, as well as their critical IT service providers.
We advise financial-sector players on:
- Mapping IT risks and assessing DORA compliance
- Framing contractual relationships with critical third-party ICT service providers
- Notifying major ICT-related incidents to the financial supervisory authorities
Cyber Resilience Act - Security of Digital Products
The Cyber Resilience Act introduces new cybersecurity requirements applicable to products with digital elements. Our lawyers advise manufacturers, software publishers, distributors and importers on identifying their obligations, adapting their contractual documentation and managing the risks arising from placing digital products on the market.
Data Act - Access to, Sharing and Monetisation of Data
The Data Act governs access to the data generated by connected products and related services, as well as the sharing of that data between businesses, users and public bodies. Our lawyers advise their clients on analysing their obligations, structuring their contracts and securing the business models built on data exploitation.
The AI Regulation - Security and Governance of AI Systems
The European Artificial Intelligence Regulation imposes specific obligations on providers and users of AI systems, in particular on risk management, documentation, transparency and human oversight. Our lawyers advise companies on aligning these obligations with their cybersecurity, digital compliance and data governance priorities.
Hacking, Cyberattacks and Criminal Cyber Litigation
Cybercrime — fraudulent access to a computer system, data theft, sabotage, online fraud — is severely punished under French criminal law. Whether they are victims or under investigation, our clients benefit from expert support at every stage of the criminal proceedings.
We act in connection with:
- Criminal complaints for attacks on automated data processing systems (STAD, the French offences relating to automated data processing systems)
- Proceedings before the specialised courts (JUNALCO, the national jurisdiction for organised crime, and OCLCTIC, the French cybercrime investigation unit)
- Criminal defence where clients are accused of computer-related offences
- Civil actions to obtain compensation for the harm suffered
- Emergency proceedings (interim relief, protective seizure) to bring an infringement to an end