Digital Regulation: Mastering " " from the Start.

GDPR, NIS2, DORA, CRA, SREN, REC… The European and French regulatory frameworks are becoming increasingly complex. Whaller is designed to comply with them natively—not as a constraint to be managed after the fact, but as a commitment built into the architecture from the start.

context

A Rapidly Evolving Regulatory Landscape

In just a few years, the European Union and France have profoundly reshaped the legal framework governing the digital tools used by organizations. GDPR, NIS2, DORA, CRA, SREN, REC… each regulation imposes new obligations and increases the responsibilities of management, CIOs, and CISOs.

These regulations are not burdens to be endured: they reflect a collective awareness of the risks associated with technological dependence and digital sovereignty. Choosing Whaller means choosing a platform designed to address these issues natively.

2018

GDPR

European Framework for the Protection of Personal Data.

2023

SREN

French law governing digital technology, sovereign cloud, and public procurement.

2024-2025

NIS2 ∙ DORA ∙ REC

NIS2 extends cybersecurity to 18 sectors. DORA mandates financial resilience. The REC Directive strengthens the physical resilience of critical entities.

2025

CRA ∙ AI Act

The CRA imposes cybersecurity requirements on digital products from the design stage onward.

key figures

Why act now?

20M€

Maximum GDPR fine or 4% of global revenue.

18

Critical sectors covered by NIS2 (compared to 7 for NIS1).

+22,000

Financial institutions subject to DORA in Europe.

72 hours

Maximum time limit for reporting a data breach.

key texts

For every regulation, a Whaller solution

Whaller natively incorporates the requirements of the main European and French regulations. Here's how.

EU Regulation 2016/679

GDPR

General Data Protection Regulation
● Effective since May 2018

The GDPR governs the collection, processing, and retention of personal data of all European residents. It requires data controllers to adhere to the principles of data minimization, purpose limitation, and transparency.

👉 Learn more
EU Directive 2022/2555

NIS2

Network and Information Security — Version 2
● Transposed · Effective 2024

NIS2 extends cybersecurity requirements to 18 critical sectors (energy, healthcare, transportation, public administration, etc.) and mandates measures for risk management, incident reporting, and supply chain security.

👉 Learn more
EU Regulation 2022/2554

DORA

Digital Operational Resilience Act
● Effective as of January 2025

DORA requires financial institutions (banks, insurance companies, investment funds, payment service providers, etc.) to adhere to a framework for digital operational resilience: ICT risk management, resilience testing, incident reporting, and governance of third parties and cloud providers.

👉 Learn more
EU Regulation 2024/2847

CRA

Cyber Resilience Act
● Adoption in 2024 · Phased implementation 2025–2027

The CRA imposes cybersecurity requirements throughout the lifecycle of products and software that contain digital components: security by design, vulnerability management, transparency, and incident reporting.

👉 Learn more
Law No. 2024-449 · France

SREN

Law on Securing and Regulating the Digital Space
● Enacted in May 2024

The SREN Act adapts the French legal framework to the challenges of the digital age: a sovereign cloud for government agencies, combating cyberthreats, protecting minors online, and regulating platforms. Article 31 of the Act directly concerns digital public procurement.

👉 Learn more
U.S. Law · Extraterritorial Risk

Cloud Act & FISA

Clarifying Lawful Overseas Use of Data Act · Foreign Intelligence Surveillance Act
● In Effect · Permanent Risk

The Cloud Act (2018) and FISA authorize U.S. authorities to access data hosted by companies subject to U.S. law, including their foreign subsidiaries—without prior notice. This applies to GAFAM services, even those hosted in Europe.

👉 Learn more
EU Directive 2022/2555

REC

Resilience of Critical Infrastructure
● In effect · To be implemented in Oct. 2024

The REC Directive strengthens the physical, organizational, and digital resilience of critical entities in 11 strategic sectors (energy, healthcare, transportation, government, digital infrastructure, etc.). Any critical entity as defined by the REC is automatically classified as an essential entity under NIS2.

👉 Learn more

detailed analysis

What every text requires, what Whaller guarantees

For each regulation: key requirements and Whaller's solutions.

overview

Whaller Compliance Table

A summary of key regulatory requirements and Whaller's level of coverage.

Requirement GDPR NIS2 DORA CRA SREN REC Whaller Cover
Hosting in France / the EU ✔ ✔ ✔ ✔ ✔ 100% OVHcloud France
Data Encryption ✔ ✔ ✔ ✔ ✔ AES-256 + TLS 1.3
Strong Authentication (MFA) ✔ ✔ ✔ ✔ MFA Required: Whaller DONJON
Incident Management (Notification) ✔ ✔ ✔ ✔ ✔ Whaller CSIRT is active
Business Continuity / BCP-BCP ✔ ✔ ✔ Whaller RESILIENCE Offer
Human Rights ✔ Native Export & Deletion
Third-Party Qualification/Certification ✔ ✔ ✔ ✔ ✔ SecNumCloud 3.2 ANSSI
Extraterritorial Independence ✔ ✔ ✔ ✔ ✔ Cloud Act-free • 100% FR
Third-Party ICT Vendor Management ✔ ✔ ✔ Documented transparent chain
Portability and Reversibility ✔ ✔ ✔ Guaranteed Full Export

glossary

Key Terms Explained

SecNumCloud

ANSSI Qualification

The ANSSI framework, which certifies cloud offerings based on strict criteria for security, sovereignty, and independence. Whaller DONJON is the first community platform to be qualified at Level 3.2 (SaaS).

GDPR

EU Regulation 2016/679

General Data Protection Regulation (), in effect throughout the European Union since May 2018. It protects the personal data of EU residents and imposes obligations on data controllers and processors.

NIS2

EU Directive 2022/2555

Directive on the Security of Network and Information Systems, Version 2. It extends cybersecurity obligations to 18 critical sectors, strengthens governance, and imposes incident reporting requirements.

DORA

EU Regulation 2022/2554

Digital Operational Resilience Act, in effect since January 2025. It requires financial institutions to adhere to a unified framework for ICT risk management, operational resilience, and oversight of third-party providers.

CRA

EU Regulation 2024/2847

Cyber Resilience Act. The first European regulation imposing cybersecurity requirements on products containing digital components throughout their lifecycle.

SREN

French Law No. 2024-449

The Law on Securing and Regulating the Digital Space, enacted in May 2024. It adapts French law to the challenges of the digital age: sovereign cloud, public procurement, protection of minors, and the fight against cyberthreats.

Cloud Act

U.S. Law • 2018

A U.S. law that allows U.S. authorities to access data hosted abroad by companies subject to U.S. law. Incompatible with the GDPR. Whaller, a French company hosted in France, is structurally immune.

CSIRT

Computer Security Incident Response Team

A team dedicated to responding to cybersecurity incidents. Whaller has its own CSIRT ( ) for reporting and managing vulnerabilities affecting its services.

REC

EU Directive 2022/2555

Critical Infrastructure Resilience Directive, transposed in October 2024. It strengthens the physical, organizational, and digital resilience of entities operating in 11 strategic sectors (energy, healthcare, transportation, government, digital infrastructure, etc.). Any critical entity as defined by the REC is automatically classified as an essential entity under NIS2.

Our Commitment

Whaller, a Key Player in Regulatory Sovereignty

Beyond Compliance: A Political and Technical Commitment

Whaller doesn't just comply with regulations. The company actively participates in the discussions that shape the French and European regulatory framework for the digital sector—before Parliament, within institutions, and within trust ecosystems.

Ready to get started?

Whaller is available for free for up to 100 members with the Standard offer. Create your platform in 5 minutes and give it a go. 🙂

Schedule a demo