Local authority compliance: GDPR, AI Act & NIS2

Why the 'Local Authority' sector is concerned

Local authorities process highly varied and sometimes sensitive data: children's data (after-school activities, school catering), social data (local social action centres), civil registration, and public-space video surveillance. Each department has its own purposes and legal bases, making data mapping a demanding exercise.

Local services increasingly rely on AI: citizen relations, request management, and sometimes pre-assessment of benefits. Some of these uses, when they affect access to services, may fall under high risk within the meaning of the AI Act.

Finally, local authorities are recurring targets of ransomware attacks, with a direct impact on citizens (civil registration blocked, services interrupted). NIS2, depending on transposition and size, strengthens their cybersecurity obligations — even as many operate with limited resources.

GDPR — the diversity of local processing activities

The local authority is responsible for a mosaic of processing activities: civil registry, electoral rolls, after-school programmes (children's data), social welfare, and video surveillance. Each requires its own legal basis, information notices, and retention periods, with video surveillance and children's data calling for particular vigilance.

The appointment of a DPO is mandatory; they are often shared across local authorities.

Key obligations

• Register covering all services.
• Legal bases and information notices by service.
• Vigilance on children's data and video surveillance.
• Mandatory DPO (often shared).

AI Act — local public services

AI in local public services (citizen relations, pre-processing of applications) often falls under limited risk, but may shift to high risk when assessing access to benefits. The deploying authority must then ensure supervision, transparency and, where applicable, a FRIA.

Key obligations

• Qualifying local AI use cases.
• Human oversight and transparency.
• FRIA for high-risk uses.
• Bias control.

NIS2 — cybersecurity for local authorities

Depending on national transposition and size, local authorities fall within the scope of NIS2. Faced with frequent ransomware attacks, they must strengthen their security posture, prepare for service continuity and, in many cases, pool their resources.

Key obligations

• Risk management measures (Art. 21).
• Continuity of local public services.
• Supply chain security (software vendors, service providers).
• Incident notification.

Comparative overview of regulations

How these regulations interact

Local authorities must combine a wide variety of GDPR processing activities, heterogeneous AI uses, and often under-resourced cybersecurity. Pooling resources (DPO, CISO, tools) between local authorities is the most realistic response, especially since all three texts share a common governance and security foundation.

A local e-service providing access to assistance illustrates the cumulative effect: GDPR (user data, sometimes involving children), AI Act (if pre-processing by AI), and NIS2 (security and continuity).

Application timeline

• 1GDPR. In force; DPO mandatory.
• 2AI Act. High risk: From 2 August 2026 for access to benefits.
• 3NIS2. French transposition in progress; scope for local authorities to be confirmed.

Applicable penalties

Specific caps may apply to public bodies under national law; the AI Act provides for up to €35M or 7%. The impact of ransomware on end users is immediate and highly visible.

Resource constraints make pooling and outsourced support particularly relevant.

Compliance roadmap

• 1Map services. Inventorying civil registry, out-of-school, social, video surveillance, and local AI systems.
• 2Pool resources. Sharing DPO, CISO and tools across local authorities.
• 3Securing (NIS2). Measures and continuity of local services.
• 4Governing AI. Qualifying use cases and conducting a DPIA where required.
• 5Steer. Appointing a DPO and involving elected representatives.

How Data Comply One supports the sector

Data Comply One covers GDPR, the AI Act, and NIS2 on a single platform, with outsourced DPO and CISO services — tailored to local authorities with limited internal resources, through resource pooling and dedicated support.

DCO offers templates tailored to the local government environment (multi-service register, DPIA for video protection, incident procedures).

Frequently asked questions