Public sector compliance: GDPR, AI Act & NIS2

Why the 'Public Sector' is concerned

The public sector processes personal data at scale, often of a sensitive nature: civil status, social, tax, and public health data. The scale and nature of these processing activities demand a high level of GDPR rigour and set an expectation of exemplary conduct from public authorities.

AI is becoming embedded in the automated processing of applications and access to benefits. The AI Act classifies as high-risk AI systems intended to assess eligibility for essential public benefits and services, as well as several sovereign-function use cases: these deployments carry the most demanding obligations.

Finally, public administration is among the entities covered by NIS2 (depending on national transposition, which in France includes a large number of public bodies). Public administrations are prime targets for ransomware attacks, with a significant impact on continuity of public services.

NIS2 — public administration

NIS2 targets public administration, with a degree of transposition latitude left to Member States regarding the exact scope (particularly at the local level). In France, many public bodies fall within its scope and must deploy risk management measures, notify incidents, and engage their leadership.

Continuity of public service and the security of citizens' data are at the heart of the challenges.

Key obligations

• Risk management measures (Art. 21).
• Notification of significant incidents.
• Continuity of public service.
• Supply chain security (public publishers, service providers).

AI Act — high-risk public services

The AI Act classifies as high-risk AI systems intended to assess eligibility for, and grant, reduce or withdraw, essential public benefits and services, as well as several sovereign-authority use cases. Public bodies deploying these systems bear the full set of high-risk obligations.

Internal or informational uses fall under lighter regulatory regimes.

Key obligations

• Classify AI systems used for access to services (often high-risk).
• Risk management and data quality.
• Human oversight and enhanced transparency.
• Fundamental Rights Impact Assessment (FRIA).

GDPR — citizen data at large scale

The public sector is responsible for large-scale and often sensitive processing activities. It must have solid legal bases (public interest mission), clear information notices, DPIAs for high-risk processing, and security commensurate with the stakes involved.

Key obligations

• Legal basis (public interest mission) and information.
• DPIA for high-risk processing operations.
• Security and retention periods.
• Governing automated decision-making.

Comparative overview of regulations

How these regulations interact

Digitised public services combine all three frameworks: an online procedure for accessing a benefit brings together GDPR (citizen data), the AI Act (where eligibility is assessed by AI, often classified as high-risk), and NIS2 (security and service continuity). The Fundamental Rights Impact Assessment (FRIA) provided for under the AI Act interfaces with the GDPR's Data Protection Impact Assessment (DPIA).

The public-sector specificity is the requirement for transparency and non-discrimination: a poorly governed AI used for benefit allocation can create systemic discrimination at scale.

Application timeline

• 1GDPR. In force.
• 2AI Act. High risk: From 2 August 2026 for essential public services.
• 3NIS2. French transposition in progress; public-sector scope to be confirmed.

Applicable penalties

The GDPR provides for up to €20M or 4%, but specific caps apply to public authorities and bodies under national law. The AI Act provides for up to €35M or 7%. NIS2: regime subject to national transposition.

Beyond penalties, the real issue is citizen trust and continuity of public service.

Compliance roadmap

• 1Map. Inventory citizen-facing processing, decision-making AI, and critical systems.
• 2Securing (NIS2). Deploy measures and a public service continuity plan.
• 3Mastering high-risk AI. Qualify access-to-services AI systems and carry out FRIAs and DPIAs.
• 4Securing GDPR processing activities. Legal bases, information, security, retention periods.
• 5Steer. Involving senior management and appointing a DPO.

How Data Comply One supports the sector

Data Comply One covers GDPR, AI Act, and NIS2 on a single platform, with outsourced DPO and CISO services, and supports public-sector organisations on the FRIA / DPIA articulation and continuity of public service.

DCO offers templates tailored to the public sector (DPIA public-interest mission, FRIA, incident procedures).

Frequently asked questions