Data clauses: navigating DORA and the EBA's third party risk guidelines

The EBA published final guidelines on the sound management of third-party risk regarding non-ICT services last month. Those guidelines complement DORA's ICT-specific framework by providing guidelines for arrangements that fall outside it.

The EBA’s new guidelines impose duties on financial entities in the context of data processing undertaken by a third-party service provider in the context of delivering a non-ICT service. This includes requiring specific data-related clauses to be built into supplier contracts. Those new data clause requirements need to be considered alongside existing similar obligations financial entities face under DORA in respect of dedicated digital or data services procured from third-party providers.

Below, we explain how, on data, the EBA’s new guidelines need to be distinguished from DORA – and set out what action is now needed, from financial entities and third-party suppliers alike, ahead of the new guidelines taking effect in 2028.

The classification question 

When data processing constitutes the service supplied to a financial entity, that entity must treat that service as an ICT service for the purposes of the EU’s Digital Operational Resilience Act (DORA). This is because DORA defines an ICT service in Article 3(21) as a digital or data service provided through ICT systems to one or more internal or external users on an ongoing basis. The definition covers certain hardware services and excludes traditional analogue telephony, but its core requires attention to what is received.  

It is not enough that the provider uses ICT systems, holds information electronically, or processes the financial entity's data repeatedly across the contractual term. The service received by the financial entity must itself be characterised as a digital or data service provided through ICT systems on an ongoing basis. 

This reflects a practical distinction between the subject matter of the service and the tools used to deliver it. Lawyers, auditors, consultants and claims handlers routinely process data through ICT systems. That does not automatically make the financial entity a purchaser of an ICT service.  

A law firm receiving and storing electronic documents while providing legal advice, or an auditor applying data analysis software during a statutory audit, may use data and technology in ways integral to efficient delivery but the output purchased remains a professional or operational service. By contrast, a provider supplying data hosting, database management, automated data transformation or access to an analytics platform is ordinarily supplying a digital or data service. In those cases, data processing is not incidental to the service but is the service itself, or a substantive component of it. 

The EBA, together with the other European supervisory authorities (ESAs), published a ‘Q&A’ on DORA. That document confirms that Article 3(21) is the starting point for classification, and that the statutory definition, rather than an administrative classification code, determines scope. 

Why non-ICT guidelines still need data requirements 

Data risk arises under almost any third-party arrangement regardless of regulatory classification. The new data provisions in the EBA’s new guidelines are intended to address those risks where they arise in contexts not addressed by DORA – i.e. where the data processing is undertaken in the course of the supply of a non-ICT service and does not constitute the ICT service being provided itself.

For non-ICT services supporting critical or important functions, the guidelines require contractual provisions addressing data location, availability, authenticity, integrity and confidentiality, protection of personal and sensitive data, and access to, recovery and return of data following insolvency, discontinuation or termination. These are risk management requirements that do not redefine the service as an ICT service any more than including cybersecurity clauses in a professional services contract changes the nature of what is purchased. 

The point was specifically considered during the EBA’s consultation on its guidelines. A respondent argued that a reference to "data processing" in the draft created uncertainty because data processing is digital and will therefore fall within DORA. The EBA accepted the point and deleted the relevant reference. The remaining data provisions concern the protection and treatment of data within an otherwise non-ICT arrangement rather than identifying data processing as the outsourced service. 

The hybrid problem 

Understanding where the boundary line is between third-party ICT services to be governed by DORA and non-ICT services falling subject to the EBA’s guidelines is most difficult to discern where a provider combines human-led services with a material technology or data component. DORA does not establish a general exclusion for ICT services that form part of a wider non-ICT arrangement, and the classification of the principal service does not automatically determine the classification of every element supplied under the contract.  

A single agreement can contain a non-ICT service subject to the EBA’s guidelines, a separately identifiable ICT service subject to DORA, or an integrated service whose overall substance must be assessed. Financial institutions should not default to applying the predominant purpose of the commercial agreement to every component, since that approach may conceal a material ICT service packaged alongside a larger operational one. 

Where a non-ICT provider relies on its own ICT subcontractors, a further distinction arises. The ESA Q&As confirm that the arrangement does not fall within the DORA register of information merely because the direct provider uses ICT subcontractors. However, if the financial entity concludes through its risk assessment that an ICT subcontractor supplies an ICT service supporting a critical or important function to such an extent that it is effectively equivalent to an ICT service provided directly, DORA applies.  

The EBA guidelines separately require firms to maintain visibility over subcontractors that materially underpin non-ICT services supporting critical or important functions. This will include an ICT dependency which, as a subcontractor to a non-ICT service, would not appear in the DORA register. 

Practical classification 

For hybrid arrangements, the appropriate approach is to assess services at component level rather than by reference to the overall agreement or the supplier's own categorisation. The starting point is to identify the recurring output or capability actually supplied to the financial entity for each component, whether users access the provider's application or platform, whether the provider stores, hosts or transforms data for the financial entity, and whether the financial entity would lose a digital capability if the provider stopped performing.  

Direct user access is strong evidence of an ICT service, though a managed or machine to machine service can also qualify even where the financial entity's employees do not log into the underlying platform.  

The financial entity should assess whether the technology component is part of what is received or merely the means by which the provider produces a non-ICT outcome. Indicators of the latter include provider control over how work is performed, the absence of user access to the system, contractual service levels measuring professional or operational outputs rather than system performance, and the provider's ability to replace its internal technology without materially altering the contracted service. Indicators of the former include continuing access to a system or platform, hosting or availability commitments, defined data storage or computation as a contracted output, and specific data portability or technical exit requirements. 

Where an ICT component is separately described, separately priced or capable of independent termination, it should generally be classified and governed separately rather than absorbed into a single classification for the entire agreement. The contract may then need to satisfy both frameworks in relation to the relevant components, identifying which services are ICT services, which are non-ICT, the functions each supports, and the data, security, audit and exit requirements applying to each. 

Classification should not be treated as a one-off exercise. A non-ICT arrangement can change character if the supplier introduces a new customer-facing platform, automated or AI-based processing, hosted storage or a material ICT subcontractor. Change control and periodic review processes should include a mechanism to trigger reassessment. 

The EBA's final guidelines provide a two-year transitional period for implementation and focus their enhanced requirements on services supporting critical or important functions. That proportionality reflects the EBA's recognition that the frameworks serve different regulatory purposes and that applying both defensively to every arrangement is neither required nor appropriate, provided the classification is grounded in the substance of the service rather than the label attached to the agreement.