Priority sector
Air, rail, maritime and road transport operators, ports, logistics companies and postal and courier services keep people and goods moving.
Key obligations
Air, rail, water and road transport are sectors of high criticality listed in Annex I of NIS2.
Postal and courier services are among the other critical sectors listed in Annex II of NIS2.
Transport operators may be identified as critical entities under Directive (EU) 2022/2557 and required to strengthen their resilience.
Passenger data, vehicle telematics and driver monitoring require clear legal bases and proportionate retention.
Transport and logistics depend on connected systems, long subcontracting chains and continuous operations. A cyber incident at a port, airport or carrier can stop entire supply chains, while location data, passenger records and telematics raise significant data protection questions. Many operators work across several Member States and must coordinate national rules.
information security: NIS2 risk-management measures, incident response and the security of operational systems;
supply chain: a single method for assessing subcontractors, carriers and ICT providers;
Data Protection Officer: for passenger, customer, driver and employee data;
integrity programmes: whistleblowing channels and anti-corruption controls for procurement and customs.
A free Compliance Assessment clarifies the entity's classification and its priority obligations.
Related domains: Cybersecurity (NIS2) · Third-Party & Supply Chain · Data Protection · Sustainability (CSRD/CSDDD) · Whistleblower Protection
Regulated functions: Information Security Officer · Data Protection Officer · Whistleblowing Officer · All sectors
General information as at October 2026; it does not constitute legal advice.
Request a free assessment designed for transport and logistics operators.