What it asks for. Competent authorities must have all supervisory, investigatory and sanctioning powers needed to fulfil their duties under DORA, and Member States must lay down rules on appropriate administrative penalties and remedial measures for breaches.
In practice. Powers include access to documents and data, on-site inspections, requiring corrective and remedial measures, ordering cessation of conduct, requiring temporary or permanent cessation of practices, requiring existing data traffic records from telecommunications operators where permitted under national law, and public notices identifying the person responsible and the breach. Member States may also decide to apply criminal penalties instead of administrative ones for some breaches. Unlike GDPR or NIS2, DORA leaves the amounts of penalties for financial entities to national law, and penalties can extend to members of the management body. Organisations should check their national implementing rules and treat management accountability as part of governance.
Common gaps. Organisations often look only for headline fine amounts in the regulation and miss national penalty regimes and personal liability for managers.