DORA backup requirements: what UK firms need to know

Part of our UK cyber compliance guide. See all guides.

DORA, the EU's Digital Operational Resilience Act, sets out detailed rules on backup, restoration and recovery for the financial sector. It is EU law, but in our view it can reach UK firms through EU entities in their own group and through contracts with EU financial entities. This guide sets out what DORA's backup rules say, how they reach UK firms, and how the UK's own rules compare.

What DORA is and who it covers

DORA is Regulation (EU) 2022/2554. ESMA says it entered into force on 16 January 2023 and applies as of 17 January 2025. Its aim is to strengthen the ICT security of financial entities and make sure the financial sector in Europe can stay resilient through a severe operational digital disruption.

Article 2 lists who it applies to. The list includes credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, trading venues, central counterparties, insurance and reinsurance undertakings, fund managers and crowdfunding service providers. These are collectively called financial entities. The same list also includes ICT third-party service providers.

DORA covers ICT risk management, incident reporting, resilience testing, third-party risk and an oversight framework for ICT providers designated as critical. The backup rules sit in the ICT risk management part.

What Article 12 requires on backups

Article 12 is headed backup policies and procedures, restoration and recovery procedures and methods. Its stated purpose is restoring ICT systems and data with minimum downtime, limited disruption and loss. In summary, financial entities must:

Document a backup policy. It must specify the scope of the data that is backed up and the minimum frequency of the backup, based on the criticality of the information or the confidentiality level of the data. They must also document restoration and recovery procedures and methods.

Set up backup systems that can be activated. Activating them must not put at risk the security of network and information systems, or the availability, authenticity, integrity or confidentiality of data.

Test periodically. Article 12 says testing of the backup procedures and the restoration and recovery procedures shall be undertaken periodically.

Restore onto segregated systems. When restoring backup data using their own systems, financial entities must use ICT systems that are physically and logically segregated from the source ICT system, securely protected from unauthorised access or ICT corruption.

Keep redundant capacity. Financial entities other than microenterprises must maintain redundant ICT capacities adequate to business needs. Microenterprises must assess the need for it based on their risk profile.

Set recovery objectives. In setting recovery time and recovery point objectives for each function, firms must take into account whether it is a critical or important function and the potential overall impact on market efficiency. Our guide to RPO, RTO and MTD explains those targets.

Check data integrity after recovery. When recovering from an ICT-related incident, firms must perform the necessary checks, including multiple checks and reconciliations, so that the highest level of data integrity is maintained.

Article 12 adds specific rules for some entity types. Central securities depositories must keep at least one secondary processing site at a geographical distance from the primary site, and central counterparties' recovery plans must allow all transactions at the time of disruption to be recovered.

Testing and business continuity under Article 11

Article 11 covers response and recovery. Financial entities are required to put in place an ICT business continuity policy, ICT response and recovery plans, and a business impact analysis of their exposure to severe business disruptions.

On testing, Article 11 says firms must test the ICT business continuity plans and ICT response and recovery plans at least yearly, and when there are substantive changes to systems supporting critical or important functions. Firms other than microenterprises must include scenarios of cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups and redundant facilities needed to meet Article 12.

Firms must also keep readily accessible records of activities before and during disruption events when these plans are activated. Our guide to how often to test disaster recovery plans covers testing more widely.

How DORA reaches UK firms

DORA is EU law and does not apply to the UK as such. In our view there are three main ways it reaches UK firms.

EU entities in your group. If your group includes an EU-authorised bank, insurer, investment firm or other entity on the Article 2 list, that entity is a financial entity under DORA and has to meet Article 12 and Article 11. Shared group IT and backup arrangements need to support that.

Selling ICT services to EU financial entities. Article 30 sets out key contractual provisions for ICT services. Contracts must state the regions or countries where services are provided and where data is processed, including the storage location. They must cover the availability, authenticity, integrity and confidentiality of data, and ensure access, recovery and return of data in an easily accessible format if the provider becomes insolvent or the contract ends. Article 30 also lists exit strategies, with a mandatory adequate transition period that lets the financial entity move to another provider or in-house. A UK supplier to an EU bank should expect those terms in its contracts.

Third-country providers designated as critical. Article 31 says financial entities may only use an ICT third-party service provider established in a third country that has been designated as critical if it has established a subsidiary in the Union within the 12 months following the designation. This applies only to designated providers, not to UK firms generally.

How the UK rules compare

The UK has its own operational resilience regime rather than a copy of DORA.

The FCA says its operational resilience rules came into force on 31 March 2022, and that firms in scope had until 31 March 2025 to make sure they could operate their important business services within their impact tolerances. On 18 March 2026 it published new incident reporting and third party notification requirements for financial services firms.

The Bank of England, the PRA and the FCA also oversee critical third parties to the UK financial sector, following their designation by HM Treasury. The Bank says this regime complements, and does not replace, the existing requirements for firms under SS1/21 on operational resilience and SS2/21 on outsourcing and third-party risk management. The FCA says it does not change the accountability of firms and their boards.

In our view, a UK firm that also has to meet DORA should map both sets of rules to one set of backup and recovery controls, rather than run two programmes. For the wider UK picture beyond financial services, see our guide to NIS2 and the UK Cyber Security and Resilience Bill.

A backup checklist based on DORA

1. Write the backup policy. For each system, record what data is backed up and how often, and link that to how critical or confidential the data is. Our backup retention policy guide helps with how long to keep copies.
2. Document restores. Write down how each critical system and its data are restored, and by whom.
3. Restore somewhere separate. Make sure restores using your own systems go to systems physically and logically segregated from the source. Our guide to immutable vs air-gapped backups covers keeping copies out of an attacker's reach.
4. Set RTO and RPO per function. Start with critical or important functions.
5. Test at least yearly. Include a cyber-attack scenario and a switchover to backups, and test again after substantive changes.
6. Reconcile after recovery. Plan the checks that confirm restored data is complete and consistent.
7. Check supplier contracts. Confirm data locations, data return on exit and a transition period are written in.

FAQ

What does DORA say about backups?

Article 12 requires financial entities to document backup policies setting the scope of the data backed up and the minimum frequency, based on criticality or confidentiality, plus restoration and recovery procedures. Backup procedures and restores must be tested periodically, and restores using a firm's own systems must use systems physically and logically segregated from the source.

Does DORA apply to UK firms?

DORA is an EU regulation that applies to EU financial entities and ICT third-party service providers. In our view, a UK firm is affected when its group includes an EU financial entity, or when it supplies ICT services to EU financial entities and so has to meet DORA's contract terms.

How often does DORA require backup and recovery testing?

Article 11 requires ICT business continuity plans and ICT response and recovery plans to be tested at least yearly, and after substantive changes to systems supporting critical or important functions. Firms other than microenterprises must include cyber-attack scenarios and switchovers to backups and redundant facilities.

When did DORA start to apply?

ESMA says DORA entered into force on 16 January 2023 and applies as of 17 January 2025.

What is the UK equivalent of DORA?

The UK has its own regime rather than an equivalent law. FCA operational resilience rules required firms in scope to be able to operate important business services within impact tolerances by 31 March 2025, and the Bank, PRA and FCA oversee critical third parties designated by HM Treasury.