DORA and Data Rooms: Compliance Guide for Financial Entities

TL;DR: If you are an EU financial entity, a virtual data room that holds your confidential material is an ICT service provided by a third party, so DORA can apply to how you assess, contract and exit it. Treat the vendor like any other ICT provider: record the contract in your register of information, secure the Article 30 terms, document data location and subcontractors, and plan your exit before you upload a single file.

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, changed how financial firms in the EU buy technology. It applies from 17 January 2025 and, being a regulation, is directly applicable rather than something each country transposes at its own pace. Banks, insurers, investment firms and most other regulated financial entities fall within it. Teams that run M&A, fundraising, fund formation or regulatory projects tend to think of a data room as a project tool, not as outsourced infrastructure, and that assumption is where compliance gaps begin.

This guide explains how DORA's third-party provisions map onto a VDR procurement. It is written for deal teams, compliance officers and legal counsel, and it is not legal advice. Whether a particular use is in scope, and whether it supports a critical or important function, is a judgement for your own compliance function.

What DORA covers and who it reaches

DORA sets a common framework for digital operational resilience across the EU financial sector. In broad terms it covers five areas: managing ICT risk, reporting major ICT incidents, testing resilience (including threat-led penetration testing for certain entities), sharing threat information and, most relevant here, managing risk from ICT third-party providers. It also creates an oversight regime for providers designated as critical.

Your obligations depend on your category and size, and proportionality principles apply. Even so, the third-party chapter is the part that touches almost any firm that buys software or hosted services, a VDR included.

When a data room counts as an ICT third-party service

A virtual data room stores and processes your documents on infrastructure you do not operate. That fits the ordinary meaning of an ICT service. The harder question is how important it is. A data room used once for a small internal project is very different from a platform that supports a regulated process, such as ongoing investor reporting or a multi-month sale of a business line.

Ask these questions to place a given use:

• What happens to the business if the room is unavailable for a day or a week?
• Does it hold data that would be damaging if disclosed, including personal data of clients or staff?
• Is it part of a process your supervisor would regard as critical or important?
• Will it be reused across many deals under an ongoing contract, or is it a one-off?

Record the answers. The reasoning behind your classification is useful evidence if a supervisor asks.

Your register of information and the VDR

DORA requires financial entities to maintain a register of information covering their contractual arrangements with ICT third-party providers, kept at entity level and, where relevant, at sub-consolidated and consolidated levels (Article 28(3)). The register supports your own monitoring, supervisory review and the designation of critical providers. Firms were due to submit their first registers to the European supervisory authorities in 2025.

For a VDR, make sure the contract appears in the register with the provider, the service description, the functions supported, data location and any subcontractors. A common trap is the one-off deal room bought by a business unit on a credit card. If the provider holds sensitive data and sits outside your central procurement process, the register will be incomplete. Close that gap by adding data rooms to your standard onboarding checklist.

Article 30: contract terms to demand from the vendor

Article 30 lists key contractual provisions for ICT services. Summarised from the published text, the contract should allocate rights and obligations in writing in one document, including service levels, and it should address data location, security, exit and termination. The table translates that into questions for a VDR vendor.

Many standard VDR terms of service do not contain all of this. Expect to negotiate or to use a financial-sector addendum, and start the conversation early, because procurement timelines for a live deal are short.

Data location and change notification

The requirement to name the regions or countries where services are performed and data is processed, and to notify the customer before changing them, is a direct fit for a data room. Ask for a current list covering primary storage, backups, disaster recovery, support access and any document-processing services such as OCR or conversion. If the vendor uses cloud infrastructure from another provider, ask which regions it has chosen and whether you can restrict them.

Our companion piece on VDR data residency explains how to verify location claims rather than accept them at face value.

Exit strategy and getting your data back

For ICT services that support critical or important functions, DORA expects an exit strategy with a mandatory transition period during which the provider keeps delivering the service so you can migrate or bring the work in-house. The published text also expects access to, recovery of and return of data in an easily accessible format if the provider becomes insolvent, stops operating or the contract ends.

Turn that into a plan before onboarding:

1. Confirm what export formats exist for documents, folder structure, permissions, Q&A and audit logs.
2. Test a full export with a sample project and check that it is usable.
3. Agree timelines for deletion and a written confirmation of deletion.
4. Identify the alternative provider or internal process you would use if the vendor failed.

A data room is a good candidate for a lightweight exit plan, because projects have natural endpoints. The discipline is to write the plan down, not to build something elaborate.

Subcontractors and fourth-party risk

Article 30(2) expects the contract to say whether subcontracting of an ICT service supporting a critical or important function is allowed, and on what conditions. VDR vendors almost always rely on cloud hosting, email delivery, support tooling and sometimes AI services. Request the sub-processor list, ask how changes are notified and whether you can object, and check whether any subcontractor sits outside the EU. The same list helps with GDPR processor obligations, so the work does double duty.

Critical ICT providers and what designation does and does not mean

DORA establishes oversight of ICT providers designated as critical, with joint examination teams from the European supervisory authorities. The first designations were announced in late 2025. A vendor's presence on that list may signal scale and scrutiny, but it does not remove your own duties. Equally, a vendor that is not designated is not exempt from your due diligence.

For most VDR providers the practical point is different: ask whether they are subject to any oversight regime, whether they have been assessed by customers in financial services, and whether they will share summaries of that work.

Incident reporting and testing expectations

Under DORA, you must be able to detect, classify and report major ICT-related incidents, and you need to know about provider incidents quickly enough to do so. Write a notification requirement into the contract: how fast the vendor tells you, what information it gives, and who the contact is. For testing, ask what independent security testing the vendor commissions and whether summaries are available. Our guide to VDR penetration testing and security audits lists what a useful summary shows.

A DORA-aware checklist for VDR procurement

Use this as a working list when you select a vendor:

• Classify the use: which function does it support, and how important is it?
• Complete a risk assessment covering data sensitivity, concentration and substitutability.
• Obtain the vendor's current assurance reports and read their scope.
• Negotiate the Article 30 terms and attach them to the contract.
• Record the arrangement in the register of information.
• Obtain the sub-processor list and a notification process for changes.
• Document the exit plan and test an export.
• Set the incident notification process and contacts.
• Schedule a review at renewal or at a material change.

Pair this list with our broader overview of data room compliance in 2026 and the sector guide to the best VDR for financial services.

Where teams slip

The recurring errors are procedural rather than technical:

• Shadow purchasing. A business unit buys a data room outside procurement, so the register and risk assessment never happen.
• Boilerplate contracts. The vendor's standard terms are accepted without the location, exit and subcontracting provisions.
• No exit rehearsal. The first export test happens during a crisis.
• One-time diligence. Assurance reports are read at onboarding and never again.

Frequently Asked Questions

Does DORA apply to every virtual data room?+

DORA applies to financial entities in its scope and to how they use ICT services. A data room is an ICT service when a third party hosts it, so the framework is relevant to your procurement. How heavily the obligations bite depends on your entity type, proportionality and whether the use supports a critical or important function. Your compliance team should make that determination and record it.

Must the data room vendor be located in the EU?+

DORA does not require a provider to be EU-based. It requires that you understand and control the risk, including where data is hosted and processed, who can access it and what happens on exit. Non-EU hosting or support may be acceptable if properly assessed and contracted, and you should consider GDPR transfer rules at the same time.

What should be in the register of information for a VDR?+

Record the provider, the contract and service description, the functions the service supports, data location, subcontractors and the dates of the arrangement. Your supervisor's templates and your own policy determine the exact fields, so work from those and add the VDR like any other ICT provider.

Does a SOC 2 report or ISO 27001 certificate satisfy DORA?+

No. Those are useful evidence of security controls, but DORA also covers contract terms, exit, concentration risk, incident reporting and register maintenance. Treat the report as one input to your assessment and check that its scope covers the product and hosting you will use.

How do I plan an exit from a data room provider?+

Document alternatives, test a full export of documents, permissions, Q&A and audit logs, agree deletion and confirmation timelines, and ensure the contract provides a transition period where the service is critical. Because data rooms are project based, you can often run the plan at the end of each deal.

Who is responsible if my data room vendor has an incident?+

You remain responsible for your own regulatory obligations, including assessing and reporting major incidents. The vendor is responsible for what the contract says. Write notification speed and content into the agreement so you receive what you need in time to act.