EIOPA · DORA 193 - 3207

ICT third-party risk management (DORA)

Name: ICT third-party risk management (DORA): EIOPA Q&A — EU Financial Regulatory Q&A
Creator: European Insurance and Occupational Pensions Authority
License: https://creativecommons.org/licenses/by/4.0/

Regulation: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
Article: 28
Topic: ICT third-party risk management (DORA)
Submitted: 2024-12-13
Answered: 2025-11-20

More Q&As on this regulation →

Question

Can Social Media usage (e.g. for public relations) be considered an ICT-service under DORA?

Background

Strictly going by the DORA criteria, this could arguably be the case. However, it is unlikely that Meta, X,… will adapt their terms and conditions to include the key contractual provisions of DORA Article 30. Therefore, agreeing that social media use constitutes an ICT-service might effectively ban financial entities from using them.

Answer

This question has been rejected because the matter falls within the scope of Q&A 030.

View original on European Insurance and Occupational Pensions Authority ↗

This Q&A is published by European Insurance and Occupational Pensions Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.