DORA update: what the EU act means for data centers

The EU's Digital Operational Resilience Act (DORA), which took effect in January 2025, establishes strict digital resiliency and security requirements for financial entities (FEs). These include banks, insurance companies, investment firms and, for the first time, the data centers and third-party digital service providers they rely on.

EU-based data centers that host financial workloads, including those operated by colocation and cloud providers, can be subject to DORA's requirements. In-house data centers are regulated as part of the FE that owns and operates them. For the first time, regulators will also now directly oversee certain FE’s third-party service providers if they are designated as critical third-party providers (CTPPs).