Högskolan i Skövde

This qualitative study explores how healthcare organizations navigate the dual regulatory demands of the General Data Protection Regulation (GDPR) and the NIS 2 Directive, focusing on the practical challenges and strategies for achieving compliance in a highly digitalized and sensitive environment. Through ten semi-structured interviews with professionals from five healthcare institutions in Greece and Germany, including DPOs, CISOs, legal advisors, and managers, this study offers insights into how organizations experience and operationalize these overlapping regulatory frameworks.

Using thematic analysis, six key themes emerged: awareness and understanding of GDPR and NIS 2, implementation practices, challenges and ambiguities, organizational culture and communication, staff engagement, and participants’ further reflections. The findings reveal varying levels of regulatory familiarity, with GDPR more embedded in practice than the newer and more technical NIS 2. Compliance efforts are shaped by organizational size, resources, internal structures, and cultural attitudes. Legal-technical overlaps, resource limitations, and communication gaps present ongoing barriers. How-ever, strong leadership, context-sensitive training, and cross-functional collaboration were identified as key enablers of effective compliance.

The study concludes that an integrated and context-aware approach, balancing legal requirements, technological safeguards, and staff engagement, is vital for healthcare organizations. By highlighting real-world implementation dynamics, this research provides practical insights for regulators, policymakers, and healthcare professionals seeking to reconcile cybersecurity resilience with data protection imperatives in healthcare. Future research should build on these findings by incorporating broader participant groups, exploring more in depth the role of emerging technologies like AI and Internet of Medical Things (IoMT) in regulatory compliance, and conducting longitudinal or cross-national studies to assess how healthcare organizations adapt to the evolving demands of GDPR and NIS 2.