Veri Sahibi Talepleri (DSP) söz konusu olduğunda, temel yükümlülükler NIS Direktifinin 16. Maddesinde belirtilmiştir:
- **Teknik ve Organizasyonel Önlemler:** DSPs must identify and take appropriate and proportionate technical and organisational measures to manage risks posed to the security of network and information systems which they use in the context of offering their services within the EU and UK.
- **Etki Minimizasyonu:** DSPs must take measures to prevent and minimise the impact of incidents affecting the security of their network and information systems.
- **Raporlama Yükümlülüğü / Temsilcisi:** DSPs must notify the relevant authority or the CSIRT when an incident occurs that has a substantial impact on the provision of their service offered in the EU or UK. In the event that a company does not have an establishment in the EU it will need to appoint a representative who acts on behalf of the company.