Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union

Article 2 - Processing of personal data
‘1. Processing of personal data pursuant to this Directive shall be carried out in accordance with Directive 95/46/EC.
2. Processing of personal data by Union institutions and bodies pursuant to this Directive shall be carried out in accordance with Regulation (EC) No 45/2001.‘