NIS2 and DORA reflect a key shift in the regulatory landscape — privacy officers must broaden their role beyond keeping sensitive data private, and help defend against threats and maintain availability of services.