Article 3(28) clearly carves out natural persons from the definition of 3rd country subcontractors. This does however not infer that natural persons are not included in the scope of EU subcontractors.

The ITS on the Register of Information clearly indicates that (i) subcontractors may be individuals acting in business capacity (Article 3(6)) and (ii) in Part 2, tables on instructions, line B_05.01.0070). It is clarified that ICT third party service providers may be either legal persons or individuals acting on business capacity.

When we look at Article 29(2) of DORA, we can infer that the relevant subcontractors are anyway ICT third party service providers. Hence, other than in the case of the third-country subcontractors, the ITS on registers has clarified that EU ICT subcontractors may be individuals.