Cybersecurity - Spain

RDL 12/2018 transposes EU Directive 2016/1148 (NIS) and, with implementing RD 43/2021, regulates the security of networks and information systems of essential-service operators and digital-service providers across sectors, sets the strategic/institutional framework, and grants inspection powers.

RD 311/2022 regulates the Esquema Nacional de Seguridad, mandating security measures and incident-handling capabilities for the public sector and its technology suppliers, with CCN-CERT as central technical coordinator.

Real Decreto-ley 7/2025 partially transposes NIS2; its obligations are enforceable from entry into force while the full transposition law is finalised.

The Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, approved by the Council of Ministers on 14 January 2025 (creating a National Cybersecurity Centre and management-accountability rules), remains in the parliamentary process and is not yet published in the BOE.

Essential-service operators and digital-service providers must notify incidents with significant disruptive effects; under the ENS, public-sector entities report to CCN-CERT and private collaborating entities report incident responses to INCIBE-CERT.

Spain missed the 17 October 2024 NIS2 deadline; the European Commission sent a reasoned opinion on 7 May 2025 (alongside 18 other Member States), a step toward referral to the Court of Justice of the EU with possible financial penalties.