Skip to content
World Watch

Cybersecurity law & regulation in Gibraltar (2026)

Cybersecurity in Gibraltar: comprehensive law.

Gibraltar has an in-force, comprehensive cybersecurity regime. Part 7 of the Civil Contingencies Act 2007 (inserted on 10 May 2018) transposes the EU NIS Directive-style framework into Gibraltar law, imposing security duties and incident-notification obligations on designated Operators of Essential Services (OES) and Digital Service Providers (DSPs), supervised and enforced by the GRA. A parallel sectoral regime — the Financial Services (Operational Resilience) Regulations 2023 with detailed GFSC guidance — imposes cyber and ICT resilience requirements on banks, insurers, e-money and payment firms, and systemic investment firms. As a British Overseas Territory outside the EU, Gibraltar is not bound by NIS2 and continues to operate its NIS1-style Part 7 regime.

Last verified Official sources first · MethodologyCompare Gibraltar with other countries

Legal framework

Civil Contingencies Act 2007 (Part 7) — NIS-style regime; Gibraltar Regulatory Authority (GRA) is the Competent Authority and single point of contact. Sector-specific overlay: Financial Services (Operational Resilience) Regulations 2023 supervised by the Gibraltar Financial Services Commission (GFSC).

Key points: cybersecurity in Gibraltar

  1. Primary law and competent authority

    Part 7 of the Civil Contingencies Act 2007 (in force 10 May 2018) is Gibraltar's dedicated NIS regime; the Gibraltar Regulatory Authority is designated Competent Authority and single point of contact for network and information systems security.

    gra.gi gibraltarlaws.gov.gi gra.gi

  2. Scope — OES and DSPs

    The GRA designates Operators of Essential Services under s.35(2) and regulates Digital Service Providers under s.43 of the Act; security duties and notification duties are set out in ss.41–43.

    gra.gi gra.gi

  3. Incident reporting duties

    OES must notify the GRA of any incident having a significant impact on the continuity of the essential service within 72 hours of becoming aware; DSPs must notify incidents having a substantial impact on the provision of the digital service, via the GRA incident report form. A voluntary reporting channel is also available.

    gra.gi gra.gi

  4. Cyber Assessment Framework (CAF)

    The GRA has adopted a Cyber Assessment Framework (CAF) that sets out outcomes-based principles (governance, risk management, resilience, monitoring, response/recovery) against which OES compliance is measured, with published guidance including CS 01/24 on response and recovery plans.

    gra.gi gra.gi

  5. Financial-sector operational resilience regime

    The Financial Services (Operational Resilience) Regulations 2023, together with GFSC Guidance Notes (2024) on Operational Resilience and Outsourcing/Third-Party Risk Management, impose ICT and cyber risk, business continuity and third-party risk obligations on insurers, banks, e-money issuers, payment service providers, systemic investment firms and large insurance intermediaries.

    gibraltarlaws.gov.gi fsc.gi fsc.gi

  6. Relationship to EU NIS2

    As a British Overseas Territory outside the EU since Brexit, Gibraltar is not required to transpose Directive (EU) 2022/2555 (NIS2); it continues to apply and enforce the NIS1-style Part 7 regime and has not published NIS2-equivalent primary legislation.

    gra.gi digital-strategy.ec.europa.eu

Timeline of decisions

  1. Guidance · official
    GRA issues updated Cyber Assessment Framework (CS01/26)

    The Gibraltar Regulatory Authority published a refreshed Cyber Assessment Framework, developed under section 54 of the Civil Contingencies Act 2007, that it uses to measure whether Operators of Essential Services meet required cyber-security outcomes. It keeps Gibraltar's OES supervision aligned with the evolving UK NCSC CAF model.

    Gibraltar Regulatory Authority

  2. Guidance · official
    GRA guidance on cyber security response and recovery plans

    The GRA's Cyber Security Compliance Division published guidance (CS01/24) on effective response and recovery planning for regulated entities, reinforcing incident-handling and business-continuity expectations for essential-service operators. It operationalises the resilience duties under Part 7 of the Civil Contingencies Act 2007.

    Gibraltar Regulatory Authority

  3. Guidance · official
    Gibraltar advances national cyber strategy and National Cyber Command

    At a cyber-security conference opened by Minister Albert Isola, the government confirmed work via the Gibraltar Contingency Council and a National Cyber Command to build a bespoke national cyber-security strategy modelled on the UK's 'four Ps' (protect, prevent, pursue, prepare). It marked Gibraltar's shift from sector regulation toward a whole-of-territory cyber posture.

    HM Government of Gibraltar

  4. Guidance
    Gibraltar urges heightened cyber defences amid Ukraine tensions

    Following the UK NCSC's lead, Gibraltar urged organisations to bolster defences against the elevated cyber-attack threat surrounding Russia's invasion of Ukraine. It showed the territory's reliance on UK threat intelligence to drive local risk advisories.

    Gibraltar Chronicle

  5. Guidance · official
    GRA publishes NIS general guidance for Operators of Essential Services

    The GRA issued general guidance (CS02/22) setting out the security and incident-reporting obligations for designated Operators of Essential Services under section 41 of the Act. It codified the technical and organisational measures OES must take to protect critical infrastructure.

    Gibraltar Regulatory Authority

  6. Law · official
    NIS Directive transposed; GRA named cyber Competent Authority

    Gibraltar transposed the EU NIS Directive via Part 7 of the Civil Contingencies Act 2007 and designated the GRA as the Competent Authority and single point of contact for the security of network and information systems. This established the legal core of Gibraltar's cybersecurity obligations for essential and digital service providers.

    Gibraltar Regulatory Authority

  7. Law · official
    EU adopts the NIS Directive (2016/1148)

    The EU adopted its first cross-border cybersecurity law, requiring member states to impose security and incident-reporting duties on operators of essential services and digital service providers. As an EU territory at the time, Gibraltar was required to, and did, transpose it, shaping today's framework.

    European Commission

Sources

  1. gra.gi/cyber-security-compliance
  2. gra.gi/cyber-security-compliance/acts-regs
  3. gra.gi/cyber-security-compliance/caf
  4. gra.gi/cyber-security-compliance/incident-report-form
  5. gra.gi/uploads/documents/CyberSecurity/Documents/Guidance/CS01_22.pdf
  6. gra.gi/uploads/documents/CyberSecurity/Documents/Guidance/CS02_22.pdf
  7. gra.gi/uploads/documents/CyberSecurity/Documents/Guidance/CS01_24.pdf
  8. gibraltarlaws.gov.gi/legislations/civil-contingencies-act-2007-2164
  9. gibraltarlaws.gov.gi/uploads/legislations/financial-services/2023s188/2023s188.pdf
  10. fsc.gi/uploads/Guidance%20Notes/GFSC%20Operational%20Resilience%20Guidance%2
  11. fsc.gi/news/gfsc-publishes-guidance-notes-on-operational-resilience-liquidit
  12. gra.gi/index.php/cyber-security-compliance/incident-reporting/voluntary-inci
  13. digital-strategy.ec.europa.eu/en/policies/nis2-directive

Next for Gibraltar: Starting a BusinessEasy

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 18 Sept 2026. Methodology & how to cite · State of Technology Regulation 2026