Cybersecurity law & regulation in Portugal (2026)

Legal framework

Regime Jurídico da Cibersegurança (Decree-Law no. 125/2025, de 4 de dezembro), transposing EU NIS2 Directive (EU) 2022/2555; supervised by the Centro Nacional de Cibersegurança (CNCS) as national competent authority and single point of contact, with CERT.PT as national CSIRT.

NIS2 & cybersecurity law in Portugal

In Portugal, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Portugal implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Portugal

1. 01Comprehensive NIS2 law in force

   Decree-Law no. 125/2025 establishes the new Regime Jurídico da Cibersegurança transposing Directive (EU) 2022/2555 (NIS2), replacing the earlier 2018 cybersecurity regime. It was preceded by enabling Law no. 59/2025 of 22 October 2025, which authorised the Government to legislate.

   diariodarepublica.pt files.diariodarepublica.pt

2. 02Competent authority and CSIRT

   The Centro Nacional de Cibersegurança (CNCS) is the national cybersecurity authority, supervisor and EU single point of contact, managing the central registry and supervisory audits/inspections; CERT.PT operates as the national CSIRT that receives and handles incident notifications.

   cncs.gov.pt digital.gov.pt

3. 03Staged incident-reporting duties

   Essential and important entities must submit an early notification of a significant incident within 24 hours of becoming aware, an update/notification within 72 hours, and a final report within one month, with affected users informed without undue delay.

   diariodarepublica.pt cncs.gov.pt

4. 04Expanded sectoral scope

   Beyond critical infrastructure already covered, the regime extends to NIS2 sectors including ICT service management, wastewater and waste management, space, manufacturing, postal services, chemicals, food production/distribution, digital service providers, and research.

   digital.gov.pt cncs.gov.pt

5. 05Entry into force and grace period

   The decree-law enters into force 120 days after publication (around 3 April 2026), with a 12-month grace period before fines apply for entities that have adopted internal adaptation procedures.

   diariodarepublica.pt mlgts.pt

6. 06Penalties

   Administrative fines reach up to EUR 10 million or 2% of total worldwide annual turnover for essential entities, and up to EUR 7 million or 1.4% of turnover for important entities, whichever is higher.

   diariodarepublica.pt publico.pt

NIS2 in Portugal: FAQ

Timeline of decisions

1. 4 Dec 2025Law
   Decree-Law 125/2025: NIS 2 Directive transposed into Portuguese law

   Portugal published Decree-Law 125/2025, replacing the NIS 1 regime (Law 46/2018) with a comprehensive new cybersecurity legal framework aligned with Directive (EU) 2022/2555. The CNCS is consolidated as national cybersecurity authority; penalties can reach €10 million or 2% of turnover; law entered into force 120 days after publication (3 April 2026).

   Vieira de Almeida / Diário da República

2. 4 Dec 2025Law · official
   Decreto-Lei 125/2025: NIS2 Directive Formally Transposed into Portuguese Law

   Portugal published its NIS2 implementing decree after missing the October 2024 EU deadline, establishing tiered obligations for 'essential' and 'important' entities across 18 sectors including energy, health, transport, digital infrastructure, and public administration. Fines reach €10 million or 2% of global turnover for essential entities; the law enters into force on 3 April 2026.

   Diário da República

3. 7 May 2025Enforcement · official
   European Commission Issues Reasoned Opinion to Portugal for NIS2 Transposition Failure

   Having missed the 17 October 2024 transposition deadline, Portugal received a formal reasoned opinion, the second step of EU infringement proceedings, for failure to notify national implementing measures for Directive 2022/2555 (NIS2), increasing legal and reputational pressure that accelerated domestic legislation.

   European Commission

4. 1 Sept 2022Incident
   EMGFA Breach: Classified NATO Documents Exfiltrated and Sold on Dark Web

   The General Staff of the Armed Forces (EMGFA) suffered a prolonged cyberattack in which classified NATO documents were exfiltrated via unsecured lines and offered for sale on the dark web; the breach was discovered only after U.S. intelligence alerted the Portuguese government, exposing severe operational-security failures in military communications.

   BleepingComputer

5. 7 Feb 2022Incident
   Vodafone Portugal Suffers Destructive Cyberattack, 4G/5G Network Down Nationwide

   A deliberate attack knocked out Vodafone Portugal's entire network, 4G/5G, fixed voice, TV, SMS, affecting 4.7 million mobile and 1 million fixed-line customers as well as ATM networks, emergency services, and hospitals; services were restored within 48 hours at an estimated direct cost of €5 million, making it the most disruptive telecommunications attack in Portuguese history.

   Vodafone Portugal

6. 9 Aug 2021Law · official
   Decreto-Lei 65/2021: Operational Cybersecurity Obligations for Critical Infrastructure Operators

   This implementing decree operationalised Law 46/2018 by mandating risk analyses, written security plans, permanent security contact points, asset inventories, annual reporting, and structured incident notification to CNCS for operators of essential services; it also implemented the EU Cybersecurity Act (Regulation 2019/881) certification framework with CNCS as National Cybersecurity Certification Authority.

   Diário da República

7. 30 Jul 2021Law
   Decree-Law 65/2021: Cybersecurity certification and NIS operational rules

   Portugal issued Decree-Law 65/2021 to implement the EU Cybersecurity Act (Regulation 2019/881), defining cybersecurity certification obligations and strengthening the NIS Directive operational framework with binding incident-reporting duties and security officer requirements for essential-service operators.

   CMS Expert Guide

8. 5 Jun 2019Guidance · official
   Resolution of the Council of Ministers 92/2019: National Cyberspace Security Strategy 2019-2023 Adopted

   Portugal's second national cybersecurity strategy (ENSC II) set six intervention axes, infrastructure resilience, cybercrime response, innovation, cooperation, resource generation, and awareness, resulting in 1,467 activities across 126 entities; by 2023 Portugal rose from 16th to 8th place in the NCSI global index, demonstrating concrete strategic progress.

   Diário da República

9. 13 Aug 2018Law
   Law 46/2018: Legal framework for cyberspace security (NIS 1 transposition)

   Portugal enacted Law 46/2018 to transpose the first EU NIS Directive (2016/1148), establishing the national legal framework for the security of network and information systems across critical sectors (energy, finance, water, transport, telecoms). It nominated CERT.PT as the national CSIRT and underpinned the CNCS's authority until it was superseded by Decree-Law 125/2025.

   NIS-2-Directive.com / Diário da República

10. 13 Aug 2018Law · official
    Law 46/2018: Legal Framework for Cyberspace Security, NIS Directive (2016/1148) Transposed

    Portugal's foundational cybersecurity statute designated CNCS as National Cybersecurity Authority and CERT.PT as the national CSIRT, imposing mandatory security requirements and incident-reporting obligations on operators of essential services in energy, transport, banking, health, water, and digital infrastructure; this remained the primary cybersecurity law for over six years.

    Diário da República

11. 6 Nov 2017Law · official
    Decreto-Lei 136/2017: CNCS Acquires Current Designation and Expanded Mandate

    This decree reorganised the National Cybersecurity Centre, formally cementing the CNCS name and clarifying its role as operational cybersecurity coordinator for state entities, critical infrastructure operators, and essential service providers, the definitive institutional framework that prefaced the 2018 legislative act.

    Diário da República

12. 1 Jan 2015Guidance · official
    First National Cyberspace Security Strategy (ENSC I) Launched

    Portugal adopted its first standalone national cybersecurity strategy, establishing foundational priorities for protecting critical information infrastructure, developing national cyber capabilities, and promoting international cooperation; this was the first comprehensive policy document coordinating public and private cybersecurity stakeholders across the country.

    ITU / Portuguese Government

13. 9 May 2014Law · official
    Decree-Law 69/2014: National Cybersecurity Centre (CNCS) established

    Portugal created the Centro Nacional de Cibersegurança (CNCS) by Decree-Law 69/2014, within the framework of the National Security Office. The CNCS became the anchor institution for national cybersecurity policy, incident coordination, and international cooperation, and remains the national authority under the NIS 2 regime today.

    CNCS (National Cybersecurity Centre)

14. 9 May 2014Law · official
    Decreto-Lei 69/2014: CNCS Formally Established as National Cybersecurity Centre

    This decree formally constituted the CNCS within the National Cybersecurity Office, absorbing the CERT.PT incident-response function from FCCN and creating Portugal's permanent institutional hub for cybersecurity coordination, threat response, and national-level cyber policy, the cornerstone of Portugal's entire cyber governance structure.

    Diário da República

15. 13 Apr 2012Decision · official
    Resolution of the Council of Ministers 42/2012: Political Mandate to Create a National Cybersecurity Centre

    The Council of Ministers approved a resolution revising Portugal's national information security architecture and establishing an installation commission to create, install, and make operational a dedicated National Cybersecurity Centre, the founding political decision that set in motion the creation of CNCS two years later.

    Diário da República

Sources

1. 1.diariodarepublica.pt/dr/detalhe/decreto-lei/125-2025-962603401
2. 2.files.diariodarepublica.pt/1s/2025/10/20400/0000300006.pdf
3. 3.diariodarepublica.pt/dr/detalhe/lei/59-2025-941547424
4. 4.cncs.gov.pt/pt/diretiva-nis-2/
5. 5.digital.gov.pt/noticias/governo-aprova-regime-juridico-da-ciberseguranca-nacional
6. 6.mlgts.pt/en/knowledge/legal-alerts/Legal-Alert-New-legal-framework-for-cyberse
7. 7.publico.pt/2025/12/04/enter/noticia/portugal-reforca-lei-ciberseguranca-torna-pr