Cybersecurity law & regulation in Spain (2026)

Legal framework

Real Decreto-ley 12/2018 (transposing the NIS Directive) and its implementing Real Decreto 43/2021, plus the Esquema Nacional de Seguridad (Real Decreto 311/2022) for the public sector; partial NIS2 transposition via Real Decreto-ley 7/2025. Competent authorities: INCIBE-CERT (private sector), CCN-CERT (public sector/National Cryptologic Centre, CNI), and ESPDEF-CERT (defence). The full NIS2 law (Ley de Coordinación y Gobernanza de la Ciberseguridad) is still in the legislative process.

NIS2 & cybersecurity law in Spain

In Spain, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Spain implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Spain

1. 01In-force comprehensive law (NIS1)

   RDL 12/2018 transposes EU Directive 2016/1148 (NIS) and, with implementing RD 43/2021, regulates the security of networks and information systems of essential-service operators and digital-service providers across sectors, sets the strategic/institutional framework, and grants inspection powers.

   boe.es boe.es

2. 02Public-sector security scheme (ENS)

   RD 311/2022 regulates the Esquema Nacional de Seguridad, mandating security measures and incident-handling capabilities for the public sector and its technology suppliers, with CCN-CERT as central technical coordinator.

   boe.es ens.ccn.cni.es

3. 03Partial NIS2 transposition in force

   Real Decreto-ley 7/2025 partially transposes NIS2; its obligations are enforceable from entry into force while the full transposition law is finalised.

   incibe.es digital-strategy.ec.europa.eu

4. 04Full NIS2 law still pending

   The Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad, approved by the Council of Ministers on 14 January 2025 (creating a National Cybersecurity Centre and management-accountability rules), remains in the parliamentary process and is not yet published in the BOE.

   dsn.gob.es cuatrecasas.com

5. 05Incident-reporting duties

   Essential-service operators and digital-service providers must notify incidents with significant disruptive effects; under the ENS, public-sector entities report to CCN-CERT and private collaborating entities report incident responses to INCIBE-CERT.

   boe.es boe.es

6. 06EU infringement pressure

   Spain missed the 17 October 2024 NIS2 deadline; the European Commission sent a reasoned opinion on 7 May 2025 (alongside 18 other Member States), a step toward referral to the Court of Justice of the EU with possible financial penalties.

   digital-strategy.ec.europa.eu incibe.es

NIS2 in Spain: FAQ

Timeline of decisions

1. 7 May 2025Enforcement · official
   European Commission sends reasoned opinion to Spain for NIS2 non-transposition

   After opening infringement proceedings in November 2024, the Commission escalated by issuing a reasoned opinion citing Spain's failure to fully transpose NIS2 (Directive EU 2022/2555) by the October 2024 deadline. Spain now risks referral to the Court of Justice of the EU and daily penalty fines.

   European Commission – Digital Strategy

2. 24 Apr 2025Guidance · official
   National Security Council approves procedure for drafting Spain's third National Cybersecurity Strategy

   The National Security Council agreed on 24 April 2025 to begin work on a new National Cybersecurity Strategy, superseding the 2023 edition; the decision was published in the BOE on 23 May 2025 as Orden PJC/522/2025. This signals a continued cycle of strategic renewal as threat landscapes evolve.

   BOE – Boletín Oficial del Estado

3. 14 Jan 2025Law · official
   Council of Ministers approves Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad (NIS2 transposition bill)

   Spain's cabinet approved the draft Law on Cybersecurity Coordination and Governance to transpose NIS2, creating a National Cybersecurity Center under the Presidency as the single competent authority, designating CCN-CERT (public sector), INCIBE-CERT (private sector), and the Joint Cyber Space Command as reference CSIRTs, and imposing proportionate security and incident-reporting obligations on essential and important entities.

   La Moncloa – Spanish Government

4. 9 Nov 2023Guidance · official
   Spain adopts Second National Cybersecurity Strategy and creates Cybersecurity Management and Cooperation Unit

   The National Security Council approved Spain's Second National Cybersecurity Strategy, updating the 2019 edition to address AI-powered threats, hybrid warfare, and supply-chain attacks. Simultaneously, a new Cybersecurity Management and Cooperation Unit was established under the DSN to coordinate cross-sectoral and public-private cyber policy.

   Departamento de Seguridad Nacional (DSN)

5. 5 Mar 2023Incident · official
   RansomHouse ransomware attack paralyses Hospital Clínic de Barcelona

   The RansomHouse group attacked Hospital Clínic de Barcelona, forcing cancellation of 150 surgeries and ~3,000 outpatient appointments, taking laboratory, pharmacy, and emergency systems offline for weeks. Attackers demanded €4.5 million; the Spanish government refused to pay. The incident intensified debate over mandatory cybersecurity standards in healthcare ahead of NIS2 transposition.

   INCIBE-CERT

6. 3 May 2022Law · official
   Royal Decree 311/2022 Modernises National Security Scheme (ENS) for Digital Public Services

   Spain updated its mandatory cybersecurity baseline, the Esquema Nacional de Seguridad, replacing the 2010 decree; it establishes 73 security controls across organisational, operational and protection layers, and is mandatory for all public-sector digital services and private providers serving the state, directly securing the infrastructure of online public services.

   CCN-CNI (Centro Criptológico Nacional)

7. 3 May 2022Law · official
   Real Decreto 311/2022 modernises the Esquema Nacional de Seguridad (ENS)

   This Royal Decree replaced the 2010 ENS, tightening mandatory security requirements for all public-sector information systems and private suppliers providing services to the state. It introduced tailored compliance profiles for local authorities, universities, and cloud environments, and required entities to achieve full conformity within 24 months.

   BOE – Boletín Oficial del Estado

8. 26 Jan 2021Law · official
   Real Decreto 43/2021 fully implements NIS Directive obligations

   This Royal Decree developed the 2018 NIS transposition law (RDL 12/2018) in detail: it specified procedures for designating operators of essential services, mandated appointment of a CISO within each operator, and set precise incident-notification thresholds and timelines for reporting to CSIRTs. It remained the primary operative NIS compliance instrument until NIS2 transposition.

   BOE – Boletín Oficial del Estado

9. 26 Apr 2019Guidance · official
   National Cybersecurity Strategy 2019 published (Order PCI/487/2019)

   Approved by the National Security Council and published via Order PCI/487/2019, this strategy superseded the 2013 edition by addressing ransomware, hybrid threats, and critical infrastructure vulnerabilities. It set objectives for full ENS implementation, critical-infrastructure protection, cybersecurity culture, and support for the domestic cybersecurity industry.

   BOE – Boletín Oficial del Estado

10. 7 Sept 2018Law · official
    Royal Decree-Law 12/2018 transposes EU NIS Directive, Spain's first comprehensive cybersecurity law

    RDL 12/2018 implemented Directive (EU) 2016/1148 (NIS), imposing binding security measures, risk-assessment obligations, and mandatory incident notification to CCN-CERT (public-sector entities) or INCIBE-CERT (private-sector operators) on operators of essential services and digital service providers. It established a supervisory and sanction framework, and was the foundation of Spain's modern cybersecurity legal order.

    BOE – Boletín Oficial del Estado

11. 5 Dec 2013Decision · official
    National Cybersecurity Council established

    Created by agreement of the National Security Council on 5 December 2013 and formally constituted on 24 February 2014, the Consejo Nacional de Ciberseguridad became Spain's apex inter-ministerial cybersecurity body, coordinating policy across public administrations, intelligence agencies, and the private sector, and advising the President on national cyber-risk.

    Departamento de Seguridad Nacional (DSN)

12. 28 Apr 2011Law · official
    Law 8/2011 on Protection of Critical Infrastructures (PIC Law) enacted

    Law 8/2011 and implementing Royal Decree 704/2011 created CNPIC (National Centre for Critical Infrastructure Protection) and required designated operators across 12 strategic sectors (energy, water, transport, ICT, finance, health, etc.) to appoint security officers, prepare specific protection plans, and report cyber-incidents, the first legally binding cybersecurity obligations for critical-sector operators in Spain.

    BOE – Boletín Oficial del Estado

13. 8 Jan 2010Law · official
    Royal Decreto 3/2010 establishes the Esquema Nacional de Seguridad (ENS)

    The original National Security Scheme mandated minimum information-security measures for all Spanish public administrations and e-government services delivered to citizens. It introduced a risk-based security categorisation system (low / medium / high), mandatory audits, and a controls catalogue, establishing the foundational cybersecurity framework for the public sector that remains operative today in updated form.

    BOE – Boletín Oficial del Estado

Sources

1. 1.boe.es/buscar/act.php?id=BOE-A-2018-12257
2. 2.boe.es/diario_boe/txt.php?id=BOE-A-2021-1192
3. 3.boe.es/buscar/act.php?id=BOE-A-2022-7191
4. 4.ens.ccn.cni.es/es/normativa
5. 5.incibe.es/incibe-cert/sectores-estrategicos/FAQNIS2
6. 6.dsn.gob.es/en/node/24160
7. 7.digital-strategy.ec.europa.eu/en/policies/nis-transposition
8. 8.cuatrecasas.com/es/spain/propiedad-intelectual/art/aprobado-anteproyecto-ley-transpon