Runs an essential service, in Spain

Ley 8/2011, art. 13, y Real Decreto 704/2011, título III, infraestructuras críticas · Read the law's page

• If you are a public or private operator designated as a critical operator because you manage at least one infrastructure classed as critical in a strategic sector, this binds you (Ley 8/2011 Article 13).
• Within six months of being notified of your designation, submit an Operator Security Plan to the CNPIC, with a risk analysis methodology that covers physical and logical threats to your assets, and review it every two years (Real Decreto 704/2011 Articles 22 and 24).
• Within four months of the approval of that plan, draw up and submit a Specific Protection Plan for each of your critical infrastructures, and review it every two years (Real Decreto 704/2011 Articles 25 and 27).
• Designate a Security and Liaison Officer and a Security Delegate for each critical infrastructure, facilitate the authorities' inspections and update the CNPIC's data on your infrastructures each year (Ley 8/2011 Article 13 and Real Decreto 704/2011 Articles 13, 34 and 35).

Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, art. 16, developed by Real Decreto 43/2021, de 26 de enero · Read the law's page

• Adopt adequate and proportionate technical and organisational measures to manage the risks to the networks and information systems you use to provide the service, and take measures to prevent and minimise the impact of incidents that affect you; as a digital service provider, determine the security measures you apply, taking into account at least the state of the art and the security of your systems and facilities, incident management, business-continuity management, monitoring, auditing and testing, and compliance with relevant international standards.
• If designated an operator of essential services, designate a responsable de la seguridad de la informacion within three months of your designation, notify the competent authority of the appointment, and file a Declaracion de Aplicabilidad of the security measures you apply within six months of designation, reviewing it at least every three years.
• This binds an operator of essential services designated under Ley 8/2011's critical-infrastructure regime and a digital service provider that is an online marketplace, online search engine or cloud computing service established in Spain, with its EU main establishment in Spain, or that has designated a Spain-based EU representative; a digital service provider that is a micro or small enterprise under Commission Recommendation 2003/361/EC is exempt, and so is an electronic-communications or trust-service operator not separately designated a critical operator.

Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, arts. 19, 21 y 22, developed by Real Decreto 43/2021, de 26 de enero · Read the law's page

• If you are an operator of essential services, notify the competent authority, through your reference CSIRT, of an incident that may have a significant disruptive effect on the provision of your service, making the initial notification without undue delay; if you are a digital service provider, notify the competent authority, through your reference CSIRT, of an incident that has a significant disruptive effect on your service, whether the incident is on your own networks or a third-party provider's.
• For a CRITICO-severity incident under the national notification instruction, notify immediately on becoming aware of it, follow up with an interim notification within 24 to 48 hours of the initial notification, and file a final notification within 20 days of the initial notification; for a MUY ALTO-severity incident, notify immediately on becoming aware of it, follow up within 72 hours of the initial notification, and file a final notification within 40 days of the initial notification; an ALTO-severity incident requires only an immediate initial notification (Real Decreto 43/2021, annex, section 6).
• This binds an operator of essential services and a digital service provider within the scope described on this jurisdiction's companion security-obligations row; a digital service provider's notification duty applies only when it has access to the information needed to assess the incident's impact.

Ley 11/2023, de 8 de mayo, ampliaciones nacionales: arts. 2.2 g) a i), 3.2 y 15 y disposición adicional tercera · Read the law's page

• If you provide to consumers the website or a mobile application of an electricity, water or gas supply service, the website or a mobile application of a travel agency or tour operator, or a social network, meet the universal accessibility requirements of Sections III and IV of Annex I (Ley 11/2023, Arts. 2(2)(g) to (i) and 3(1)).
• Make your websites within Title I meet at least the intermediate level of the generally recognized web content accessibility criteria, taking standard UNE 139803 or its successor as the reference, without prejudice to the technical criteria of Real Decreto 1112/2018 (additional provision 3).
• Make the built environment that clients of the services use meet the accessibility requirements of Annex III, in accordance with the sectoral legislation in force (Art. 3(2)).
• Train your staff continuously on how to use accessible products and services, including supplying information, advice, advertising and attention to diversity (Art. 15).
• The service requirements and any obligation relating to compliance with them do not apply to a microenterprise, meaning an enterprise that employs fewer than 10 persons and whose annual turnover or annual balance sheet total does not exceed EUR 2 million (Arts. 3(3); Annex VII, point 16).

Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, text approved by the Consejo de Ministros on 14 January 2025 (transposing Directive (EU) 2022/2555) · Read the law's page

• As drafted, the Anteproyecto would require you to carry out an individualised risk assessment and put in place technical, operational and organisational measures, proportionate to the risk, to secure the networks and information systems you use and to prevent or minimise the impact of an incident.
• As drafted, the Anteproyecto would require you to designate a responsable de la seguridad de la informacion (information security officer) as your point of contact and technical coordinator, with accredited personnel in that role where your entity is classified as essential.
• As drafted, it would reach your service where you are classified as an essential or important entity under the Anteproyecto's sector criteria, which track NIS2's own classification of an online marketplace, online search engine and cloud computing service among the digital providers it names; the wider sector classes the Anteproyecto also reaches (energy, transport, banking, health, water, digital infrastructure, public administration and others) are reached too, by declaring that you are an essential or important entity.

Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, text approved by the Consejo de Ministros on 14 January 2025 (transposing Directive (EU) 2022/2555) · Read the law's page

• As drafted, the Anteproyecto would require you to notify the competent authority of a significant incident affecting the provision of your service, whether on your own networks or a third-party provider's.
• As drafted, the Anteproyecto would require you to send an early warning without undue delay, and in any event within 24 hours of becoming aware of a significant incident, to the competent authority through your reference CSIRT, stating, where applicable, whether the incident is suspected to result from an unlawful or malicious act or could have cross-border repercussions (Article 18(6)(a)).
• As drafted, the Anteproyecto would then require you to submit an incident notification to the competent authority, through your reference CSIRT, within 72 hours of becoming aware of the significant incident, updating the early warning with an initial assessment of the incident; a trust service provider whose services the incident affects would have to submit it within 24 hours instead (Article 18(6)(b)).
• As drafted, the Anteproyecto would require you to submit an interim report when your reference CSIRT or the competent authority asks for one, and a final report within one month of submitting the incident notification, or, if the incident is still ongoing, a status report then and a final report within one month of the incident being handled (Article 18(6)(c) to (e)).
• As drafted, the Anteproyecto would require you to communicate to the recipients of your service, as soon as possible, a significant cyberthreat that could affect them and any mitigating measures they can take.
• As drafted, it would reach your service where you are classified as an essential or important entity under the Anteproyecto's sector criteria; the wider sector classes are reached as on this jurisdiction's companion risk-management row.

Ley 10/2025, de 26 de diciembre, por la que se regulan los servicios de atención a la clientela, art. 8 y disposición transitoria única (BOE-A-2025-26698) · Read the law's page

• If you are a company providing water, gas or electricity, passenger transport, postal, electronic communications or financial services in Spain, do not use an answering machine or similar means as the exclusive customer service channel (article 8(1)).
• When your answering machine, conversational bot or similar means handles a customer's query, complaint, claim or incident report by telephone or electronic means, let the customer request personalised attention from the options of your main menu at any time from the start of the interaction (article 8(2)).
• Provide personalised attention through a natural-person operator who answers in real time and identifies themselves at the start of the conversation, as soon as possible, so that on average 95 percent of requests are attended within three minutes (article 8(2)).
• This law is in force from 28 December 2025 but gives companies twelve months from then to adapt their customer service, so these duties bind from 28 December 2026 (disposición transitoria única, point 1).