Runs an essential service, in Portugal

Decreto-Lei n.º 125/2025, de 4 de dezembro, Artigos 25.º a 29.º · Read the law's page

• Take appropriate technical, operational and organisational measures to manage the risks to the network and information systems you use in your operations, and to prevent or minimise the impact of an incident on the recipients of your services and on other services, at a level proportionate to your risk exposure, your size and the likelihood and severity of an incident.
• Cover at minimum: incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your relationship with your direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and cybersecurity training, including for your top management; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and multi-factor or continuous authentication, secure communications and secure emergency communication systems.
• Have your management, direction and administration body approve these measures, supervise their implementation, ensure compliance with supervision and enforcement obligations, and ensure regular cybersecurity training; know that a member of that body can be held personally liable, by act or omission, on a finding of intent or gross negligence, for an infringement of this Decree-Law, and that this responsibility cannot be delegated away.
• Articles 25 and 26 apply from 3 April 2026; Article 27(1) and (2), Articles 28 to 30 and 33 and the Article 61(1)(b), (c) and (f) fines take effect 24 months after publication of the regulations that Articles 8, 14, 26, 31, 32 and 83 of the Regime call for (Article 10(2) of the Decree-Law), which Regulamento n.º 756/2026, published on 22 June 2026, sets out in one document. This binds an essential or important entity of a type listed in Annex I or Annex II that is a medium enterprise under Annex III or exceeds the EU medium-enterprise thresholds of Commission Recommendation 2003/361/EC, or that Annex I or II names as essential regardless of size; Annex II's digital-services sector names an online marketplace provider, an online search engine provider and a social-networking-services-platform provider expressly, and Annex I's digital-infrastructure sector separately names a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a trust-service provider and a top-level-domain registry, so a service in any of those eight lines is reached; the wider sector classes (energy, transport, banking, health, drinking water, public administration and the rest of the Annexes) are reached too, by declaring that you are an essential or important entity.

Decreto-Lei n.º 125/2025, de 4 de dezembro, Artigos 40.º a 44.º · Read the law's page

• Notify the competent cybersecurity authority of any significant incident, weighing the number and share of users affected, the incident's duration, the severity of the service disruption and its economic and social impact.
• Submit an initial notification without undue delay and within 24 hours of concluding that a significant incident exists or may exist, and, where necessary, update it within 72 hours with an initial assessment of the incident's severity and impact; if the incident resolves within two hours of detection, submit only the end-of-impact notification below.
• Submit a notification that the incident's significant impact has ended, without undue delay and within 24 hours of that impact ending.
• Submit a final report within 30 working days of your end-of-impact notification, describing the incident, its impact, the mitigating measures you took and any residual impact still present, and submit an interim report if the competent authority asks for one; if the incident is still ongoing when the final report falls due, submit that interim report at the authority's request every week until you submit the final report (Article 44(1) and (3)).
• This binds an essential, important or relevant public entity on the same scope as this jurisdiction's companion risk-management row: Annex II's digital-services sector names an online marketplace provider, an online search engine provider and a social-networking-services-platform provider, and Annex I's digital-infrastructure sector separately names a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a trust-service provider and a top-level-domain registry; the wider sector classes are reached as on that row.