LexLint.ioBeta

Know the law your code answers to.

Law / Spain

Ley 34/2002 Information Society Services Act, Cooperation with the CERT on Cybersecurity Incidents

Ley 34/2002, disposición adicional novena, servicios de la sociedad de la información

In force since .

A vulnerability and incident reporting rule binding public and private bodies.

Obligation class
Security

What it requires

  • If you provide an information society service from an establishment in Spain, or operate a domain name registry or act as a registrar there, this binds you.
  • Cooperate with the competent CERT in resolving cybersecurity incidents that affect the internet, and act on the security recommendations it indicates or that the codes of conduct establish (Disposición adicional novena, apartado 1).
  • Supply the CERT and the competent authorities with the information needed to manage an incident, including the IP addresses that may be compromised or involved, while respecting the secrecy of communications (apartado 2).
  • Identify the users affected by an incident the CERT notifies to you, tell them what they must do and by when, and, if they do not act within the recommended period, isolate the equipment or service from the network when the CERT requires it (apartado 4).

These lines are LexLint's reading of the law's text.

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

The ninth additional provision requires information society service providers, domain name registries and registrars established in Spain to cooperate with the competent CERT in resolving cybersecurity incidents that affect the internet and to act on the security recommendations it indicates.

Those providers must supply the competent CERT and the competent authorities with the information needed to manage cybersecurity incidents, including the IP addresses that may be compromised or involved, while respecting the secrecy of communications. Under the codes of conduct, providers must identify the users affected by cybersecurity incidents that the CERT notifies to them and tell those users what they must do and by when.

Where users do not act within the recommended period, providers must isolate the equipment or service from the network at the request of the CERT until the malicious activity ends. Ley 9/2014 introduced the ninth additional provision into Ley 34/2002.

When LexLint raises it

When your app profile says your app operates a social platform, operates an app store or provides cloud services.

Back to the example  ·  Lint your app

Page updated .