LexLint.ioBeta

Know the law your code answers to.

Law / Spain

Real Decreto-ley 12/2018, Security Obligations for Operators of Essential Services and Digital Service Providers

Real Decreto-ley 12/2018 de 7 de septiembre, de seguridad de las redes y sistemas de informacion, art. 16, developed by Real Decreto 43/2021, de 26 de enero

In force since .

A sector security regimes rule binding public and private bodies.

Obligation class
Security, Governance

What it requires

  • This binds an operator of essential services designated under Ley 8/2011's critical-infrastructure regime and a digital service provider that is an online marketplace, online search engine or cloud computing service established in Spain, with its EU main establishment in Spain, or that has designated a Spain-based EU representative; a digital service provider that is a micro or small enterprise under Commission Recommendation 2003/361/EC is exempt, and so is an electronic-communications or trust-service operator not separately designated a critical operator.
  • Adopt adequate and proportionate technical and organisational measures to manage the risks to the networks and information systems you use to provide the service, and take measures to prevent and minimise the impact of incidents that affect you; as a digital service provider, determine the security measures you apply, taking into account at least the state of the art and the security of your systems and facilities, incident management, business-continuity management, monitoring, auditing and testing, and compliance with relevant international standards.NIST CSF 2.0GV.PO-01
  • If designated an operator of essential services, designate a responsable de la seguridad de la informacion within three months of your designation, notify the competent authority of the appointment, and file a Declaracion de Aplicabilidad of the security measures you apply within six months of designation, reviewing it at least every three years.NIST CSF 2.0GV.RR-02NIST CSF 2.0GV.OC-03

These lines are LexLint's reading of the law's text. Also read by: Departamento de Seguridad Nacional (DSN), Presidencia del Gobierno (guidance, recorded ).

In the frameworks

NIST Privacy Framework
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
  • GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
  • GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.2Compliance monitoring
  • 3.2Monitoring and logging
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Titulo VII (arts. 35 to 42) creates an administrative infringement and fine regime rather than a criminal offence; article 19.6 separately preserves the ordinary duty to report facts that may constitute a crime to the criminal-justice authorities under the Ley de Enjuiciamiento Criminal, independent of this Real Decreto-ley's own notification duty.

Penalty structure

Article 37 tiers the fine to the infraction's classification under article 36: a muy grave infraction (including a failure to remedy a security deficiency that left the operator vulnerable to a significantly disruptive incident) draws a fine of EUR 500,001 to 1,000,000; a grave infraction draws EUR 100,001 to 500,000; a leve infraction draws a warning or a fine of up to EUR 100,000. The highest fine is the top of the muy grave tier.

Rule
Fixed only
As of
Currency
EUR
Fixed cap
1,000,000

Who enforces it

Enforcement body

The competent authority varies by sector: the Secretaria de Estado de Seguridad (Ministerio del Interior, through the Centro Nacional de Proteccion de Infraestructuras y Ciberseguridad) for an operator of essential services also designated a critical operator under Ley 8/2011, the sectoral authority that regulation determines for any other operator of essential services, the Secretaria de Estado de Digitalizacion e Inteligencia Artificial (Ministerio de Asuntos Economicos y Transformacion Digital) for digital service providers, and the Centro Criptologico Nacional (Ministerio de Defensa) for operators and digital service providers that are not critical operators but fall within the scope of Ley 40/2015.

Settledness

As of
Guidance link
https://www.dsn.gob.es/en/node/24160
Guidance body
Departamento de Seguridad Nacional (DSN), Presidencia del Gobierno
Open questions
Will Real Decreto-ley 12/2018 and Real Decreto 43/2021 be repealed outright once the Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad is enacted, or will parts of Real Decreto 43/2021's operational detail (the security-officer designation, the Declaracion de Aplicabilidad, the notification instruction) be carried forward under the new Act's implementing regulations?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 16 requires an operator of essential services (a public or private entity identified under Article 6 that provides a service in one of the strategic sectors defined in the annex to Ley 8/2011) and a digital service provider under this Real Decreto-ley to adopt adequate and proportionate technical and organisational measures to manage the risks to the networks and information systems used in providing the services the Real Decreto-ley covers.

A digital service provider must additionally address, at minimum, the security of its systems and facilities, incident management, business-continuity management, monitoring, auditing and testing, and compliance with international standards. Real Decreto 43/2021 develops this duty: an operator of essential services must designate a responsable de la seguridad de la informacion within three months of its designation as an operator of essential services.

It must also send the competent authority a Declaracion de Aplicabilidad of the security measures it applies within six months of that designation, and review it at least every three years. This transposes the original NIS Directive (Directive (EU) 2016/1148) and remains in force, with no repeal recorded in the consolidated text, pending the NIS2 transposition described on this jurisdiction's Anteproyecto rows.

When LexLint raises it

When your app profile says your app operates a social platform, handles health records, is a bank, is a securities firm or runs an essential service.

Back to the example  ·  Lint your app

Page updated .