SpainReal Decreto-ley 12/2018, Incident Notification Obligation
Real Decreto-ley 12/2018 de 7 de septiembre, de seguridad de las redes y sistemas de informacion, arts. 19, 21 y 22, developed by Real Decreto 43/2021, de 26 de enero
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds an operator of essential services and a digital service provider within the scope described on this jurisdiction's companion security-obligations row; a digital service provider's notification duty applies only when it has access to the information needed to assess the incident's impact.
- If you are an operator of essential services, notify the competent authority, through your reference computer security incident response team (CSIRT), of an incident that may have a significant disruptive effect on the provision of your service, making the initial notification without undue delay; if you are a digital service provider, notify the competent authority, through your reference CSIRT, of an incident that has a significant disruptive effect on your service, whether the incident is on your own networks or a third-party provider's.
- For a CRITICO-severity incident under the national notification instruction, notify immediately on becoming aware of it, follow up with an interim notification within 24 to 48 hours of the initial notification, and file a final notification within 20 days of the initial notification; for a MUY ALTO-severity incident, notify immediately on becoming aware of it, follow up within 72 hours of the initial notification, and file a final notification within 40 days of the initial notification; an ALTO-severity incident requires only an immediate initial notification (Real Decreto 43/2021, annex, section 6).
These lines are LexLint's reading of the law's text. Also read by: Departamento de Seguridad Nacional (DSN), Presidencia del Gobierno (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Titulo VII (arts. 35 to 42) creates an administrative infringement and fine regime; a repeated failure to notify an incident with a significant disruptive effect is itself a muy grave infraction under article 36.2.b, but none of its offences is criminal.
Penalty structure
Article 37 tiers the fine to the infraction's classification under article 36, which lists a repeated failure to notify a significantly disruptive incident, and a failure to notify a less severe incident where notification is required, among the muy grave and grave infractions respectively: a muy grave infraction draws a fine of EUR 500,001 to 1,000,000; a grave infraction draws EUR 100,001 to 500,000; a leve infraction draws a warning or a fine of up to EUR 100,000. The highest fine is the top of the muy grave tier.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
The competent authority varies by sector: the Secretaria de Estado de Seguridad (Ministerio del Interior, through the Centro Nacional de Proteccion de Infraestructuras y Ciberseguridad) for an operator of essential services also designated a critical operator under Ley 8/2011, the sectoral authority that regulation determines for any other operator of essential services, the Secretaria de Estado de Digitalizacion e Inteligencia Artificial (Ministerio de Asuntos Economicos y Transformacion Digital) for digital service providers, and the Centro Criptologico Nacional (Ministerio de Defensa) for operators and digital service providers that are not critical operators but fall within the scope of Ley 40/2015; the CCN-CERT and INCIBE-CERT operate as reference CSIRTs that receive notifications.
Settledness
- As of
- Guidance link
- https://www.dsn.gob.es/en/node/24160
- Guidance body
- Departamento de Seguridad Nacional (DSN), Presidencia del Gobierno
- Open questions
- Will Real Decreto 43/2021's severity-tiered notification clock be replaced by NIS2's own fixed 24-hour and 72-hour clock once the Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad is enacted, or will a Spain-specific clock be carried forward under the new Act's implementing regulations?
What this law does
Article 19 requires an operator of essential services to notify the competent authority, through its reference computer security incident response team (CSIRT), of an incident that may have a significant disruptive effect on its service, and requires a digital service provider to notify an incident with a significant disruptive effect on its service, limited to cases where the provider has access to the information needed to assess the incident's impact.
Article 22 sets an initial notification made without undue delay (sin dilacion indebida), followed by interim and final notifications.
Real Decreto 43/2021's own national incident-notification and management instruction (its Anexo) fixes the clock by severity: for a CRITICO-severity incident, the initial notification is immediate, the interim notification is due within 24 to 48 hours and the final notification within 20 days; for a MUY ALTO-severity incident, the interim notification is due within 72 hours and the final notification within 40 days; an ALTO-severity incident requires only an immediate initial notification, and the instruction sets no reporting window for a MEDIO- or BAJO-severity incident.
This is a looser, severity-gated clock than the fixed 24-hour early warning and 72-hour notification Directive (EU) 2022/2555 itself sets, and it remains in force pending the NIS2 transposition described on this jurisdiction's Anteproyecto rows.
When LexLint raises it
When your app profile says your app operates a social platform, runs an essential service, is a bank, is a securities firm or handles health records.
Back to the example · Lint your app
Page updated .