PortugalRegime Jurídico da Cibersegurança, Significant-Incident Reporting Obligations
Decreto-Lei n.º 125/2025, de 4 de dezembro, Artigos 40.º a 44.º
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds an essential, important or relevant public entity on the same scope as this jurisdiction's companion risk-management row: Annex II's digital-services sector names an online marketplace provider, an online search engine provider and a social-networking-services-platform provider, and Annex I's digital-infrastructure sector separately names a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a trust-service provider and a top-level-domain registry; the wider sector classes are reached as on that row.
- Notify the competent cybersecurity authority of any significant incident, weighing the number and share of users affected, the incident's duration, the severity of the service disruption and its economic and social impact.NIST CSF 2.0RS.CO-02
- Submit an initial notification without undue delay and within 24 hours of concluding that a significant incident exists or may exist, and, where necessary, update it within 72 hours with an initial assessment of the incident's severity and impact; if the incident resolves within two hours of detection, submit only the end-of-impact notification below.NIST CSF 2.0RS.CO-02
- Submit a notification that the incident's significant impact has ended, without undue delay and within 24 hours of that impact ending.NIST CSF 2.0RC.CO-03
- Submit a final report within 30 working days of your end-of-impact notification, describing the incident, its impact, the mitigating measures you took and any residual impact still present, and submit an interim report if the competent authority asks for one; if the incident is still ongoing when the final report falls due, submit that interim report at the authority's request every week until you submit the final report (Article 44(1) and (3)).NIST CSF 2.0RS.CO-03
These lines are LexLint's reading of the law's text. Also read by: Centro Nacional de Cibersegurança (CNCS) (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 61 makes non-compliance with the Article 40 to 44 notification duties a contraordenação muito grave (very serious administrative offence) punished by an administrative fine; the Decreto-Lei creates no criminal offence for the infringement.
Penalty structure
Article 61(2)(a) sets the fine for an essential entity's infringement of, among other provisions, Articles 40 to 44, at EUR 2,000 to EUR 10,000,000 or 2 percent of the entity's total worldwide annual turnover in the preceding financial year, whichever is higher, for a legal person (EUR 350 to EUR 200,000 for a natural person). Article 61(2)(b), the mirror provision for an important entity, sets the equivalent range at EUR 1,250 to EUR 7,000,000 or a maximum of not less than 1.4 percent of that turnover, whichever is higher, for a legal person. Both mirror NIS2 Article 34(4) and (5).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The Centro Nacional de Cibersegurança (CNCS), Portugal's national cybersecurity authority, receiving notifications through the electronic platform referenced in Article 8(7), or the sectoral national cybersecurity authority the Decree-Law designates for your sector under Article 15.
Settledness
- As of
- Guidance link
- https://www.cncs.gov.pt/pt/regime-juridico/
- Guidance body
- Centro Nacional de Cibersegurança (CNCS)
- Open questions
- Will the CNCS technical instruction on notification format, procedure and incident taxonomy that Article 41(4) contemplates, together with the European Commission's own implementing acts under NIS2 Article 23(11), narrow or restate the impact thresholds Article 40(3) currently leaves to the entity's own judgement?
What this law does
Article 40 requires an essential, important or relevant public entity to notify the competent cybersecurity authority of any significant incident, weighed against the number of users affected, the incident's duration, the severity of the service disruption and its economic and social impact.
Article 41 sets three notification types per incident: an initial notification, a notification that the significant impact has ended, and a final report, with an entity whose incident resolves within two hours of detection required only to submit the end-of-impact notification. Article 42 requires the initial notification without undue delay and within 24 hours of concluding a significant incident exists or may exist.
Where necessary, Article 42 also requires an update within 72 hours of that determination, providing an initial assessment of the incident's severity and impact. Article 43 requires the end-of-significant-impact notification without undue delay and within 24 hours of the impact ending.
Article 44 requires the final report within 30 working days of the end-of-impact notification, describing the incident, its impact, the mitigating measures taken and the residual impact still present; an entity may also be asked for an interim report. Portugal's 30-day final-report deadline runs in working days from the end-of-impact notification rather than in calendar days from the initial notification.
This Decree-Law transposes NIS2 Directive Article 23 and, by its own Article 9(b), repeals the Regime Jurídico da Segurança do Ciberespaço approved by Lei n.º 46/2018, de 13 de agosto, the predecessor NIS1 transposition.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.
Back to the example · Lint your app
Page updated .