Preliminary draft Act on the security of network and information systems

The purpose of this preliminary draft Act on the security of network and information systems is to transpose into national law Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (hereinafter ‘the Directive’).

In addition, it extends the security and reporting requirements for the incidents specified in the act to services provided in Spain in sectors other than those specified by the Directive and which depend on network and information systems, particularly in the administrative, aerospace, industrial chemical, research facility and food sectors.

It also extends the scope of the above-mentioned requirements to certain service providers that are, in principle, expressly excluded from the scope of the Directive, i.e. network and electronic communication service providers and trusted electronic service providers which have been declared ‘critical operators’ pursuant to Law 8/2011 of 28 April 2011 laying down measures for the protection of critical infrastructure.