Guide · Updated 29 October 2026
Incident reporting deadlines in Spain, 2026
GDPR, NIS2, DORA, the EU AI Act and the Cyber Resilience Act each have their own clock. Here is who you report to in Spain, how fast, and what changes once Spain passes its NIS2 law.
Why one incident can mean several reports
Spanish organisations rarely face just one reporting rule. A ransomware attack on a payments company can trigger a GDPR notification to the AEPD because customer data was touched, a DORA report to the Banco de España because a critical service went down, and a report to INCIBE-CERT if the company is also an essential service operator. Each clock starts at a different moment and each authority wants a different form.
The teams that miss deadlines usually know the rules. What they lack is a named person who decides, clocks started on time, and a written record of why they decided what they did.
GDPR: 72 hours to the AEPD
A personal data breach must be reported to the Agencia Española de Protección de Datos within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms (GDPR art. 33). Reports go through the AEPD's electronic office. If you are late, you must explain why. You can report in phases: send what you know, then update.
If the breach is likely to result in a high risk to the people affected, you must also tell them directly and without undue delay (art. 34). And every breach, reported or not, must be recorded internally (art. 33(5)).
NIS2 in Spain: still the old rules for now
Spain had not published its NIS2 law, the Ley de Coordinación y Gobernanza de la Ciberseguridad, by October 2026. The government approved the bill in January 2025, but Parliament was dissolved on 6 October 2026 for the general election on 29 November, so the law is unlikely before 2027.
Until then, Royal Decree-law 12/2018 and Royal Decree 43/2021 apply. Operators of essential services and digital service providers must notify incidents of critical, very high or high impact or danger through the Plataforma Nacional de Notificación y Seguimiento de Ciberincidentes, to their CSIRT of reference: INCIBE-CERT for the private sector and CCN-CERT for the public sector.
| Level (RD 43/2021) | Initial | Intermediate | Final |
|---|---|---|---|
| Critical | Immediate | 24/48 h | 20 days |
| Very high | Immediate | 72 h | 40 days |
| High | Immediate | Not required | Not required |
The initial notification runs from awareness. Intermediate and final notifications run from when the initial one was sent.
When the NIS2 law arrives, expect the EU baseline: a 24-hour early warning, a 72-hour incident notification and a final report one month later, for a much wider group of "essential" and "important" entities. If you operate in other EU countries, check their national laws now: several transposed NIS2 earlier and already apply the 24/72-hour clocks.
DORA: the fastest clock for financial firms
Banks, payment and e-money institutions, investment firms, insurers and most other EU financial entities must report major ICT-related incidents under DORA. In Spain the report goes to the entity's supervisor: Banco de España, CNMV or the Dirección General de Seguros y Fondos de Pensiones.
- Initial notification: within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
- Intermediate report: within 72 hours of the initial notification.
- Final report: within one month of the last intermediate report.
An incident is major if it affects critical services and meets two or more materiality thresholds (clients, reputation, duration, geography, data, economic impact), or involves malicious unauthorised access that may lead to data loss. Incidents with the same root cause that happen twice in six months can count together.
EU AI Act: serious incidents with high-risk AI
Providers of high-risk AI systems must report serious incidents to the market surveillance authority of the country where they happened (art. 73). In Spain that is AESIA, the Spanish AI Supervision Agency, or a sector authority for some systems. AESIA has published guidance on serious incident reporting.
- 15 days from establishing a causal link, as a rule.
- 10 days if a person may have died.
- 2 days for a widespread infringement or serious disruption of critical infrastructure.
The Digital Omnibus on AI, in force since 27 July 2026, moved most high-risk obligations to 2 December 2027 (Annex III systems) and 2 August 2028 (AI in regulated products). Whether art. 73 already applies before those dates is disputed. Deployers have a simpler duty: tell the provider immediately (art. 26).
Cyber Resilience Act: reporting started on 11 September 2026
Manufacturers of hardware and software products sold in the EU must report actively exploited vulnerabilities and severe security incidents through ENISA's Single Reporting Platform, which forwards them to the coordinating CSIRT. The clock is a 24-hour early warning and a 72-hour notification, then a final report 14 days after a fix is available (vulnerabilities) or one month after the notification (incidents). The rest of the CRA applies from 11 December 2027.
A worked example
A Madrid payments company detects ransomware at 09:00 on a Monday. Customer names and IBANs were on an affected server. Its card authorisation service is down. It is regulated by the Banco de España.
| Report | Rule | Deadline |
|---|---|---|
| DORA initial notification (classified as major at 10:30) | 4 h after classification | Monday 14:30 |
| GDPR notification to the AEPD | 72 h from awareness | Thursday 09:00 |
| DORA intermediate report (initial sent at 13:00) | 72 h after the initial | Thursday 13:00 |
| Letters to affected customers | Without undue delay (high risk: IBANs) | As soon as practical |
| DORA final report | 1 month after the last intermediate | About a month later |
Three authorities, three forms, and the first deadline is five and a half hours away. That is why the decision has to be made in the first hour, not after the investigation.
A 5-point checklist
- Name one Reporting Decision Lead and a deputy, reachable 24/7.
- Keep a one-page register of which rules apply to you and how to file with each authority.
- Start every possible clock at awareness. Treat "not sure" as "yes" until ruled out.
- Draft every report from one master fact sheet so the facts match.
- Log every decision, including decisions not to report, with the facts known at the time.
Free download
Incident Reporting Clocks 2026
Every deadline above on one printable page.
Regulatory Incident Reporting Kit · €199
Turn this into a working process
A deadline calculator workbook, a playbook with roles and a 60-minute triage, and fill-in templates for every regime.
Questions
Does NIS2 apply in Spain yet?
Not directly. NIS2 is a directive, so it needs a national law. Spain had not published one by October 2026, so the older RD-ley 12/2018 and RD 43/2021 still govern incident reporting for essential services and digital service providers.
When does the 72-hour GDPR clock start?
When you become aware of the breach: when you have a reasonable degree of certainty that a security incident has compromised personal data. You do not need to know everything before reporting; you can send updates.
Who do I report a cyber incident to in Spain?
Private-sector operators report to INCIBE-CERT and public-sector bodies to CCN-CERT, through the national notification platform. Personal data breaches go separately to the AEPD. Financial entities also report under DORA to their supervisor.
Do I still have to report if the incident turned out to be minor?
Possibly not, but record the decision. GDPR requires you to document every personal data breach, including ones you did not report, and a written rationale protects you if a regulator asks later.