![\"\"](\"https:\/\/adcecija.pt\/wp-content\/uploads\/2025\/09\/Portugal-Passes-NIS2-Transposition-640x360.jpg\"){kind=spacer}
<\/p>\n<\/p>\n
<\/p>\n
The Portuguese Parliament has approved the transposition of the European NIS2 Directive, marking a turning point in national digital security.<\/p>\n
The bill still awaits presidential promulgation and publication in the Official Gazette, after which the new cybersecurity rules will become mandatory.<\/p>\n
What changes in practice:<\/strong><\/p>\n Broader scope<\/strong> Digital service providers<\/strong> Personal liability<\/strong> \u2013 Executives and directors may now be held personally liable for non-compliance \u2014 a clear sign that cybersecurity has moved up to the C-level agenda.<\/p>\n Mandatory CISO role<\/strong> \u2013 Appointment of a Chief Information Security Officer (or equivalent) as the compliance guarantor and responsible for implementing security measures.<\/p>\n Strict incident reporting deadlines<\/strong><\/p>\n 24h: initial alert<\/p>\n<\/li>\n 72h: detailed report<\/p>\n<\/li>\n 30 days: final assessment<\/p>\n<\/li>\n<\/ul>\n Sanctions for non-compliance<\/strong> Coordinated oversight<\/strong> The message is clear:<\/strong> For companies in the covered sectors \u2014 including many tech firms and digital providers \u2014 this is the moment to assess the maturity of your cybersecurity programs.<\/p>\n by Joana Pinto<\/a>\u00a0e Ana Bastos<\/a>, Practice Area – TMT – Technology, Media & Telecommunications<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" The Portuguese Parliament has approved the transposition of the European NIS2 Directive, marking a turning point in national digital security. The bill still awaits presidential promulgation and publication in the Official Gazette, after which the new cybersecurity rules will become mandatory. What changes in practice: Broader scopeThe bill now covers sectors such as energy,…<\/p>\n","protected":false},"author":125,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[153,188],"tags":[],"class_list":["post-18476","post","type-post","status-publish","format-standard","hentry","category-flash-alert-2","category-news-media-en"],"_links":{"self":[{"href":"https:\/\/adcecija.pt\/en\/wp-json\/wp\/v2\/posts\/18476","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adcecija.pt\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adcecija.pt\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adcecija.pt\/en\/wp-json\/wp\/v2\/users\/125"}],"replies":[{"embeddable":true,"href":"https:\/\/adcecija.pt\/en\/wp-json\/wp\/v2\/comments?post=18476"}],"version-history":[{"count":6,"href":"https:\/\/adcecija.pt\/en\/wp-json\/wp\/v2\/posts\/18476\/revisions"}],"predecessor-version":[{"id":18488,"href":"https:\/\/adcecija.pt\/en\/wp-json\/wp\/v2\/posts\/18476\/revisions\/18488"}],"wp:attachment":[{"href":"https:\/\/adcecija.pt\/en\/wp-json\/wp\/v2\/media?parent=18476"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adcecija.pt\/en\/wp-json\/wp\/v2\/categories?post=18476"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adcecija.pt\/en\/wp-json\/wp\/v2\/tags?post=18476"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
The bill now covers sectors such as energy, transport, banking, financial infrastructures, healthcare, water supply, public administration, the space sector, and digital infrastructures.<\/p>\n
Also included are providers of cloud services, data centers, content delivery networks (CDNs), DNS services, online marketplaces, search engines, and social media platforms.<\/p>\n\n
Fines up to \u20ac10M or 2% of global turnover.<\/p>\n
The National Cybersecurity Center (CNCS) leads, with specialized support from the Bank of Portugal, CMVM, ASF, and ANACOM.<\/p>\n
Cybersecurity is no longer a \u201cnice to have\u201d \u2014 it is now a strategic and legal obligation.<\/p>\n