OBS Report: Spain and Its Cybersecurity Regulations
The level of cyberattacks it suffers surpasses that of the U.S. and Israel
September 2025. OBS Business School, an institution of Planeta Formación y Universidades, has published the report Cybersecurity from a Regulatory Perspective, led by professor and lawyer specialized in Digital Law Ramón Miralles. This document compares regulations in Spain, the United States, Latin America, and the European Union.
Information security is no longer just a technical issue—it has become a legal asset and a right. This shift requires the adoption of security measures and the promotion of international cooperation, the only way to strengthen the effectiveness of laws against attacks that know no borders.
Legislative processes are similar in rule-of-law states, but differences exist in the degree of implementation depending on legal culture, regulatory capacity, and each country’s level of economic development.
Legal Measures in Cybersecurity
The Global Cybersecurity Index 2024 by the ITU evaluates 194 countries across five pillars: legal, technical, organizational, capacity-building, and cooperation. Most countries stand out in the legal domain: 177 have regulations on data protection, privacy, or security breaches; 151 have specific data protection laws; and 104 regulate critical infrastructures.
The European Union has a mature regulatory framework, with the NIS2 Directive as its cornerstone. This directive mandates risk management, incident reporting, staff training, and executive accountability. It has led to regulations such as DORA, which ensures digital resilience in the financial sector, and MiCA, which regulates crypto-assets by requiring security measures on platforms. Other additions include the Cyber Resilience Act, focused on connected digital products; the Cyber Solidarity Act, which strengthens cooperation in the face of incidents; and the Cybersecurity Act, which enhances ENISA’s role and establishes an ICT certification framework.
The European framework is complemented by the GDPR, rules on digital services and telecommunications, and Directive 2013/40/EU on cybercrime. However, Miralles warns that regulations alone are not enough without effective mechanisms to act against perpetrators in cyberspace.
What About Spain?
Spanish regulations are aligned with the European framework but also include the National Security Law for the protection of critical infrastructures, the National Cybersecurity Strategy (2019, currently under review), and the National Cybersecurity Plan. Currently, the Draft Law on Cybersecurity Coordination and Governance is being processed. It proposes the creation of the National Cybersecurity Center, risk management, mandatory incident reporting, designation of security officers, and oversight by sectoral authorities.
Spain also has the National Security Framework (ENS), which sets the security policy for the use of electronic means in public administration. Key institutions include the National Cryptologic Center, INCIBE, police units for technological investigations, and the Cybercrime Prosecutor’s Office, responsible for coordinating the prosecution of cybercrimes.
In short, Spain has a mature and necessary cybersecurity regulatory and governance framework, given the high number of cyberattacks it receives—surpassing even the United States and Israel.
Content written by:
Carmen García-Trevijano
OBS Business School's Press Office
DOWNLOAD REPORT
