Portugal: there are updates in the new Cybersecurity law (NIS2)

Portugal is enacting a new cybersecurity law, Law No. 59/2025, which is a critical step in aligning with the European Union's broader cybersecurity strategy. This law transposes Directive (EU) 2022/2555, aiming to establish a high common level of cybersecurity across the Union and reinforcing digital resilience. This initiative underscores the growing importance of protecting critical infrastructure and digital services in the face of escalating cyber threats. The law, published on October 22, 2025, directly implements the NIS2 Directive. This directive mandates enhanced security requirements for essential and important entities operating within the EU. It broadens the scope of entities covered by cybersecurity regulations, including those in sectors like energy, transport, and digital infrastructure. This new legislation will impact a wide range of organizations, particularly those providing essential services. Companies will need to implement robust cybersecurity measures and report security incidents to the relevant authorities. This will improve the overall security posture of the country and increase digital trust. Portugal's move reflects a broader EU trend towards strengthening digital sovereignty and protecting its digital economy. This is a crucial step for the country to be in line with the EU's digital transformation agenda.