Cybersecurity Law: responsibilities of Management, Direction and Administration bodies

Portugal is strengthening its cybersecurity framework with a new law that places increased responsibility on management, direction, and administration (GDA) bodies. This development, stemming from the transposition of the NIS 2 Directive through Decree-Law No. 125/2025, marks a significant shift in accountability for digital security. The changes aim to enhance the protection of critical infrastructure and essential services within the country. The new legislation, based on the NIS 2 Directive, legally mandates specific cybersecurity duties for GDA bodies. These bodies are now directly accountable for ensuring their organizations meet stringent security requirements. This includes implementing robust cybersecurity measures, reporting incidents, and conducting regular risk assessments. This law affects organizations providing essential services and those operating critical infrastructure, requiring them to elevate their cybersecurity posture. It also aligns Portugal's digital security standards with broader European Union regulations, contributing to the EU's overall strategy for digital sovereignty and resilience. Future implications will involve increased investment in cybersecurity measures and ongoing training for personnel.