ITER/PTPortugal
What the record establishes for Portugal: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Comissão Nacional de Proteção de Dados reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | The competent cybersecurity authority, which article 2 defines as the Centro Nacional de Cibersegurança or, where one applies, the sectoral national authority under article 15(2)(a) binding | Article 41(4) leaves the format and procedure to a technical instruction of the CNCS. The Centre names the instrument: notifications are made on the MyCiber platform, in the entity's reserved area, and the initial notification within twenty-four hours goes there. The platform's own address is not recorded, because every route to the Centre's site was refused: the tool, a browser with an ordinary user agent, and a headless browser. | pt dl 125 2025 |
| Financial supervisorDORA, article 19 | Banco de Portugal reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Comissão do Mercado de Valores Mobiliários (CMVM) reported | — | esma mar nca |
Transposition of NIS2 binding
| Act | Decreto-Lei n.º 125/2025, de 4 de dezembro |
|---|---|
| In force | Article 11 sets it at 120 days after publication. Published 4 December 2025, that falls on 3 April 2026. The date is arithmetic on the act's own wording, not a date the act prints. |
| Recipient | The competent cybersecurity authority, which article 2 defines as the Centro Nacional de Cibersegurança or, where one applies, the sectoral national authority under article 15(2)(a) |
| Moves a term | Yes. Substantial, and in four places. The anchor is not awareness. Article 42(1) starts the twenty-four hours when the entity «concluir que existe, ou possa vir a existir, um incidente significativo» and runs them «até 24 horas após essa verificação», from that determination, and reaching forward to an incident that may yet come to exist. The seventy-two hour stage is conditional and is an update. Article 42(3) owes it «quando necessário», as «uma atualização da notificação inicial», where the Directive's second stage is owed in every case. There is a stage the Directive does not have. Article 43 requires a notification of the end of significant impact, within twenty-four hours of that end. The final report is measured differently and in a different unit. Article 44(1) gives «30 dias úteis a contar da data da notificação do fim de impacto significativo», thirty working days from that new stage, where the Directive gives one month from the incident notification. |
| Standing | Read in the act itself, in the Diário da República, and not in guidance. One consequence worth holding: article 41(2) provides that where the incident is resolved within two hours of detection, only the end-of-impact notification is owed. An organization working from the Directive alone would hold the wrong anchor, the wrong final deadline, and would not know the third stage exists. |
| Source | pt dl 125 2025 |
An event in Portugal
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.