New Cybersecurity Legal Framework comes into force in Portugal

Decree-Law 125/2025 of 4 December (which transposes the NIS 2 Directive into national law) came into force on 3 April 2026.

The law applies to a number of essential and important organisations, increasing the responsibility of their management bodies and reinforcing security, risk management and incident reporting obligations.

Does this new regime apply to your organisation? What should you implement in order to be compliant?

Find out more about the entry into force of this law and the main obligations you may be subject to here.