The Ministry for Digital Transformation and Public Function has launched a public consultation to draft a regulation that enhances the security and resilience of networks and electronic communication services against extraordinary events: from to DANA (depressive and atmospheric phenomena), volcanic eruptions, or health crises. This initiative develops Article 63 of Law 11/2022, General Telecommunications Law (LGT), which already requires operators to ensure service continuity and notify significant incidents.
The initiative follows the national blackout in April, which tested the energy independence of the network: after a few hours, batteries and generators depleted, and parts of the country were left without communication, with serving as last-mile information sources. The Ministry also recalls other recent episodes that strained infrastructure: the COVID-19 pandemic, the La Palma eruption (September 2021), and the DANA that severely affected the Mediterranean in October 2024.
What is intended to be regulated
According to the draft available for consultation, the upcoming regulation could establish:
- Mandatory contingency plans: one general plan per operator and other specific plans per service, with technical and organizational measures to guarantee the integrity of networks and service continuity during catastrophic failures or force majeure scenarios.
- Notification timelines and procedures: clear criteria for reporting security incidents with significant impact, aligned with Art. 63.3 of LGT, and protocols for early warning to the authorities.
- Institutional coordination: formal mechanisms for collaboration and information exchange between the Ministry and other national, European, and international authorities.
Existing obligations (and upcoming enhancements)
Article 63 of LGT mandates operators to manage security risks, maximize the availability of voice and internet access services during disasters, and to ensure uninterrupted access to 112 and the public alert system. The Secretary of State for Telecommunications and Digital Infrastructures (SETELECO) aims to translate these obligations into concrete operational requirements based on lessons learned over recent years.
What these plans could mean in practice
While details will be defined after the consultation, industry experts expect that the plans will include, among other measures:
- Energy backup capacity sized by area and criticality: minimum autonomy at base stations, central offices, and transport nodes, with inventory management and fuel rotation for generators.
- Enhanced backhaul and alternative routes (fiber, radio links, satellite) and traffic prioritization for essential services and emergency calls.
- Regular testing (drills) of switching, generator startup, and total power outage scenarios, including audits and lessons learned.
- Crisis logistics: framework agreements for mobile generators, batteries, spare parts, and field teams; along with access protocols to restricted areas during emergencies.
- Business continuity and cybersecurity: separation of critical domains, red team exercises, 24/7 response, and public communication coordinated with Civil Protection.
Why now
The growing digital dependency — IoT, AI, cloud, and big data — amplifies the risk surface. Recent episodes saw traffic increase even as capacity decreased due to energy shortages or physical infrastructure damage. The government seeks to anticipate and standardize minimum requirements so that, during the next extreme event, phone and internet services remain operational, especially for emergencies and alert reception.
Next steps
The public consultation gathers opinions on:
a) the problems to address; b) the need and timing for the regulation; c) its objectives; and d) regulatory or non-regulatory alternatives. After reviewing contributions, the Ministry will prepare the draft regulation, which will go through the usual approval process.
Frequently Asked Questions
What will change for end users?
Ideally, more resilience: fewer outages and basic services available longer during blackouts or extreme phenomena (calls, 112, alerts). Some of the work will be invisible, but critical.
Will operators face penalties if they do not comply?
The LGT already includes a penal framework. The new regulation is expected to define verifiable standards and notification timelines, facilitating supervision and, if necessary, sanctions.
Is it aligned with European regulations (NIS2/EECC)?
Yes. Spain tends to align resilience and security efforts with European frameworks. The regulation aims for compatibility with NIS2 and the European Electronic Communications Code, avoiding overlaps.
Which services will have priority during a crisis?
By law, emergency communications, public alerts, and essential services. Contingency plans must outline traffic prioritization and continuity mechanisms per service.
Source: bandaancha, Public Consultation, and Article 63 of LGT