Data Centres & Telecommunications in Spain

The electricity blackout on the Iberian Peninsula on 28 April 2025 underlines the importance of assessing wider supply-disruption scenarios: in its June 2025 report, the Spanish investigation committee described an overvoltage incident with multiple contributing factors and found no evidence of a cyberattack as its cause. [1] In March 2026, the CNMC also issued recommendations for other electricity-dependent sectors, including closer coordination between telecommunications and electricity planning. [2]

The operational implications extend beyond installed backup power capacity. Computing capacity remains usable only while cooling, network connectivity and the necessary operating processes also function. During prolonged outages, fuel replenishment, accessible service providers and sufficient staff are therefore as important as the technical reserve.

Investment and operating decisions therefore depend not just on the additional capacity of an individual system, but on its contribution to the availability of the whole site. A reserve whose replenishment fails in the same disruption scenario provides only limited cover.

A powered data centre can fulfil its role only while the necessary connections remain available. Two connections offer limited protection against common causes of failure if they share the same route, handover point or power supply. Continuity therefore also depends on disruption detection, alternative paths and coordinated restoration by the network operators involved.

Article 63 of Spain’s General Telecommunications Law 11/2022 requires operators of public networks and publicly available electronic communications services to implement appropriate technical and organisational security measures and notify significant security incidents to the competent ministry. [3] In a catastrophic network failure or force majeure event, they must also ensure the greatest possible availability of voice communications and internet access, together with uninterrupted access to emergency services and transmission of public warnings. [3]

In June 2026, Spain’s digital ministry announced additional requirements for network resilience and bridging electricity outages; that publication describes a framework still awaiting adoption. [4] Such proposals are a planning signal for investment decisions. Binding design requirements, however, arise from the rules in force, not from an announcement alone.

Owners, colocation operators, cloud providers and telecommunications companies carry different responsibilities. Sharing a site does not remove these distinctions. Safeguards and responsibilities must therefore reflect the service and legal entity concerned.

Spain’s Law 8/2011 ties the specific obligations of critical operators to the designation of their infrastructure; operating a data centre does not, by itself, establish that designation. [5] For designated operators, it requires, among other measures, a “Plan de Seguridad del Operador”, specific protection plans for critical infrastructures and designated security and liaison personnel. [5]

The implementing Royal Decree 704/2011 expressly connects physical and logical security: operator plans must address the corresponding threats, while specific protection plans must also cover the information systems of each critical infrastructure. [6] For operators within scope, this calls for a coherent security organisation: structural and technical safeguards, security responsibilities and crisis procedures must address the same protection duties.

NIS2 covers data centre and cloud services under the applicable scope conditions and requires an all-hazards approach that also addresses the physical environment of information systems; for these services, jurisdiction also depends on the main establishment within the EU. [7] The EUR-Lex register checked on 14 November 2026 lists no notified national transposition measures for Spain; absence of notification must be distinguished from an assessment of the national law actually in force. [8]

Spain’s existing NIS framework, comprising Royal Decree-Law 12/2018 and Royal Decree 43/2021, already regulates security measures and incident management for operators of essential services and certain digital services, including cloud services, within their scope; the relevant conditions and exceptions require assessment in each case. [9] [10] The unresolved transposition status in the register therefore does not mean an absence of obligations. The services offered, the responsible legal entity and the applicable jurisdiction remain decisive.

The directly applicable NIS2 Implementing Regulation (EU) 2024/2690 specifies requirements for providers within its scope, including the security of supporting utilities, physical access control, business continuity, recovery and supplier management. [11] The European Critical Entities Resilience Directive also requires careful interpretation: Article 8 exempts critical entities in digital infrastructure from certain provisions, while allowing more extensive national resilience rules consistent with Union law. [12]

Services for public-sector customers may bring the “Esquema Nacional de Seguridad”, or ENS, into scope: under the conditions specified in Article 2(3) of Royal Decree 311/2022, it also covers systems of private providers delivering services or solutions for the exercise of public administrative functions, and corresponding requirements can extend to the supply chain. [13] The relevant services and systems determine the scope. A single public-sector customer does not create a blanket requirement across every site.

For financial-sector customers, DORA requires specific contractual provisions with ICT service providers, including service and data-processing locations and, for critical or important functions, audit rights and exit arrangements. [14] The ability to provide evidence thus becomes an operational task: contractual commitments must be supported by actual processes, responsibilities and available records.

Energy and environmental requirements also affect operations: Regulation (EU) 2024/1364 requires data centres with installed information technology power demand of at least 500 kW to report indicators to the European database annually. [15] In 2026, Spain also legislated for the development of further sustainability, resilience and digital-sovereignty requirements; the implementing framework documented on MITECO’s specialist page is presented as a draft royal decree. [16] [17] Existing reporting obligations and possible future connection or operating requirements are therefore distinct considerations in site planning. Water, cooling and electricity supply connect resource needs with resilience to outages.

These dependencies point to five operational priorities. In each case, the key consideration is whether a safeguard remains effective when other systems or external services are disrupted at the same time.

• Connect access control with response: Permissions and protected areas restrict access. Responding to unauthorised entry also requires alarm handling, available response personnel and decision-making authority to work together.
• Plan backup operation through to recovery: The period a site can sustain operations depends jointly on power, cooling, replenishment and staffing. The operating plan must also cover a controlled return to normal operation.
• Address common site hazards: Fire compartments, the location of critical equipment and protection against water ingress affect whether several systems can fail together. Access routes need to remain usable by operational staff and emergency responders under the disruption scenarios considered.
• Link remote maintenance to accountability: Access to operational technology and building automation requires traceable permissions and clear responsibility for changes. Accountability at the interface with external service providers must remain clear during disruption.
• Make crisis readiness demonstrable: Escalation paths, alternative communications and recovery planning require named owners and tested procedures. Exercises and documentation make assumptions testable and reveal where action is needed.

Spain’s official SNCZI mapping supports the assessment of potential flooding; the environment ministry expressly notes that not all flood-prone areas have been mapped. [18] The absence of a mapped hazard is therefore not evidence that a site is free from risk. Local conditions, access routes and the positioning of essential utility equipment remain relevant to site decisions.