Entry into force of Law No. 13/2026 (Cybersecurity) and Law No. 14/2026 (Cybercrime)

What changes, in numbers

Immediate deadline

29 Set 2026

Already in force

Both laws have been in effect since 29 September 2026, with no transitional period.

Notificação imediata

Serious incidents

Duty to immediately report to the competent authorities, namely the National Cybersecurity Centre, any incident compromising systems or data.

Pessoas colectivas

Corporate criminal liability

Companies may be held criminally liable for offences committed for their benefit, facing heavy fines or suspension of activity.

Executive summary

Law No. 13/2026, which establishes the legal regime for the security of networks and information systems, and Law No. 14/2026, which defines and punishes unlawful conduct carried out through computer systems, came into force on 29 September 2026. Law No. 13/2026 creates institutional mechanisms for prevention, early warning and incident management, and requires operators of critical infrastructure and essential services to adopt strict technical and organisational measures, to notify serious incidents, to carry out periodic vulnerability audits, and holds management directly accountable for any failure to invest in cybersecurity policies. Law No. 14/2026 criminalises illegitimate access, unlawful interception, interference with data and systems — including denial-of-service attacks —, computer fraud and forgery, and invasion of privacy, giving the authorities new powers of investigation and digital evidence collection. For companies, adapting means reviewing contracts with technology and cloud providers, adopting internal usage policies, providing continuous staff training and creating incident response protocols.