Covered institutions manage cybersecurity and incidents; vital operators have additional management, continuity and evidence duties.
Essential service institutions and designated operators of vital importance; duties differ by classification.
BCN / ANCI · 2026-10-23المصدر الرسمي ↗Current personal-data framework applies through 30 November 2026. Assess lawful authorization, purpose, confidentiality and data rights.
Public and private personal-data registers/databases subject to statutory exceptions.
BCN · 2026-10-23المصدر الرسمي ↗Enters into force on 1 December 2026. Prepare transition; do not describe the new regime as already operative on the checked date.
Future expanded controller duties and data-protection authority, subject to statutory scope.
BCN · 2026-10-23المصدر الرسمي ↗يُقيَّم نطاق الأنظمة بحسب أنشطة المؤسسة. هذه القائمة ليست رأياً قانونياً ولا إعلاناً عن صلاحية تدقيق رسمية.