Impact map of data center regulation: this is how the actions of the affected listed companies have evolved

As of today, there is no “data center regulation proposal” from the Government that is in parliamentary processing as such. The central initiative to regulate data centers is being processed as a draft royal decree (regulatory development by the Government), which remains within the Executive branch and has not been sent to the Cortes as a law.

According to official notes from the involved ministries —particularly the Ministry for the Ecological Transition and the Demographic Challenge and the Ministry for Digital Transformation and Public Function— the Government has initiated the processing of a Draft Royal Decree regulating the requirements of energy sustainability, environmental sustainability, resilience, and digital sovereignty applicable to data centers. This regulation:

• Sets requirements for energy and water efficiency and renewable energy consumption for data centers.
• Introduces digital sovereignty requirements (operator established in the EU, operational data hosted in community territory, control of access from third countries).
• Conditions access and connection to the electrical grid on compliance with these requirements.
• Develops a mandate included in Royal Decree-Law 7/2026, responding to the Middle East crisis, which was already ratified by Congress and processed as a bill.

Available information shows that this draft royal decree is being processed:

• Through regulatory, not parliamentary, channels, under the Government’s regulatory authority.
• By urgent procedure, authorized by the Council of Ministers on August 25, 2026.
• In the phase of public hearing and information, initially open since August 27.
• With an extension of the deadline for submissions until September 10, 2026, as announced by the Ministry for Ecological Transition itself and reported by specialized press, including the newspaper Demócrata.

This means that the current “phase” of this regulation is an administrative preliminary phase, of public participation on a draft royal decree. In strictly parliamentary terms, the answer is:

There is not yet a specific parliamentary phase for this data center regulation, because the initiative is structured as a royal decree and remains under processing within the Government. Only if the Executive decided, in the future, to bring a specific data center law (bill) to Parliament or include a detailed regime in a law-ranked norm, would a proper parliamentary process open (consideration, amendments, committee, plenary, Senate, etc.).

There is, in parallel, a broader legislative framework that serves as an umbrella:

• Royal Decree-Law 7/2026, responding to the Middle East crisis, already ratified by Congress and processed as a Bill, includes an additional provision ordering the approval of sustainability criteria for data centers connected to the electrical system.
• That royal decree-law is being processed in Congress as a bill with an open amendment period, but it is a broad economic and energy policy norm; the technical regulation of data centers is being specified in the draft royal decree currently in public hearing.

In summary, the situation can be described as follows:

• The legal basis at law rank (Royal Decree-Law 7/2026 and its conversion into a bill) is indeed in parliamentary processing, with Congress still in the amendment phase.
• The specific data center regulation referred to in the public debate —the future royal decree on sustainability, resilience, and digital sovereignty requirements— has not entered Parliament: it is in the phase of draft subject to public hearing and urgent processing within the Government.

Therefore, if the focus is strictly “the data center regulation proposal presented by the Spanish Government,” today it is in the public hearing and information phase of a draft royal decree, with no parliamentary phase yet open; the parliamentary component is currently concentrated in the bill derived from Royal Decree-Law 7/2026, which acts as an enabling framework.

In Spain, there is no single “data center ministry,” but the specific regulation being designed for these projects is jointly led by several departments. The most relevant regulatory axis is the draft royal decree on energy sustainability, environmental sustainability, resilience, and digital sovereignty requirements applicable to data centers, promoted in 2026 by the Ministries of Ecological Transition and Demographic Challenge (MITECO), Economy, Trade and Business, and especially the Ministry for Digital Transformation and Public Function (MTDFP), which acts as the reference in digital sovereignty and data policy.

Practically, the MTDFP, through the State Secretariat for Digitalization and Artificial Intelligence and the General Directorate of Data, is the ministry that concentrates general policy on data economy, digital infrastructures, and attraction of data centers, while MITECO is responsible for integrating these projects into energy and climate planning.

1. Competencies of the Ministry for Digital Transformation and Public Function

According to official notes and recent regulations, the main functions of Digital Transformation regarding data centers and data spaces are:

• Define the digital regulatory framework for data centers, in coordination with Economy and MITECO. In parliamentary appearances, the Minister of Digital Transformation has announced a regulatory framework for sustainable deployment of data centers in Spain and has presented the commitment to “sustainable, efficient, and sovereign” centers.
• Guarantee resilience and digital sovereignty. In the draft royal decree on data centers, this ministry is responsible for verifying compliance with digital sovereignty requirements (that operation and control of data associated with the center fall under entities subject to EU law, that data and metadata remain in community territory, and that access from third countries is controlled). The regulation foresees that non-compliance may even lead to loss of rights to access and connect to the electrical grid.
• Promote the data economy and data spaces. The Action Plan for the Deployment of Data Spaces shapes the development framework of the data economy in Spain, under the responsibility of the MTDFP. The General Directorate of Data is the competent body for promoting and fostering data spaces, as established by Order TDF/758/2025 (program “Data Spaces Kit”).
• Management of specific instruments such as:
  • The Trusted List of Data Spaces, an official and voluntary registry identifying trusted data spaces that meet technical and security criteria defined by ministerial order (MTDFP note).
  • Aid programs linked to the Recovery Plan and the National Artificial Intelligence Strategy, supporting cloud and data infrastructures in Spain.
• Strategic planning and investment attraction. From the “Plan for Connectivity and Digital Infrastructures” and the axis “Spain Data Hub,” Digital Transformation leads public policy to attract investments in data processing centers and consolidate Spain as a digital node in Europe.

2. Role of Ecological Transition and other ministries

Data center regulation also has a critical energy and environmental dimension, so MITECO assumes key functions:

• Design of the energy and water sustainability framework. The draft royal decree establishes that data centers of at least 1 MW must comply with the most demanding levels of the European energy and water efficiency labeling (Delegated Regulation (EU) 2024/1364) and consume, hour by hour, at least 80 % of newly implemented renewable energy.
• Control of impact on the electrical system and water, conditioning grid access on compliance with these requirements. MITECO also receives annual information on energy efficiency and sustainability of centers over 500 kW for publication and monitoring.
• Development of prior legal mandates, particularly those of Royal Decree-Law 7/2026, which links data center deployment to new renewable generation to prevent their growth from raising electricity costs and hindering electrification.

The Ministry of Economy, Trade and Business also participates in the design of the royal decree, given the relevance of data centers for competitiveness, foreign investment, and the development of cloud and AI services.

In summary, data center policy and regulation in Spain is structured interministerially: Digital Transformation leads the part of digital ecosystem, data economy, and digital sovereignty, while Ecological Transition and Economy frame these projects within energy, environmental, and economic planning, jointly developing the regulation that conditions their deployment and operation.

Data centers do not currently have a unique and specific regime in Spain but rely on a mosaic of horizontal regulations. Broadly speaking, a company wishing to install and operate a data center must structure compliance in several blocks: urban planning and licenses, industrial safety, environment and energy, data protection and cybersecurity, and occupational risk prevention. Below is a summary of the main state legal frameworks and the types of obligations they impose.

1. Urban planning, construction, and activity

• Planning and urban license: the building must be compatible with the intended use (industrial, technological tertiary, etc.) according to municipal planning and obtain urban licenses for construction and first occupancy/operation. The design must comply with the Technical Building Code (Royal Decree 314/2006) and its Basic Documents (structural safety, fire safety, healthiness, noise protection, energy saving, etc.).
• Noise: the Law 37/2003, on Noise and its regulatory development (Royal Decree 1513/2005 and Royal Decree 1367/2007) set acoustic quality objectives and emission limits for activities. The project and activity license must justify that the center (generators, fans, etc.) does not exceed levels at the facade and inside adjacent buildings.
• Environmental / activity license: depending on the autonomous community and size/impact, the center may be subject to an environmental license, responsible communication, or environmental assessment regime (Law 21/2013, on environmental assessment) if integrated into larger projects.

2. Industrial safety and installations

• Electrical installations: interior networks and low voltage panels must comply with the Low Voltage Electrotechnical Regulation (Royal Decree 842/2002) and applicable ITCs; transformation centers and part of the high voltage evacuation are governed by the High Voltage Installations Regulation (Royal Decree 337/2014). A technical project, execution by an authorized installation company, periodic inspections, and regional registration are required.
• Fire protection: building design and detection/extinction systems rely on the DB-SI of the CTE and the Fire Protection Installations Regulation (Royal Decree 513/2017), which regulates design, installation, maintenance, and requirements of maintenance companies.
• Fuels and generators: tanks and supply systems for diesel or other fuels are subject to the Petroleum Installations Regulation (Royal Decree 2085/1994) and specific chemical product storage regulations, as applicable.
• Industrial refrigeration and air conditioning: refrigeration and air conditioning installations, key in a data center, must comply with the Safety Regulation for Refrigeration Installations and its ITCs (Royal Decree 552/2019), as well as the fluorinated gases regime (Royal Decree 115/2017), which imposes certification requirements for companies and leakage registers.

3. Environment, energy, and efficiency

• Environmental assessment: Law 21/2013, on environmental assessment regulates when a project must undergo environmental impact assessment (ordinary or simplified). A data center may be affected if it is part of a certain size industrial/energy complex.
• Waste and discharges: the company must comply with waste regulations (currently derived from Law 22/2011 and its successor regulations) and discharge and sanitation connection authorizations set by the autonomous community and municipality.
• Energy and grid connection: Law 24/2013, on the Electric Sector and Royal Decree 1955/2000 regulate connection to distribution/transport grids (high power supply points, direct lines, etc.). The company assumes the technical and economic conditions of access and connection set by the grid manager.
• Climate change and efficiency: Law 7/2021, on climate change and energy transition promotes efficiency and decarbonization measures, which translate into requirements on consumption, air conditioning, and, where applicable, emission trading regimes if certain thresholds are exceeded.

4. Data protection, information security, and cybersecurity

• Personal data protection: if the data center hosts or processes personal data, the controller/processor must comply with the GDPR and Organic Law 3/2018, on Personal Data Protection and Guarantee of Digital Rights: legal basis for processing, processing contracts, risk analyses and, when applicable, impact assessments, appropriate technical and organizational measures, and breach notification to the AEPD and affected parties.
• National Security Framework (ENS): when the data center provides services to public administrations or supports public sector systems, Royal Decree 311/2022 applies, requiring classification by levels, declaration of applicability of security measures, periodic audits, and certifications aligned with the ENS.
• Network and information security (NIS): if the company is an operator of essential services or provider of certain digital services, it falls under Royal Decree-Law 12/2018 and its development by Royal Decree 43/2021: risk management, security officer, formal policies and procedures, and obligation to notify relevant incidents to CSIRTs and competent authorities. The future transposition of NIS2 is expected to strengthen and expand these obligations.

5. Occupational risk prevention

• Safety and health: Law 31/1995, on Occupational Risk Prevention and its development impose specific risk assessment (electrical, work in technical rooms, cold atmospheres, work at height maintenance, etc.), preventive planning, worker training, health surveillance, and coordination of business activities (Royal Decree 171/2004) with maintenance, security, cleaning contractors, etc.

On this state framework, regional regulations and municipal ordinances (urban catalogs, environmental licenses, noise ordinances, fire protection, etc.) are superimposed, so any specific data center project requires detailed analysis in the autonomous community and municipality where it is located.