Impact map: which listed companies are most at stake in the regulation of data centers

The key “regulatory development” for data centers in Spain is not currently at a classic parliamentary stage, but rather at a government regulatory phase prior to its final approval. The legal basis did pass through the Cortes (a royal decree-law already ratified), and there is also a broader bill on critical entities under parliamentary processing, but the specific piece for data centers is a draft royal decree in public consultation, still pending approval by the Council of Ministers and publication in the BOE.

1. Which specific regulation is at stake

• The Government has prepared a Draft Royal Decree regulating the requirements of energy sustainability, environmental, resilience, and digital sovereignty applicable to data centers, aimed at installations of significant power (generally, ≥1 MW).
• This draft develops a mandate included in Royal Decree-law 7/2026, which is part of the Comprehensive Response Plan to the Middle East Crisis and empowers the Executive to regulate the deployment of data centers linking it to new renewable generation and criteria of resilience and digital sovereignty.
• In parallel, the Congress is processing the Bill on protection and resilience of critical entities (121/000088), which transposes the European Directive on critical entities and includes references to digital infrastructures, but it is not the specific detailed regulation on data centers.

2. Current phase of the regulatory development

According to official notes from MITECO and the Ministry for Digital Transformation, as well as specialized press and social and business organizations monitoring:

• The Council of Ministers has agreed on the urgent processing of the draft royal decree and its submission to public consultation and information, in compliance with the mandate of RDL 7/2026.
• The text has been published for comments; MITECO notes indicate that the public consultation was open until September 4, 2026, and various actors (environmental NGOs, renewable sector, data center companies) have submitted formal observations on the draft.
• Therefore, as of September 29, 2026, the regulatory development is in the final phase of internal processing within the Government, after the closure of the public consultation, but it has not yet been approved or published as a royal decree in the BOE.

From a strictly parliamentary point of view, this royal decree does not have a phase in Congress or Senate, because it is a government regulatory norm. The parliamentary component was the Royal Decree-law 7/2026 itself, already ratified by Congress, and the mentioned bill on critical entities, which remains in Congress with an extended amendment period.

3. Basic content of the draft royal decree

• Very demanding obligations of energy and water efficiency, aligned with the European data center labeling (Delegated Regulation (EU) 2024/1364), requiring the highest standard level when it comes into force.
• Requirement that data centers cover, in practice, at least 80% of their electricity consumption with new renewable generation, with hourly correlation between consumption and production and additionality criteria (each new MW of demand associated with a new MW of renewable installed in the previous 18 months).
• Conditions of digital sovereignty and resilience: operator established in the EU, operational data maintained in community territory, and effective control of access from third countries.
• Obligations of annual reporting of efficiency and sustainability data for data centers of certain power, and possible penalties or loss of rights of access and connection to the electrical grid in case of non-compliance.

4. Next steps until final approval

• Review of comments received during the public consultation by the involved ministries (Ecological Transition, Economy, and Digital Transformation).
• Drafting of the final text of the royal decree, incorporating (or rejecting with reasons) proposals from the sector, environmental NGOs, and autonomous communities.
• Obtaining the mandatory reports (including, if applicable, Council of State and other advisory bodies) and closing the regulatory impact assessment.
• Approval by the Council of Ministers of the royal decree and subsequent publication in the BOE.
• Entry into force with the transitional regime foreseen in the draft itself: for example, adaptation periods of several months for projects already in process and specific conditions for those pending electrical grid access tenders.

In parallel, the Bill on protection and resilience of critical entities will continue its ordinary parliamentary course (amendments, committee report, plenary of Congress, referral to Senate, and possibly return to Congress), but its role regarding data centers is more of a horizontal framework on critical infrastructures than detailed sectoral regulation.

In summary: the specific framework for data centers is currently in the final part of its government regulatory processing, not in a parliamentary phase; the decisive factor for its final approval will be the submission and approval of the royal decree by the Council of Ministers and its official publication.

In Spanish legislation, the central Government (State) holds a clearly predominant role in regulating digital and energy infrastructures, supported by exclusive competencies in the Constitution and developed through various sectoral laws. Autonomous communities and local entities mainly intervene in territorial execution and urban planning, but the “playing field” is set by the State.

1. Constitutional basis for the distribution of competencies

• Digital infrastructures (telecommunications): the basis is article 149.1.21.a of the Constitution, which grants the State exclusive competence over “postal services and telecommunications,” as well as cables and radiocommunication. Law 11/2022, General Telecommunications Law, itself declares it is enacted under this exclusive state competence, addressing comprehensively the telecommunications regime throughout the national territory (BOE).
• Energy infrastructures: article 149.1.25.a reserves to the State the “bases of the mining and energy regime” and 149.1.13.a grants it the bases and coordination of general economic activity planning, which the Constitutional Court has interpreted as including the basic regulation of the energy sector and its infrastructures (Constitution).

2. Government competencies in digital infrastructures

On these bases, Law 11/2022, General Telecommunications Law, configures a framework in which the State and its Government are responsible, in summary (Law 11/2022):

• Regulating the general legal regime of electronic communications networks and services, including:
  • Purpose, scope, rights, and obligations of operators.
  • Conditions to install and operate networks and provide services under free competition, through a notification regime to the CNMC operator registry.
• Ordering and managing the radioelectric public domain, which the regulation considers a state public domain asset. The Government sets numbering, addressing, and spectrum use plans, as well as assignment conditions.
• Establishing public service and general interest obligations (e.g., emergency services, security and defense, road safety, or civil protection linked to telecommunications), as well as the universal service regime.
• Issuing the basic sanctioning regime in telecommunications and exercising, through competent ministries, inspection and control powers.
• Planning and promoting strategic digital infrastructures: the organizational structure of the Ministry for Digital Transformation assigns to the State Secretariat for Telecommunications and Digital Infrastructures the policy to promote the sector, infrastructure deployment, and guarantee connectivity for citizens and companies (Red.es–Notariado agreement).

Regarding network security and cybersecurity, the State also sets the basic framework:

• Royal Decree-law 12/2018, on security of networks and information systems, and its regulatory development (RDL 12/2018; RD 43/2021) establish state competent authorities, security obligations, incident notification, and sanctioning regime for essential operators.
• The National Security Framework (Royal Decree 311/2022) sets minimum information security requirements for the public sector and associated technology providers (RD 311/2022).

3. Government competencies in energy infrastructures

In energy, the core is articulated around Law 24/2013, the Electricity Sector Law, and Law 34/1998, the Hydrocarbons Sector Law, which specify the bases of the electrical and gas systems. The General State Administration is responsible, among others (Law 24/2013; Law 34/1998):

• The general regulation of the electrical system and the basic regulatory framework of the wholesale and retail markets, in coordination with EU regulations and the CNMC.
• Binding planning of the electrical transmission grid, approved by the Government and defining major transmission infrastructures considered of general interest, conditioning investments by Redeia and the system as a whole.
• Authorization of supra-autonomous or strategic energy infrastructures. Article 3.13 of Law 24/2013, cited in recent rulings, attributes to the State the authorization of:
  • Peninsular high-power electricity production installations and their evacuation infrastructures.
  • Primary transport installations and certain interconnections.
• Setting the basic remuneration framework for transmission and distribution networks, as well as criteria for their investment plans, through laws and royal decrees.
• In hydrocarbons, regulating access and use of networks, storage, transport, and distribution, as well as key aspects of supply security and strategic reserves.

4. Role of autonomous communities and local entities

Autonomous communities can develop and execute the basic state regulation in aspects such as:

• Authorization of electrical or gas installations of exclusively autonomous scope.
• Territorial and urban planning that conditions the location of networks and substations, or the deployment of telecommunications infrastructures (licenses, landscape integration, etc.).
• Additional environmental protection rules.

However, they must respect the State’s basic legislation. Constitutional jurisprudence has reiterated that neither in telecommunications nor in energy can state competencies be emptied or the operation of networks fragmented, which are, in fact, single-system infrastructures at the state scale.

5. Summary

In conclusion, the central Government defines the essential regulatory framework of digital infrastructures (telecommunications, spectrum, network cybersecurity) and the bases of the energy regime (electricity, gas, hydrocarbons, planning of transmission networks and major installations). Autonomous communities and local entities act within that framework, with execution and territorial planning competencies, but without the capacity to alter the basic elements that guarantee market unity, network interoperability, supply security, and homogeneous service standards throughout the country.

In the current state legislature (15th Legislature), there is not yet a specific sectoral law on “data centers,” but several relevant regulatory initiatives have been activated. Counting only laws clearly linked to the deployment of data centers and digital infrastructures, one can speak of 1 royal decree-law in force (under processing as a bill) and 1 transversal bill affecting digital infrastructures. Additionally, there is a specific draft royal decree on data centers in public consultation and several non-legislative parliamentary initiatives.

1. Royal Decree-law 7/2026 and its processing as a bill

The key piece is Royal Decree-law 7/2026, of March 20, which approves the Comprehensive Response Plan to the Middle East Crisis and has been ratified and is being processed as Bill 121/000091 in the Congress of Deputies (bill file, bill BOCG, text in BOE).

Although its main object is not digital policy, the text incorporates a specific additional provision on data centers, in which:

• It recognizes the “enormous interest” and the volume of grid access permits already granted to data center projects.
• It declares these infrastructures as strategic for digitalization and data autonomy.
• It empowers the Government to establish energy sustainability criteria for data centers connected to the electrical system, obliging to accompany new consumption with equivalent new renewable generation.

From your question’s point of view, this is currently the only law-level norm approved in the legislature that introduces a direct regulatory mandate on data centers, although it does so as an enabling provision for subsequent regulatory development, not as complete sector regulation.

2. Bill on protection and resilience of critical entities

The second initiative with law rank affecting the perimeter of digital infrastructures is the Bill on protection and resilience of critical entities (121/000088), presented by the Government and under processing in Congress (file).

It does not focus on data centers, but:

• It defines the “digital infrastructure” sector within the catalog of critical sectors.
• It includes as critical entities, among others, cloud computing service providers, public electronic communications networks, and other digital infrastructures linked to data.
• It establishes a framework of physical, organizational, and resilience protection for such entities and infrastructures, with specific coordination between Interior and the Ministry for Digital Transformation and Public Function.

It is, therefore, a framework law on security and resilience that impacts part of the infrastructures supporting data centers and cloud data services, although without sectoral regulation of their territorial implementation or specific energy requirements.

3. Specific regulatory development: draft Royal Decree on data centers

Based on the mandate of Royal Decree-law 7/2026, the Government has submitted for consultation the Draft royal decree regulating the requirements of energy sustainability, environmental, resilience, and digital sovereignty applicable to data centers (Ministry of Digital Transformation note, MITECO note).

Although it is not a law but a regulatory norm under administrative processing, it is the most specific initiative on data centers. Among other aspects, the draft foresees:

• Application thresholds linked to power (reporting from 500 kW and reinforced obligations from 1 MW).
• Requirement that, in certain cases, at least 80% of electricity consumption is backed hour by hour by new renewable generation.
• Strict energy and water efficiency requirements, aligned with the future European data center labeling.
• Digital sovereignty conditions: operation by entities subject to EU law and maintenance of operational data in community territory.

4. Non-legislative parliamentary initiatives on data centers

Besides these norms, the 15th Legislature has registered several initiatives of political impulse or positioning:

• Two Non-Legislative Motions in Congress:
  • One for a sustainable and transparent planning of resource consumption by the data center industry (Plurinational Sumar Parliamentary Group, no. 162/000593).
  • Another related to the promotion of the data center industry in Spain (Popular Parliamentary Group, no. 161/000187).
• A motion in the Senate to promote data centers in Spain, approved in the Upper Chamber (file (15)661/001491).

These initiatives do not create law-level norms but show that the parliamentary debate on the regulation of data centers and their energy and territorial impact is fully open.

5. Numerical balance

If we limit to “laws or similar norms” in the strict sense, in the current legislature the following can be identified:

• 1 royal decree-law already approved and in force, under processing as a bill, with an express mandate to regulate data center sustainability.
• 1 transversal bill on critical entities that includes the digital infrastructure sector and affects the data ecosystem.
• 1 specific draft royal decree on data centers, still in public consultation phase.

There is, to date, no exclusive sectoral law on data centers, but there is a regulatory block under construction combining legal enabling, resilience regulation of critical infrastructures, and a specific regulation in preparation.