{"id":535,"date":"2026-10-19T07:30:00","date_gmt":"2026-10-19T07:30:00","guid":{"rendered":"https:\/\/ipglobalguard.com\/?p=535"},"modified":"2026-10-04T11:59:38","modified_gmt":"2026-10-04T11:59:38","slug":"nis2-transposition-domain-registries-spain-ireland","status":"publish","type":"post","link":"https:\/\/ipglobalguard.com\/en\/blog\/nis2-transposition-domain-registries-spain-ireland\/","title":{"rendered":"Two years past the NIS2 deadline: Spain, Ireland and domain data rules"},"content":{"rendered":"<p>On 17 October 2026, the deadline for NIS2 transposition passed its second anniversary, and neither Spain nor Ireland had a transposition law in force at the time of writing. Both were referred to the Court of Justice of the EU on 8 July 2026, with a request for financial sanctions. For brand owners, the gap matters because of NIS2 Article 28: the rule that makes domain registries and registrars keep accurate registration data and answer legitimate access requests within 72 hours still has no national law behind it for providers established in those two countries.<\/p>\n<h2>Key takeaways<\/h2>\n<ul>\n<li>The NIS2 Directive had to be transposed by 17 October 2024 and applied from 18 October 2024 (Article 41).<\/li>\n<li>Spain&#8217;s draft Law on Cybersecurity Coordination and Governance was approved at first reading on 14 January 2025; in early October 2026 no government bill had reached the Congress of Deputies.<\/li>\n<li>Ireland&#8217;s National Cyber Security Bill remained on the Government&#8217;s priority list for publication; in early October 2026 it did not appear among the bills before the Oireachtas.<\/li>\n<li>The Commission has asked the Court for <strong>a lump sum and daily penalties<\/strong> until full transposition is notified.<\/li>\n<li>Until then, getting registrant data from registries and registrars established in Spain or Ireland depends on their own policies and on the ICANN tools that exist for generic domains.<\/li>\n<\/ul>\n<h2>Where does NIS2 transposition stand in Spain and Ireland?<\/h2>\n<p>Article 41 of the <a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj\" target=\"_blank\" rel=\"noopener\">NIS2 Directive (EU) 2022\/2555<\/a> required Member States to adopt and publish their transposition measures by 17 October 2024. The <a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/news\/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules\" target=\"_blank\" rel=\"noopener\">European Commission said on 8 July 2026<\/a> that most Member States had complied, but that Ireland, Spain, France and the Netherlands had yet to notify full transposition.<\/p>\n<table>\n<thead>\n<tr>\n<th>Step<\/th>\n<th>Spain<\/th>\n<th>Ireland<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Draft text<\/td>\n<td>Draft Law on Cybersecurity Coordination and Governance, approved at first reading by the Council of Ministers on 14 January 2025 (<a href=\"https:\/\/www.lamoncloa.gob.es\/consejodeministros\/ruedas\/Paginas\/2025\/20250114-rpcm.aspx\" target=\"_blank\" rel=\"noopener\">La Moncloa<\/a>)<\/td>\n<td>General scheme of the National Cyber Security Bill published in 2024 (<a href=\"https:\/\/www.lawsociety.ie\/gazette\/top-stories\/2026\/july\/ireland-referred-to-cjeu-over-cyber-bill\/\" target=\"_blank\" rel=\"noopener\">Law Society Gazette<\/a>)<\/td>\n<\/tr>\n<tr>\n<td>Notification to the Commission<\/td>\n<td>Notified as a draft technical regulation on 21 February 2025; standstill ended on 26 May 2025 (<a href=\"https:\/\/technical-regulation-information-system.ec.europa.eu\/es\/notification\/26686\/print\" target=\"_blank\" rel=\"noopener\">TRIS 2025\/0104\/ES<\/a>)<\/td>\n<td>No bill text published yet<\/td>\n<\/tr>\n<tr>\n<td>Commission procedure<\/td>\n<td>Letter of formal notice on 28 November 2024, reasoned opinion on 7 May 2025, referral to the Court on 8 July 2026<\/td>\n<td>Same dates<\/td>\n<\/tr>\n<tr>\n<td>Status in early October 2026<\/td>\n<td>No NIS2 bill among the government bills listed in the <a href=\"https:\/\/www.congreso.es\/es\/opendata\/iniciativas\" target=\"_blank\" rel=\"noopener\">Congress of Deputies open data<\/a><\/td>\n<td>Listed as a priority for publication in the Autumn 2026 legislation programme, according to <a href=\"https:\/\/www.williamfry.com\/knowledge\/government-legislative-priorities-for-autumn-2026\/\" target=\"_blank\" rel=\"noopener\">William Fry (17 September 2026)<\/a>; not among the bills in the <a href=\"https:\/\/www.oireachtas.ie\/en\/bills\/\" target=\"_blank\" rel=\"noopener\">Oireachtas bills database<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>In both countries, the next visible milestone is the formal text reaching parliament. In Spain, that requires a second reading in the Council of Ministers; in Ireland, publication of the bill.<\/p>\n<h2>What happens at the Court of Justice?<\/h2>\n<p>The Commission&#8217;s referral asks the Court to impose financial sanctions, consisting of a lump sum and daily penalties until the Member State notifies complete transposition. The referral does not change the obligations of registries and registrars by itself: the sanctions fall on the State, not on businesses. What it does is increase the pressure to legislate. At the time of writing, the Court had not ruled on either case.<\/p>\n<h2>What does NIS2 transposition change for domain registries?<\/h2>\n<p>Article 28 of the Directive requires Member States to impose the following duties on top-level domain registries and on entities providing domain name registration services, which under Article 2(4) are covered regardless of their size:<\/p>\n<ol>\n<li>Collect and maintain accurate and complete registration data, in line with EU data protection law.<\/li>\n<li>Include at least the domain name, registration date, the registrant&#8217;s name, contact email and telephone, and those of any separate point of contact.<\/li>\n<li>Have public policies and procedures, including verification procedures.<\/li>\n<li>Publish the registration data that are not personal data without undue delay after registration.<\/li>\n<li>Grant access to specific data on lawful and duly justified requests from legitimate access seekers, and reply without undue delay and in any event within 72 hours.<\/li>\n<\/ol>\n<p>Under Article 26, registries and registration service providers fall under the jurisdiction of the Member State where they have their main establishment in the EU. A brand owner chasing a cybersquatter therefore needs to know where the registrar is established, not where the domain is used.<\/p>\n<h2>What can a rights holder obtain from .es, .ie and generic domains today?<\/h2>\n<ul>\n<li>.ie: under the <a href=\"https:\/\/weare.ie\/whois-services-policy-2023\" target=\"_blank\" rel=\"noopener\">.ie WHOIS Services Policy<\/a>, valid since 16 November 2020, the registrant name is published when the holder is a legal person (an incorporated entity or registered charity on the island of Ireland), but not for individuals unless they consent. The sponsoring registrar&#8217;s abuse contact is always shown.<\/li>\n<li>.es: Red.es requires accurate data and lists <a href=\"https:\/\/www.dominios.es\/es\/sobre-dominios\/faqs\" target=\"_blank\" rel=\"noopener\">false or incorrect registration data<\/a> as a ground for cancellation, but the 72-hour access duty in Article 28 will only bind registrars established in Spain once the law is in force.<\/li>\n<li>Generic domains: ICANN&#8217;s <a href=\"https:\/\/www.icann.org\/rdrs-en\" target=\"_blank\" rel=\"noopener\">Registration Data Request Service (RDRS)<\/a> lets intellectual property professionals and others request non-public registration data. The ICANN Board decided to keep it running for up to two more years after the pilot ended in November 2025. It does not cover ccTLDs.<\/li>\n<\/ul>\n<p>None of these routes depends on knowing the registrant before acting. Under paragraph 3(b)(v) of the <a href=\"https:\/\/www.icann.org\/resources\/pages\/udrp-rules-2024-02-21-en\" target=\"_blank\" rel=\"noopener\">UDRP Rules<\/a>, the ICANN procedure for recovering generic domains, a complaint can be filed against an unidentified holder, and the provider then passes on the registrant&#8217;s details obtained from the registrar.<\/p>\n<h2>What this means for your business<\/h2>\n<ul>\n<li>Map where the registrars of infringing domains have their main EU establishment; that determines whether Article 28 already has national force.<\/li>\n<li>Draft every data request as lawful and duly justified: your rights, the domain, the specific data you need and the purpose.<\/li>\n<li>Keep a dated record of each request and response; once transposition is complete, the 72-hour deadline will be a useful lever.<\/li>\n<li>Do not let a pending disclosure stop enforcement: file the UDRP or ccTLD complaint when the evidence is ready.<\/li>\n<li>Check your own domains as well: accurate registrant data protects you from verification problems when the new rules take effect.<\/li>\n<\/ul>\n<p>Our team handling <a href=\"https:\/\/ipglobalguard.com\/en\/services\/domain-names\/\">domain disputes and registrant identification across EU registrars<\/a> can prepare and track these requests. Within the same group, META Channel advises companies that are themselves in scope of NIS2 on their compliance obligations.<\/p>\n<h2>Where companies get this wrong<\/h2>\n<ul>\n<li><strong>Assuming NIS2 already applies everywhere.<\/strong> A request to a registrar established in Spain or Ireland cannot yet rely on a national 72-hour duty.<\/li>\n<li>Sending vague requests. A request that does not explain the legal basis and purpose is easy to refuse, whatever the law says.<\/li>\n<li>Looking at the wrong country. The registrar&#8217;s main establishment decides the applicable law, not the extension or the language of the website.<\/li>\n<li>Waiting for disclosure before acting. Cybersquatters move names, and under the UDRP Rules the registrar only locks the domain once a complaint has been filed.<\/li>\n<li>Ignoring the follow-up. Data obtained may point to other domains held by the same registrant; our <a href=\"https:\/\/ipglobalguard.com\/en\/services\/legal-ip\/\">IP enforcement team<\/a> can coordinate the next steps, including court action where needed.<\/li>\n<\/ul>\n<h2>Frequently asked questions<\/h2>\n<h3>Has Spain transposed NIS2?<\/h3>\n<p>Not at the time of writing. The Council of Ministers approved the draft Law on Cybersecurity Coordination and Governance at first reading on 14 January 2025, and it was notified to the Commission in February 2025. In early October 2026 no NIS2 bill appeared among the government bills in the Congress of Deputies, and Spain had been referred to the Court of Justice.<\/p>\n<h3>Has Ireland transposed NIS2?<\/h3>\n<p>Not at the time of writing. The general scheme of the National Cyber Security Bill was published in 2024 and the bill remained a priority for publication in the Autumn 2026 programme. In early October 2026 it was not among the bills before the Oireachtas, and Ireland had been referred to the Court of Justice in July 2026.<\/p>\n<h3>Can a trade mark owner obtain registrant data from a registrar in Spain or Ireland?<\/h3>\n<p>It can ask, and many registrars have disclosure procedures, but until NIS2 is transposed there is no national rule requiring an answer within 72 hours. For generic domains, the ICANN RDRS offers a standard request channel. A UDRP complaint can also be filed without knowing the holder; the provider obtains the data from the registrar.<\/p>\n<h3>Can IP Global Guard handle registrant data requests and domain disputes for us?<\/h3>\n<p>Yes. We prepare lawful, justified requests to registries and registrars, track responses, and file UDRP or ccTLD complaints when the evidence supports them. For registrars and courts outside our direct reach, we coordinate qualified local correspondents across Europe, Latin America and Africa from a single point of contact.<\/p>\n<h2>How IP Global Guard can help while transposition is pending<\/h2>\n<p>The delay in Spain and Ireland does not stop brand owners from acting; it changes how requests have to be drafted and which tools carry weight. IP Global Guard, the IP services line of META Channel Corporation Limited, combines domain enforcement with the group&#8217;s NIS2 regulatory practice, across more than 25 jurisdictions in Europe, Latin America and Africa; see our <a href=\"https:\/\/ipglobalguard.com\/en\/coverage\/\">coverage<\/a>.<\/p>\n<p>Send us the domains you are trying to act against and the registrars involved. We will tell you which rules apply, what to request and how to proceed if no answer comes. <a href=\"https:\/\/ipglobalguard.com\/en\/contact\/\">Talk to our domain enforcement team<\/a>.<\/p>\n<p><em>This article is general information, not legal advice, and reflects the status of transposition at the time of writing.<\/em><\/p>\n<h2>Sources<\/h2>\n<ul>\n<li><a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj\" target=\"_blank\" rel=\"noopener\">EUR-Lex, Directive (EU) 2022\/2555 (NIS2), Articles 2, 26, 28 and 41 (14 December 2022)<\/a><\/li>\n<li><a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/news\/commission-refers-ireland-spain-france-and-netherlands-court-justice-failing-transpose-rules\" target=\"_blank\" rel=\"noopener\">European Commission, Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice (8 July 2026)<\/a><\/li>\n<li><a href=\"https:\/\/www.lawsociety.ie\/gazette\/top-stories\/2026\/july\/ireland-referred-to-cjeu-over-cyber-bill\/\" target=\"_blank\" rel=\"noopener\">Law Society Gazette Ireland, Ireland referred to CJEU over cyber bill (8 July 2026)<\/a><\/li>\n<li><a href=\"https:\/\/www.lamoncloa.gob.es\/consejodeministros\/ruedas\/Paginas\/2025\/20250114-rpcm.aspx\" target=\"_blank\" rel=\"noopener\">La Moncloa, Council of Ministers press conference (14 January 2025)<\/a><\/li>\n<li><a href=\"https:\/\/technical-regulation-information-system.ec.europa.eu\/es\/notification\/26686\/print\" target=\"_blank\" rel=\"noopener\">European Commission, TRIS notification 2025\/0104\/ES (21 February 2025)<\/a><\/li>\n<li><a href=\"https:\/\/www.congreso.es\/es\/opendata\/iniciativas\" target=\"_blank\" rel=\"noopener\">Congress of Deputies, open data on legislative initiatives (consulted 2 October 2026)<\/a><\/li>\n<li><a href=\"https:\/\/www.williamfry.com\/knowledge\/government-legislative-priorities-for-autumn-2026\/\" target=\"_blank\" rel=\"noopener\">William Fry, Government legislative priorities for Autumn 2026 (17 September 2026)<\/a><\/li>\n<li><a href=\"https:\/\/www.oireachtas.ie\/en\/bills\/\" target=\"_blank\" rel=\"noopener\">Houses of the Oireachtas, bills database (consulted 2 October 2026)<\/a><\/li>\n<li><a href=\"https:\/\/weare.ie\/whois-services-policy-2023\" target=\"_blank\" rel=\"noopener\">.ie, WHOIS Services Policy (valid from 16 November 2020)<\/a><\/li>\n<li><a href=\"https:\/\/www.dominios.es\/es\/sobre-dominios\/faqs\" target=\"_blank\" rel=\"noopener\">Red.es (dominios.es), Frequently asked questions (consulted October 2026)<\/a><\/li>\n<li><a href=\"https:\/\/www.icann.org\/rdrs-en\" target=\"_blank\" rel=\"noopener\">ICANN, Registration Data Request Service (RDRS)<\/a><\/li>\n<li><a href=\"https:\/\/www.icann.org\/resources\/pages\/udrp-rules-2024-02-21-en\" target=\"_blank\" rel=\"noopener\">ICANN, UDRP Rules (updated 21 February 2024), paragraphs 3(b)(v) and 4(b)<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Spain and Ireland still had no NIS2 law two years after the deadline. Where transposition stands and what it means for registrant data under Article 28.<\/p>\n","protected":false},"author":1,"featured_media":889,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"wds_primary_category":0,"footnotes":""},"categories":[36],"tags":[60,44,64],"class_list":["post-535","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-domain-names","tag-icann","tag-spain","tag-udrp"],"_links":{"self":[{"href":"https:\/\/ipglobalguard.com\/en\/wp-json\/wp\/v2\/posts\/535","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ipglobalguard.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ipglobalguard.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ipglobalguard.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ipglobalguard.com\/en\/wp-json\/wp\/v2\/comments?post=535"}],"version-history":[{"count":0,"href":"https:\/\/ipglobalguard.com\/en\/wp-json\/wp\/v2\/posts\/535\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ipglobalguard.com\/en\/wp-json\/wp\/v2\/media\/889"}],"wp:attachment":[{"href":"https:\/\/ipglobalguard.com\/en\/wp-json\/wp\/v2\/media?parent=535"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ipglobalguard.com\/en\/wp-json\/wp\/v2\/categories?post=535"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ipglobalguard.com\/en\/wp-json\/wp\/v2\/tags?post=535"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}