CYBCybersecurity

Cybersecurity in San Marino: the rules that apply to companies

For a San Marino company, cybersecurity rules come from Law 171/2018, the Criminal Code and contracts with Italian and European clients. Here is what they require and where to start.

Strategic editorial team 10 November 2026 8 min read

Cover: “San Marino: the rules of cybersecurity”, Cybersecurity

For a company in San Marino, cybersecurity rules come from three places. The first is San Marino Law 171/2018 on the protection of personal data. The second is the Criminal Code, which punishes computer crimes. The third is the contracts signed with Italian and European clients, which bring EU rules with them, such as NIS2, the GDPR and, for banks and insurers, the DORA regulation. In practice you need written and proportionate measures, regular checks, a procedure for data breaches with notification within 72 hours, and sound contracts with anyone who works on your data.

Which San Marino laws cover cybersecurity?

There are two laws to know, plus one that does not exist yet.

Law no. 171 of 21 December 2018. This is the personal data protection law. It requires security measures appropriate to the risk, notification of breaches to the San Marino Data Protection Authority and, in the most serious cases, a notice to the people affected. It applies to anyone established in the Republic and, in some cases, also to those who process from abroad the data of people located in San Marino (Article 3).
The Criminal Code, as amended by Law no. 114 of 23 August 2016. This law introduced computer crimes. Unauthorised access to a protected system is Article 182-bis. Then come interception of electronic communications (190-bis), damage to data and programs (203-bis) and computer fraud (204-ter), which the same law rewrote. The penalty increases if the offence is committed by a «system operator», meaning someone who manages the systems.
A San Marino law on NIS2. We did not find one in the collection of laws of the Great and General Council, nor in our searches of 7 November 2026. San Marino is not part of the EU, and the EU directive does not bind activities carried out in the Republic. It does, however, arrive through clients.

What does Law 171/2018 require in practice?

The San Marino law closely follows the EU GDPR. For cybersecurity, these articles matter most.

Topic	What it requires	Article
Security measures	Technical and organisational measures appropriate to the risk. Examples include encryption, the ability to restore data after an incident and a procedure to check regularly that the measures work	33
Data breach	Notification to the Data Protection Authority without undue delay and, where possible, within 72 hours. Every breach is documented, including those that are not notified	34
Notice to individuals	If the risk to people is high, they must be told too, in plain language	35
Suppliers processing data	A contract covering instructions, confidentiality, security measures, rules for sub-processors and the return or deletion of data at the end	29
Record of processing	Mandatory for organisations with at least 250 employees. Below that threshold it is still needed if the processing is risky, not occasional or involves special categories of data	31
Data protection officer	Must be appointed by public bodies and when the core activity requires regular monitoring of people on a large scale, or large-scale processing of special categories of data	38

Penalties are administrative. For companies the maximum can be a percentage of annual turnover, 2 or 4 per cent depending on the breach (Article 72).

The point companies underestimate most is testing. The law does not only ask you to have measures in place. It asks for a procedure to test them and assess their effectiveness on a regular basis. An antivirus installed three years ago and never checked does not prove it.

What changes when the client is Italian or European?

This is where San Marino rules meet EU rules. It happens in three ways.

The client is subject to NIS2. In Italy the directive applies through Legislative Decree 138/2024 (Italy’s NIS2 law). Article 24 requires in-scope entities to manage security in their relationships with direct suppliers and to assess their security practices. According to the FAQs of ACN, Italy’s National Cybersecurity Agency, a supplier does not become a NIS entity for this reason, but it must meet the obligations the client writes into the contract. That is why questionnaires and clauses arrive.
The client entrusts you with personal data. San Marino is not among the countries the European Commission recognises as providing adequate data protection (list consulted on 7 November 2026). For an Italian company, sending personal data to a San Marino supplier is therefore a transfer to a third country. The GDPR requires appropriate safeguards (Article 46). The most common are the standard contractual clauses approved by the Commission. Clients usually propose them together with the contract.
The client is an EU bank or insurer. The DORA regulation has applied since 17 January 2025. Article 30 lists what contracts with ICT service providers must contain. It ranges from a description of the services to assistance during an incident. For the most important functions, rights of access, inspection and audit are added.

There is also a rarer case. A San Marino company that offers services such as cloud, data centres or managed IT services in the EU may fall directly within NIS2. In that case it must designate a representative in a Member State. We will cover this in a separate guide.

Typical scenario. A San Marino company manages the website and email of an Italian client. The client is added to the list of NIS2 entities and renews the contract. Three documents arrive together: a security questionnaire, the appointment as data processor and the standard contractual clauses. A company that already has written measures and a record of its checks replies in a few days. A company that has neither must build them first.

And the association agreement with the European Union?

The agreement between the EU, Andorra and San Marino was signed on 19 October 2026. According to the European Commission, it will give access to the internal market under common rules. To enter into force it needs the consent of the European Parliament and ratification. As of 7 November 2026 it is not in force.

What will change for cybersecurity can only be judged on the text in force and on the rules that follow it. Until then, the rules described here apply. Our guide for businesses covers the content of the agreement.

Where do you start?

Order matters more than the number of documents. Five steps are enough to get going.

A list of systems and data. What you have, where it sits, who can access it and which personal data it holds. Mailboxes and cloud services included.
Written measures. Two-factor sign-in, backups kept apart from the network, updates on a set schedule, access removed when people leave. Each measure has an owner.
A regular check. A test restore of the backups and a technical check of exposed systems. The results are kept, together with the fixes made.
The breach procedure. Who decides, who notifies the Data Protection Authority within 72 hours, who keeps the record. Rehearse it at least once with management.
The contracts. Appointments of suppliers that process data, the clauses for transfers and ready answers to client questionnaires.

If you work with clients subject to NIS2, see also our guide on what supplier questionnaires ask.

In brief

For a San Marino company the rules come from Law 171/2018, the Criminal Code and contracts with clients.
Law 171/2018 requires measures appropriate to the risk, regular testing and notification of breaches to the Data Protection Authority, within 72 hours where possible.
We did not find a San Marino law transposing NIS2. The directive arrives through Italian and European clients.
San Marino is not among the countries recognised as adequate for personal data. EU clients that share data ask for safeguards such as the standard contractual clauses.
The agreement with the EU has been signed but is not yet in force. Its effects will depend on the text in force.

Frequently asked questions

How quickly must a data breach be reported in San Marino?

To the San Marino Data Protection Authority, without undue delay and, where possible, within 72 hours of becoming aware of it. If that deadline is missed, the notification explains the reason for the delay. If the risk to people is high, they must be told as well.

Can a San Marino supplier process personal data for Italian clients?

Yes, with the safeguards the GDPR requires for transfers to third countries. San Marino does not have an adequacy decision from the European Commission. Clients therefore usually propose the standard contractual clauses, together with the data processing contract.

Do you need a data protection officer?

Not always. Law 171/2018 requires one in the cases listed in Article 38. These are public bodies and organisations whose core activity requires regular monitoring of people on a large scale, or large-scale processing of special categories of data such as health data. In other cases it is the company’s choice.

Is a security test on your own systems lawful?

Yes, if it is authorised in writing by whoever has the right to decide on those systems. The Criminal Code punishes anyone who enters a protected system against the will of the person holding that right. That is why a serious test always starts from a written engagement, with scope, timing and contacts.

Putting measures, checks and contracts in order for a company in the Republic is the work of our cybersecurity service for San Marino companies. It usually starts with a cyber risk assessment, which shows where to begin. On the legal side we work with the company’s lawyer and with the data protection officer, where there is one.

Sources

Consulted on 7 November 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.