In some months of 2025, electricity consumption at data centers in Spain grew 75% compared to the previous year. Red Eléctrica documented it. It wasn't a projection. It was already happening.
Spain has been attracting investment in digital infrastructure for years. The combination of cheap renewable energy and available land has made it one of Europe's leading destinations for data centers. Since 2021, the Government had granted grid access rights for more than 12 GW of capacity — triple the 3.5–4 GW projected for 2030.
In August 2026, the Government decided it was time to bring order.
The August 2026 Royal Decree
On 27 August 2026, the Ministry for Ecological Transition published, on an urgent basis, the draft Royal Decree on energy sustainability, environmental, resilience and digital sovereignty requirements applicable to data centers.
It is the first time Spain has regulated data centers specifically. The window to submit comments was barely a week — a clear signal of the urgency with which the Government wants to move this forward. The text has already received more than 100 contributions from the sector and is now in the Ministry's hands before going to the Council of Ministers.
Who it affects: more data centers than you think
This is the point many companies are overlooking.
The decree is not aimed exclusively at large operators or hyperscale facilities. The text is explicit: it covers enterprise data centers, colocation centers, and co-hosting centers. Those exceeding 500 kW of installed IT power will need to report environmental and socioeconomic indicators annually by 15 May each year. Those exceeding 1 MW of access power take on the full set of obligations — covering energy, efficiency, digital sovereignty, waste heat reuse, and technical audits.
To put 1 MW in perspective: a standard server rack consumes between 5 and 15 kW. We're talking about facilities with 70 to 200 racks. A mid-sized corporate data center at a company that has grown over the past few years may fall within that range without anyone ever having calculated it precisely.
What the decree requires
The text organizes requirements into three main areas.
The first area is renewable energy. The decree structures this requirement across three articles that work in a chain.
- Article 7 establishes the general exemption clause: if the average share of electricity from renewable sources in the national electricity system exceeded 90% in the reference year (year n-2), the renewables requirements are automatically deemed to be met. When that threshold is not reached, the following two articles come into force.
- Article 8 regulates additionality: the data center must demonstrate that it covers 80% of its total consumption through own self-consumption or forward renewable electricity purchase agreements (PPAs) with installations located in Spain. Those installations must be newly commissioned: their commissioning certificate cannot predate the start of the data center's operations by more than 18 months. PPA contracts must have a minimum duration of ten years and must be executed as a public deed (Article 12).
- Article 9 regulates hourly correlation: the energy consumed in each hour must be backed, at least 80%, by renewable generation produced in that same hour. Annual averages cannot be used to offset, nor can surpluses from other time slots be carried over.
The second area is energy and water efficiency.
The decree requires achieving Category A under the European data center labeling system, which is due to come into force in August 2027. As transitional values until that date, PUE (Power Usage Effectiveness) cannot exceed 1.15 — meaning that for every 100 W consumed by servers, the data center cannot use more than 115 W in total. This is a demanding threshold; many current facilities operate with a PUE above 1.4 or even 1.6. For water, WUE (Water Usage Effectiveness) cannot exceed 0.1, a very strict value that targets cooling systems directly.
The third area is digital sovereignty.
Before commencing operations, the operator must submit a responsible declaration to the Ministry of Digital Transformation certifying: its establishment within the European Union; that the data, metadata, and records it processes as part of the data center's operation and that are under its control remain within the EU; the adoption of legal, technical, and organizational measures to control access from third countries; the identification and contractual supervision of direct subcontractors; and adequate measures against access requests from authorities in third countries that contravene European law..
The decree also includes a significant restriction for companies handling public sector data: data centers may not host information systems subject to the National Security Framework (Esquema Nacional de Seguridad) unless the data is processed, stored, and transferred exclusively within the European Union.
What the sector is asking for
The sector has not welcomed the draft with open arms. The more than 100 contributions submitted during the comment period reflect a concrete concern: the hourly renewable correlation requirements would place Spain among the most restrictive markets in Europe, with the risk of deterring investments estimated at €67 billion between 2026 and 2030.
Industry associations are calling for flexibility on hourly additionality and for requirements to be balanced against investment viability.
The Government is currently reviewing these contributions. The final text has not yet been approved, but the process is well advanced.
The question nobody is asking
There is something this decree makes plain that goes beyond the specific requirements.
To comply with a maximum PUE of 1.15, you need to know what your actual PUE is right now. Not the one you calculated in the last audit. Today's — this hour's. The same applies to water consumption, the source of the energy you're using, and the traceability of the data you manage.
To comply with a maximum PUE of 1.15, you need to know what your actual PUE is right now. Not the one you calculated in the last audit. Today's — this hour's. The same applies to water consumption, the source of the energy you're using, and the traceability of the data you manage.
Complying with this decree requires genuine control over the infrastructure you already manage. And that is something many data centers simply do not have today.
What to do now
The final text has not yet been published. But the draft is concrete enough that any company with a significant data center should start assessing its situation.
Do you exceed 500 kW of installed IT power? What about 1 MW of access power? What is your actual PUE? Do you have renewable self-consumption infrastructure or contracts? Do you know what percentage of renewables you're running on hour by hour? Is your operator established in the EU?
If any of these answers are not immediate, now is the time to start finding them.
https://www.miteco.gob.es/es/energia/participacion/2026/detalle-participacion-publica-k-851.html