Duty LXD-1001
Processes personal data, in Portugal
CNPD Deliberacao 2019/494, Disapplication of Lei 58/2019 Provisions in Portugalsince 1 line
CNPD Deliberacao n.o 2019/494, de 3 de setembro de 2019; Regulation (EU) 2016/679, Arts. 82-83 · Read the law's page
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.
GDPR Article 9, Special Categories of Personal Data as Applied in Portugalsince 2 lines
Regulation (EU) 2016/679, Art. 9 · Read the law's page
- Ground the processing of any biometric identifier of a person in Portugal, including a faceprint or voiceprint captured for unique identification, on a GDPR Article 9(2) condition such as explicit consent.
- Process the biometric data of a worker in Portugal only for attendance control and for control of access to your premises, use only representations of the biometric data, and collect it in a way that does not allow the data to be reversed, under Lei 58/2019 Article 28(6).
GDPR Articles 12-21 and Lei n.o 58/2019, Data Subject Rights in Portugalsince 3 lines
Regulation (EU) 2016/679, Arts. 12-21; Lei n.o 58/2019, de 8 de agosto, arts. 20, 31 · Read the law's page
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Portugal within one month of receipt.
- You need not give a person in Portugal information about, or access to, their personal data under GDPR Articles 13 to 15 where a law imposes on you a duty of secrecy that can be invoked against that person, under Lei n.o 58/2019 article 20(1), although the CNPD has announced that it will not apply that article.
- You need not give effect to a person's rights of access, rectification, restriction or objection in Portugal for data you process for archiving in the public interest, scientific or historical research or statistics, to the extent those rights would make that purpose impossible or seriously impair it, under Lei n.o 58/2019 article 31(2).
GDPR Articles 33-34, Breach Notification in Portugalsince 3 lines
Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page
- Notify the CNPD without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Portugal, unless the breach is unlikely to risk their rights and freedoms.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
GDPR Chapter V, Cross-Border Transfer of Personal Data from Portugalsince 1 line
Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page
- Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Portugal outside the European Economic Area.
Lei n.o 58/2019, Portuguese GDPR Implementation Law (Lei de Execução do RGPD)since 1 line
Lei n.o 58/2019, de 8 de agosto · Read the law's page
- Establish a GDPR Article 6 lawful basis before processing personal data of a person in Portugal, including data collected by crawling.