Operates a social platform, in Portugal

Decreto-Lei n.º 7/2004, artigos 13.º-A, 19.º-A e 19.º-B · Read the law's page

• It binds a provider of intermediary network services within the meaning of the Decree-Law (Articles 19-A and 19-B)
• Inform the Ministério Público immediately on becoming aware that content made available through your service, or access to it, may constitute a crime, in particular child pornography, discrimination and incitement to hatred and violence or, where the victim or a third party reports it in a way that helps indicate the conduct, intrusion into sexual or bodily privacy (Article 19-A).
• Block within 48 hours the sites identified as containing child pornography or related material and, on a request by the victim or a third party that helps indicate the conduct, the sites identified as containing intrusion into sexual or bodily privacy or related material, through a transparent procedure with adequate safeguards that limits the restriction to what is necessary and proportionate and tells users the reason (Article 19-B(1)).
• Treat as identified every site on the lists that the competent national and international crime-prevention bodies draw up and communicate to you and to the Procuradoria-Geral da República (Article 19-B(2) and (3)).

Lei n.º 82/2021, de 30 de novembro · Read the law's page

• If you are a mere-conduit or internet access provider, a content-linking provider, or a storage provider whose servers hold the content, remove or block access to the copyright-protected content the inspector-general of cultural activities determines, within 48 hours of the notification, including by blocking a URL, a DNS name or an IP address (Article 5(1) and (2)).
• Where the IGAC notifies you that a time-limited delay would defeat the measure, act as soon as possible after the notification (Article 5(5)).
• Inform the IGAC at once when you learn of manifestly unlawful activity through your services, and meet requests to identify the recipients with whom you have storage agreements (Article 5(4)).

Código do Direito de Autor e dos Direitos Conexos, artigos 175.º-A a 175.º-I, aditados pelo Decreto-Lei n.º 47/2023, de 19 de junho · Read the law's page

• Obtain authorization from the rights holders before communicating protected works your users upload to the public or making them available (Article 175-B(2)).
• If you have no authorization, avoid liability for unauthorized communication by showing, cumulatively, best efforts to obtain authorization; best efforts, to high industry standards of professional diligence, to ensure the unavailability of specific works for which rights holders gave you the relevant and necessary information; and diligent action on a sufficiently substantiated notice to remove or block the work, with best efforts to prevent its future upload (Article 175-C(1)).
• If your services have been available to the public in the Union for less than three years, you may rely on that exclusion by showing annual turnover below EUR 10 million, an average of fewer than 5 million monthly unique visitors in the previous calendar year, best efforts to obtain authorization, and diligent action on a sufficiently substantiated notice to remove or block; if you cannot show the visitor figure, show full compliance with Article 175-C(1)(c) (Article 175-D).
• On request, give rights holders adequate information on how your practices under Articles 175-C and 175-D work and on the use of content covered by licensing agreements, and tell your users in your general conditions that they may use works under the exceptions and limitations to copyright and about the complaint procedures (Article 175-E).
• Provide all users an effective and rapid complaint and appeal mechanism against the improper removal or blocking of works they uploaded, tell users of a removal or blocking and its grounds, process complaints without undue delay with human review of the decision, tell interested parties when content is restored, and run the procedures in Portuguese (Article 175-F).

Decreto-Lei n.º 25/2026, de 28 de janeiro · Read the law's page

• Remove terrorist content, or block access to it, within one hour of receiving a removal or blocking decision, including a cross-border decision, and report the removal or blocking to the authority with its date and hour (Article 5(1)(a) to (c) of the Decreto-Lei n.º 25/2026, backing Articles 3 and 4 of Regulation (EU) 2021/784).
• Restore or unblock content when a reasoned decision requires it (Article 5(1)(d)).
• Meet the other obligations of the Regulation whose breach Article 5(1)(e) to (n) makes an administrative offence: adopt and apply specific measures, preserve removed content and related data, meet the transparency obligations, run a complaint mechanism and restore content or access where a complaint succeeds, give content providers the information the Regulation requires, tell the police or judicial authorities at once of terrorist content that implies an imminent threat to life, publish a point of contact for removal decisions, and, if your main establishment is outside the Union, designate a legal representative with the necessary powers and publish its details.

Decreto-Lei n.º 125/2025, de 4 de dezembro, Artigos 25.º a 29.º · Read the law's page

• Take appropriate technical, operational and organisational measures to manage the risks to the network and information systems you use in your operations, and to prevent or minimise the impact of an incident on the recipients of your services and on other services, at a level proportionate to your risk exposure, your size and the likelihood and severity of an incident.
• Cover at minimum: incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your relationship with your direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and cybersecurity training, including for your top management; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and multi-factor or continuous authentication, secure communications and secure emergency communication systems.
• Have your management, direction and administration body approve these measures, supervise their implementation, ensure compliance with supervision and enforcement obligations, and ensure regular cybersecurity training; know that a member of that body can be held personally liable, by act or omission, on a finding of intent or gross negligence, for an infringement of this Decree-Law, and that this responsibility cannot be delegated away.
• Articles 25 and 26 apply from 3 April 2026; Article 27(1) and (2), Articles 28 to 30 and 33 and the Article 61(1)(b), (c) and (f) fines take effect 24 months after publication of the regulations that Articles 8, 14, 26, 31, 32 and 83 of the Regime call for (Article 10(2) of the Decree-Law), which Regulamento n.º 756/2026, published on 22 June 2026, sets out in one document. This binds an essential or important entity of a type listed in Annex I or Annex II that is a medium enterprise under Annex III or exceeds the EU medium-enterprise thresholds of Commission Recommendation 2003/361/EC, or that Annex I or II names as essential regardless of size; Annex II's digital-services sector names an online marketplace provider, an online search engine provider and a social-networking-services-platform provider expressly, and Annex I's digital-infrastructure sector separately names a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a trust-service provider and a top-level-domain registry, so a service in any of those eight lines is reached; the wider sector classes (energy, transport, banking, health, drinking water, public administration and the rest of the Annexes) are reached too, by declaring that you are an essential or important entity.

Decreto-Lei n.º 125/2025, de 4 de dezembro, Artigos 40.º a 44.º · Read the law's page

• Notify the competent cybersecurity authority of any significant incident, weighing the number and share of users affected, the incident's duration, the severity of the service disruption and its economic and social impact.
• Submit an initial notification without undue delay and within 24 hours of concluding that a significant incident exists or may exist, and, where necessary, update it within 72 hours with an initial assessment of the incident's severity and impact; if the incident resolves within two hours of detection, submit only the end-of-impact notification below.
• Submit a notification that the incident's significant impact has ended, without undue delay and within 24 hours of that impact ending.
• Submit a final report within 30 working days of your end-of-impact notification, describing the incident, its impact, the mitigating measures you took and any residual impact still present, and submit an interim report if the competent authority asks for one; if the incident is still ongoing when the final report falls due, submit that interim report at the authority's request every week until you submit the final report (Article 44(1) and (3)).
• This binds an essential, important or relevant public entity on the same scope as this jurisdiction's companion risk-management row: Annex II's digital-services sector names an online marketplace provider, an online search engine provider and a social-networking-services-platform provider, and Annex I's digital-infrastructure sector separately names a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a trust-service provider and a top-level-domain registry; the wider sector classes are reached as on that row.

Lei n.º 12-A/2026, de 15 de abril · Read the law's page

• Comply, within the time each order sets, with orders from the competent judicial authorities or administrative bodies to act on illegal content, to give information on specific individual recipients of your service, or to supply lists of recipients or information on a group of unidentified recipients (Article 2).
• Give the Digital Services Coordinator, without undue delay and within the time it fixes, the information it requires about a suspected infringement of the Regulation or of the Act (Article 6(1)(a)).
• Designate a single point of contact for authorities and publish, in an easily accessible and current form, the information needed to identify and reach it (Article 18(1)(e) and (f), backing Article 11 of the Regulation).