Is a bank, in Portugal

Decreto-Lei n.º 82/2022, de 6 de dezembro, serviços, arts. 2.º n.º 3 a 5, 4.º, 5.º, 13.º a 15.º, 25.º, 34.º, 36.º e 38.º · Read the law's page

• If you provide a service listed in Article 2(3) of Decreto-Lei 82/2022 to consumers, provide it only if it meets the accessibility requirements of the Decree-Law, which Portaria 220/2023 sets out in Annex I (Art. 4(1), Art. 13(1)); the Decree-Law has applied since 28 June 2025 (Art. 39(1)).
• If you offer e-commerce services, banking or financial services, electronic communications services, services that give access to audiovisual media services, or the websites, mobile applications, e-tickets and travel information of passenger transport, expect the supervising authority of your sector to check these services against the accessibility requirements (Art. 2(3), Art. 25(1), Art. 28(1)).
• Explain how your services meet the applicable accessibility requirements, in writing and orally, in a manner accessible to persons with disabilities, and keep that information for as long as the service is available (Art. 13(2)(b)); the explanation goes in the terms and conditions or an equivalent document (Annex II, point 1).
• Keep procedures that maintain the conformity of the service when its characteristics, the accessibility requirements or the harmonised standards change (Art. 13(2)(c)).
• If a service does not conform, adopt the corrective measures needed and inform the competent authorities of every Member State where you provide it, with the information on the non-conformity and the measures taken (Art. 13(2)(d)); give the supervising authority, on a reasoned request, the information and documentation it needs, in Portuguese among other languages, and cooperate with its actions (Art. 13(2)(e) and (f)).
• If you rely on the fundamental-alteration or disproportionate-burden defence, assess it yourself, document the assessment and keep the results for five years from the last time the service was supplied, and give the authority a copy on request (Art. 14(2) and (3)).
• If you rely on the disproportionate-burden defence for a service, update the assessment for each category or type of service when the service changes, when the authority asks, and at least every five years (Art. 14(6)); you cannot rely on it if you receive public or private funding, other than your own resources, made available to improve accessibility (Art. 14(7)).
• If you rely on the fundamental-alteration or disproportionate-burden defence for a specific service, inform the competent authority of the Member State where you provide it (Art. 14(8)).
• If you provide passenger air, bus, rail or waterborne transport services, meeting the accessible-information and accessibility-information requirements of Regulations (EC) 261/2004, (EC) 1107/2006, (EC) 1371/2007, (EU) 1177/2010 and (EU) 181/2011 counts as meeting the corresponding requirements of the Decree-Law, and its additional requirements still apply (Art. 5(1) and (3)).
• If you are a microenterprise providing services, the Decree-Law does not apply to you (Art. 2(5)(b)); Article 3 takes the definition from Directive (EU) 2019/882, Article 3(23): an enterprise which employs fewer than 10 persons and which has an annual turnover not exceeding EUR 2 million or an annual balance sheet total not exceeding EUR 2 million.
• A service provider whose facilities were lawfully in use before 28 June 2025 may keep providing the covered services with the products it lawfully used for similar services until 28 June 2030 (Art. 38(1)); self-service terminals used for services before that date may stay in use until the end of their economic useful life, for no more than 20 years after entering into service (Art. 38(4)).

Portaria n.º 220/2023, de 20 de julho, arts. 1.º a 4.º e anexos I e II · Read the law's page

• If you provide a service covered by Decreto-Lei 82/2022, make your websites, their online applications and your mobile services, including mobile applications, accessible in a consistent and adequate way by making them perceivable, operable, understandable and robust (Portaria 220/2023, Art. 2(2)(a), Annex I, Section III(c)); the Portaria names no technical standard.
• Provide information on how your service works, and on its accessibility features and interoperability with assistive devices, through more than one sensory channel, in an understandable and perceivable form, in text formats that can be rendered in other ways, and with a textual alternative for non-text content (Annex I, Section III(b)).
• Where you offer support services such as technical assistance, call centres or training, give information on the accessibility of the service and its compatibility with assistive technologies in accessible modes of communication (Annex I, Section III(d)).
• If you provide consumer banking services, offer identification methods, electronic signatures, security and payment services that are perceivable, operable, understandable and robust, and keep information at or below level B2 of the Common European Framework of Reference for Languages (Annex I, Section IV(e)).
• If you provide e-commerce services, give accessible information on the accessibility of the products and services sold, and make identification, security and payment functions perceivable, operable, understandable and robust (Annex I, Section IV(g)).
• If you provide an electronic communications service, provide real-time text in addition to voice, total conversation where you provide video, and synchronised voice, text and video in emergency communications passed to the most appropriate public safety answering point (Annex I, Section IV(a)).
• If you provide a service that gives access to audiovisual media services, provide perceivable, operable, understandable and robust electronic programme guides, and transmit subtitles for the deaf and hard of hearing, audio description, spoken subtitles and sign language interpretation with adequate quality, in sync with sound and video, and under the user's control (Annex I, Section IV(b)).
• If you provide passenger air, bus, rail, maritime or inland waterway transport services, provide information on the accessibility of vehicles, infrastructure and assistance, and on smart ticketing and real-time travel information (Annex I, Section IV(c)); for urban, suburban and regional transport services make the self-service terminals you use accessible (Annex I, Section IV(d)).
• If you provide e-books, deliver text and audio synchronised, do not block assistive technology, give access to the content structure, and supply accessibility metadata (Annex I, Section IV(f)).
• If you manufacture a product within Decreto-Lei 82/2022, design it so that persons with disabilities can perceive, use, understand and operate it, with more than one sensory channel, alternatives to speech and to colour, adjustable magnification, brightness and contrast, and accessible information on its operation and accessibility features (Annex I, Sections I and II; self-service terminals meet Section I only).
• If you rely on the disproportionate-burden defence, base the assessment on the ratio of the net costs of compliance to the total cost of making, distributing or importing the product or providing the service, on the estimate of the costs and benefits to you against the benefits to persons with disabilities, and on the ratio of the net costs to your net turnover (Art. 3, Annex II as republished by Declaração de Retificação 17/2023).

Lei n.º 73/2025, de 23 de dezembro (resiliência operacional digital do setor financeiro), artigos 1.º a 12.º · Read the law's page

• If you are a financial entity within Article 2(1) of Regulation (EU) 2022/2554 (DORA) established in Portugal, including an insurance or reinsurance undertaking or a pension fund management entity, comply with DORA as this Act executes it; the former Caixas Económicas that Article 2(2) lists are outside DORA and the Act.when it serves a financial business
• Report severe ICT-related incidents and any voluntary notification of a significant cyber threat to the competent authority Article 3 gives you: the Banco de Portugal where a credit institution distributes insurance or a credit or payment institution provides crowdfunding services, and otherwise the authority responsible for your prudential supervision (Article 3(2)(a) and (5)).when it serves a financial business
• If you make a voluntary notification of a significant cyber threat under DORA Article 19(2), also send it on the standard templates to the national CSIRTs (Article 5).when it serves a financial business
• Give the competent authority and your clients information that is complete, true, current, clear, objective and lawful, and cooperate with the authorities in crisis-management and contingency exercises that involve cyber-attack scenarios (Article 10(1)(a) and (b)).when it serves a financial business

Decreto-Lei n.º 125/2025, de 4 de dezembro, Artigos 25.º a 29.º · Read the law's page

• Take appropriate technical, operational and organisational measures to manage the risks to the network and information systems you use in your operations, and to prevent or minimise the impact of an incident on the recipients of your services and on other services, at a level proportionate to your risk exposure, your size and the likelihood and severity of an incident.
• Cover at minimum: incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including your relationship with your direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and cybersecurity training, including for your top management; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and multi-factor or continuous authentication, secure communications and secure emergency communication systems.
• Have your management, direction and administration body approve these measures, supervise their implementation, ensure compliance with supervision and enforcement obligations, and ensure regular cybersecurity training; know that a member of that body can be held personally liable, by act or omission, on a finding of intent or gross negligence, for an infringement of this Decree-Law, and that this responsibility cannot be delegated away.
• Articles 25 and 26 apply from 3 April 2026; Article 27(1) and (2), Articles 28 to 30 and 33 and the Article 61(1)(b), (c) and (f) fines take effect 24 months after publication of the regulations that Articles 8, 14, 26, 31, 32 and 83 of the Regime call for (Article 10(2) of the Decree-Law), which Regulamento n.º 756/2026, published on 22 June 2026, sets out in one document. This binds an essential or important entity of a type listed in Annex I or Annex II that is a medium enterprise under Annex III or exceeds the EU medium-enterprise thresholds of Commission Recommendation 2003/361/EC, or that Annex I or II names as essential regardless of size; Annex II's digital-services sector names an online marketplace provider, an online search engine provider and a social-networking-services-platform provider expressly, and Annex I's digital-infrastructure sector separately names a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a trust-service provider and a top-level-domain registry, so a service in any of those eight lines is reached; the wider sector classes (energy, transport, banking, health, drinking water, public administration and the rest of the Annexes) are reached too, by declaring that you are an essential or important entity.

Decreto-Lei n.º 125/2025, de 4 de dezembro, Artigos 40.º a 44.º · Read the law's page

• Notify the competent cybersecurity authority of any significant incident, weighing the number and share of users affected, the incident's duration, the severity of the service disruption and its economic and social impact.
• Submit an initial notification without undue delay and within 24 hours of concluding that a significant incident exists or may exist, and, where necessary, update it within 72 hours with an initial assessment of the incident's severity and impact; if the incident resolves within two hours of detection, submit only the end-of-impact notification below.
• Submit a notification that the incident's significant impact has ended, without undue delay and within 24 hours of that impact ending.
• Submit a final report within 30 working days of your end-of-impact notification, describing the incident, its impact, the mitigating measures you took and any residual impact still present, and submit an interim report if the competent authority asks for one; if the incident is still ongoing when the final report falls due, submit that interim report at the authority's request every week until you submit the final report (Article 44(1) and (3)).
• This binds an essential, important or relevant public entity on the same scope as this jurisdiction's companion risk-management row: Annex II's digital-services sector names an online marketplace provider, an online search engine provider and a social-networking-services-platform provider, and Annex I's digital-infrastructure sector separately names a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a trust-service provider and a top-level-domain registry; the wider sector classes are reached as on that row.