PortugalGDPR Articles 12-21 and Lei n.o 58/2019, Data Subject Rights in Portugal
Regulation (EU) 2016/679, Arts. 12-21; Lei n.o 58/2019, de 8 de agosto, arts. 20, 31
In force since .
A data subject rights rule binding public and private bodies.
As of .
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Portugal within one month of receipt.
- You need not give a person in Portugal information about, or access to, their personal data under General Data Protection Regulation (GDPR) Articles 13 to 15 where a law imposes on you a duty of secrecy that can be invoked against that person, under Lei n.o 58/2019 article 20(1).
- You need not give effect to a person's rights of access, rectification, restriction or objection in Portugal for data you process for archiving in the public interest, scientific or historical research or statistics, to the extent those rights would make that purpose impossible or seriously impair it, under Lei n.o 58/2019 article 31(2).
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Portugal can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. Lei n.o 58/2019 narrows these rights twice.
Article 20(1) bars the information and access rights of GDPR Articles 13 to 15 where a law imposes on the controller or processor a duty of secrecy that can be invoked against the person, and Article 31(2) sets aside access, rectification, restriction and objection, as far as necessary, for archiving, research and statistics that exercising them would make impossible or seriously impair.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot or sends automated outreach.