PortugalLei n.º 16/2022, Electronic Communications Law, Security Incident Notification
Lei n.º 16/2022, de 16 de agosto, artigo 60.º
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Obligation class
- Reporting, Security
What it requires
- This binds a company that offers public electronic communications networks or publicly available electronic communications services in Portugal. Article 9(d) of Decreto-Lei n.º 125/2025 repeals Articles 59 to 65 only after the competent entities replace or revoke the ANACOM regulations on network and service security that are not incompatible with that Decree-Law (Article 10(1)), and until then this Article applies.
- Notify ANACOM and the Centro Nacional de Cibersegurança (CNCS), without undue delay, of any security incident with a significant impact on the functioning of your networks or services (Article 60(1)(a)). The Law sets no hour or day count in the Article itself.
- Follow the circumstances, format and procedures for that notification that ANACOM approves, which weigh the number of users affected, the duration, the geographical spread, the extent to which the network or service is affected and the economic and social impact (Article 61(2) and (3)).
- Inform the public, by the most appropriate means, of a security incident when ANACOM considers it to be in the public interest (Article 60(1)(b)).
- Where there is a specific and significant threat of a security incident in your networks or services, tell your potentially affected users, free of charge, of any protective or response measure they can adopt and, if appropriate, of the threat itself (Article 60(2)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
Autoridade Nacional de Comunicações (ANACOM), the ARN, which investigates non-compliance with the security chapter (Article 64(2)).
Settledness
- As of
- Open questions
- Has the repeal of Articles 59 to 65 of the Electronic Communications Law that Article 9(d) of Decreto-Lei n.º 125/2025 orders taken effect, given that Article 10(1) delays it until the competent entities replace or revoke the ANACOM regulations and acts on network and service security and integrity that are not incompatible with that Decree-Law?
What this law does
Lei n.º 16/2022 entered into force 90 days after its publication, except for the Articles of the Electronic Communications Law that Article 13(2) brings forward to the day after publication.
Article 60(1)(a) requires companies that offer public electronic communications networks or publicly available electronic communications services to notify the ARN and the Centro Nacional de Cibersegurança, without undue delay, of any security incident with a significant impact on the functioning of networks or services. Article 60(1)(b) requires those companies to inform the public of security incidents, by the most appropriate means, when the ARN considers this to be in the public interest.
Article 60(2) requires those companies, where there is a specific and significant threat of a security incident, to inform their potentially affected users free of charge of any protective or response measure and, if appropriate, of the threat itself. Article 61(2) has the ARN approve the measures that define the circumstances, the format and the procedures of incident notification.
Article 61(3) has the ARN weigh, among other parameters, the number of users affected, the duration, the geographical spread, the extent to which the network or service is affected and the economic and social impact in defining when an incident has a significant impact. Article 178(3)(n) classes a failure to comply with the notification duties of Article 60(1) and (2) among the very serious administrative offences.
Article 60(5) leaves unaffected the legislation on the processing of personal data and the protection of privacy in the electronic communications sector. Article 9(d) of Decreto-Lei n.º 125/2025 repeals Articles 59 to 65 of the Electronic Communications Law and points (m) to (t) of Article 178(3).
Article 10(1) of Decreto-Lei n.º 125/2025 makes that repeal take effect only after the competent entities replace or revoke the ANACOM regulations and acts on network and service security and integrity that are not incompatible with that Decree-Law.
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .