PortugalLei n.º 16/2022, Electronic Communications Law, Security Measures for Public Networks and Services
Lei n.º 16/2022, de 16 de agosto, artigos 59.º e 61.º a 64.º
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds a company that offers public electronic communications networks or publicly available electronic communications services in Portugal. Article 9(d) of Decreto-Lei n.º 125/2025 repeals Articles 59 to 65 only after the competent entities replace or revoke the ANACOM regulations on network and service security that are not incompatible with that Decree-Law (Article 10(1)), and until then these Articles apply.
- Adopt technical and organizational measures proportionate to the risk to manage the security risks to your networks and services, including encryption where appropriate, so as to prevent or minimize the impact of security incidents on users and on other networks and services (Article 59(1) and (2)).
- Cover at least network and resource security, security incident management, business continuity and recovery, and monitoring, auditing and testing in those measures (Article 59(3)).
- Apply the technical implementing measures that ANACOM approves and imposes (Article 61(1)) and the additional requirements it sets, which can include a permanent contact point, an up-to-date plan of your measures, exercises, an annual report, certified products, conditions on virtualization and subcontracting, supplier diversification, and network and security operations centres located in Portugal or another Member State (Article 62(1) and (2)).
- When ANACOM so determines, have an independent qualified entity audit the security of your networks and services at your own cost, submit that entity to ANACOM for prior approval, send ANACOM the report and send it a plan to correct any non-conformity found (Article 63(1) and (2)).
- Follow ANACOM's binding instructions, including the measures it orders to end or prevent a security incident (Article 64(1)), and a determination of the Security Assessment Commission to exclude, restrict or stop using equipment or services (Article 62(5)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Private right of actionNo
Penalty structure
Article 178(12)(e) sets the fine for a very serious administrative offence by a large enterprise at EUR 20,000 to EUR 5,000,000; lower bands apply to natural persons and smaller enterprises. Article 178(3)(m) classes a failure to comply with Article 59 among the very serious administrative offences.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
Autoridade Nacional de Comunicações (ANACOM), the ARN, which investigates non-compliance with the security chapter (Article 64(2)).
Settledness
- As of
- Open questions
- Has the repeal of Articles 59 to 65 of the Electronic Communications Law that Article 9(d) of Decreto-Lei n.º 125/2025 orders taken effect, given that Article 10(1) delays it until the competent entities replace or revoke the ANACOM regulations and acts on network and service security and integrity that are not incompatible with that Decree-Law?
What this law does
Lei n.º 16/2022 entered into force 90 days after its publication, except that Article 59 and Article 62(3) to (7) of the Electronic Communications Law it approves took effect on the day after publication. The ARN named in the Law's security chapter is the Autoridade Nacional de Comunicações (ANACOM).
Article 59(1) requires companies that offer public electronic communications networks or publicly available electronic communications services to adopt proportionate technical and organizational measures to manage adequately the risks to the security of networks and services, including encryption where appropriate. Article 61(1) lets the ARN approve and impose technical implementing measures on those companies.
Article 62(1) lets the ARN set more demanding additional requirements on those companies, including a permanent contact point, an up-to-date plan of the measures taken, exercises and an annual report to the ARN.
Article 62(2) has the ARN determine additional requirements that include the use of certified products, conditions on virtualization and subcontracting, a supplier diversification strategy and the location of the network and security operations centres in Portugal or another Member State. Article 62(5) lets the Security Assessment Commission determine, as a result of a security assessment, the exclusion of equipment or services, restrictions on their use, or the end of their use.
Article 63(1) lets the ARN require those companies to have an independent qualified entity audit the security of their networks and services at their own expense and to send the ARN a report of the results. Article 64(1) lets the ARN issue binding instructions to those companies, including the measures needed to end or prevent a security incident where a significant threat has been identified.
Article 178(3)(m) classes a failure to comply with the obligations of Article 59 among the very serious administrative offences. Article 178(12) fines a very serious administrative offence by a large enterprise at between EUR 20,000 and EUR 5,000,000. Article 9(d) of Decreto-Lei n.º 125/2025 repeals Articles 59 to 65 of the Electronic Communications Law and points (m) to (t) of Article 178(3).
Article 10(1) of Decreto-Lei n.º 125/2025 makes that repeal take effect only after the competent entities replace or revoke the ANACOM regulations and acts on network and service security and integrity that are not incompatible with that Decree-Law.
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .