Portugal

A controller must notify the CNPD without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Portugal, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. No Lei 58/2019 derogation from this timeline is identified.

Portugal's private-sector regime is the General Data Protection Regulation (GDPR) plus Lei n.o 58/2019, de 8 de agosto (Lei de Execucao do RGPD, GDPR Implementation Law), in effect from its 8 August 2019 publication.

Portugal is genuinely divergent here: the CNPD, in Deliberacao n.o 2019/494 of 3 September 2019, announced it would decline to apply a set of Lei 58/2019's own provisions in its enforcement decisions, on the ground that those provisions restrict the GDPR's direct effect and full effectiveness contrary to the primacy of EU law.

This is not a repeal (the CNPD has no constitutional-court power to strike a provision down) and it does not bind the courts, which remain free to reach their own view if a disapplied provision is litigated; it is a supervisory authority's own prospective enforcement stance, published for transparency.

Transferring personal data of a person in Portugal outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. No Lei 58/2019 derogation broadening or narrowing this is identified.

General Data Protection Regulation (GDPR) Articles 12 to 23 apply, including Article 22 rights against a decision based solely on automated processing, restated by Lei 58/2019 without narrowing per its own summary.

One of the CNPD's disapplied provisions, Lei 58/2019 Article 20(1) (restricting access rights where a confidentiality or secrecy duty applies against the data subject), sits in this dimension: only one of the three secondary sources names Article 20(1) among the disapplied provisions, so that specific finding is not settled here, and the GDPR Article 12 to 23 baseline is recorded as controlling.

The CNPD is Portugal's supervisory authority and enforces General Data Protection Regulation (GDPR) Article 83 fines. In Deliberacao n.o 2019/494 of 3 September 2019, the CNPD announced it will not apply a defined set of Lei 58/2019's own provisions in its enforcement practice, reasoning that an EU regulation has direct effect and primacy over conflicting national law under Article 288 TFEU and settled CJEU case law.

Three independent secondary paraphrases of the deliberation (Lexology, Garrigues, Recording Law) agree the CNPD disapplies Article 28(3)(a) (restricting employee consent to processing that would grant a legal or economic advantage) and a penalties-framework provision in the Article 37 to 39 range (differentiated fine ceilings by company size, and a prior-warning requirement for negligent infringements); the three sources diverge on the rest of the disapplied list (Articles 61(2), 62(2), and 20(1) are each named by only some of the three), so only what all three corroborate is recorded here, without asserting a complete article list.

The deliberation's own primary text has not been located in readable form. GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.

General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. No Lei 58/2019 provision adding a distinct national biometric-specific derogation is identified; Lei 58/2019's own additions are concentrated in automated-decision rights and the CNPD's disapplication practice rather than a biometric-specific chapter.

No Portugal-specific voiceprint or faceprint case, deliberation, or regulatory guidance was located; this is recorded as nothing located, not as a confirmed absence in Portuguese law.

Whoever, without legal permission or authorization from the system's owner or another rights holder, accesses a computer system in any way is punished with imprisonment up to one year or a fine up to 120 day-fines.

The penalty rises to imprisonment up to three years or a fine where the access was achieved by breaching a security control, and to imprisonment from one to five years where the access revealed a trade or industrial secret or confidential data protected by law, or produced a considerably high financial benefit.

Producing, selling, distributing, or introducing into a computer system a device, program, executable instruction set, code, or other computer data intended to carry out that unauthorized access is punished under the same penalty.

Reproducing a legally accessible protected work for text and data mining is a permitted exception under CDADC Article 75.º(2)(w), unless the rights holder has expressly reserved that use through a machine-readable means, such as optical reading of content made available to the public online, or another adequate means.

A separate, unconditional exception in Article 75.º(2)(v) covers a research organization or a cultural-heritage institution carrying out text and data mining on legally accessible works for scientific research. Article 75.º(3) defines text and data mining as any automated analytical technique aimed at analyzing text and data in digital form to produce information such as patterns, trends, and correlations.

A database whose selection or arrangement of contents is an intellectual creation is protected by copyright under Article 4.º(1) of Decreto-Lei n.º 122/2000, Portugal's transposition of the EU Database Directive (96/9/EC).

A separate sui generis right in Article 12.º gives the database's maker the right to authorize or prohibit extraction or re-utilization of the whole or a substantial part of its contents where obtaining, verifying, or presenting that content represented a substantial investment.

Reproducing, disclosing, communicating, or making available to the public, for direct or indirect commercial purposes, a database protected under Article 4.º(1) or Article 12.º without authorization is a criminal offense under Article 11.º, carrying imprisonment up to three years or a fine; Decreto-Lei n.º 47/2023 widened that offense in 2023 to also cover the sui generis right and to add making available to the public as a covered act, where the original 2000 text reached only a creative, copyright-protected database.

The decree does not state a general commencement day for the diploma; its Article 21.º backdates copyright protection under the diploma to 1 January 1998 but expressly excludes Article 11.º from that backdating, and no other commencement date for Article 11.º is stated in the text, though Decreto-Lei n.º 47/2023 cites the statute in its current wording as still applicable.

Article 26 requires an essential or important entity to take appropriate technical, operational and organisational measures to manage the risks to the network and information systems it uses in its operations, and to prevent or minimise an incident's impact on the recipients of its services and on other services, at a security level proportionate to the entity's risk exposure, size and the likelihood and severity of an incident, following a risk matrix the Centro Nacional de Cibersegurança (CNCS) defines and may update.

Article 27 lists the areas those measures must cover: incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure; policies to assess the effectiveness of the entity's risk-management measures; basic cyber-hygiene practices and staff training, including for members of top management bodies; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and multi-factor or continuous authentication, secure communications and secure emergency communication systems.

Article 25 requires the entity's management, direction and administration body to approve the Article 27 measures, supervise their application, ensure compliance with the supervision and enforcement measures of Chapter VI, and ensure regular cybersecurity training; a member of that body may be held liable, by act or omission, on a finding of intent (dolo) or gross negligence (culpa grave), for an infringement under this Decree-Law, and that responsibility may not be delegated except to another member of the same body.

This Decree-Law, Decreto-Lei n.º 125/2025, transposes NIS2 Directive Articles 20 and 21 and, by its own Article 9(b), repeals the Regime Jurídico da Segurança do Ciberespaço approved by Lei n.º 46/2018, de 13 de agosto, the predecessor NIS1 transposition.

Article 40 requires an essential, important or relevant public entity to notify the competent cybersecurity authority of any significant incident, weighed against the number of users affected, the incident's duration, the severity of the service disruption and its economic and social impact.

Article 41 sets three notification types per incident: an initial notification, a notification that the significant impact has ended, and a final report, with an entity whose incident resolves within two hours of detection required only to submit the end-of-impact notification. Article 42 requires the initial notification without undue delay and within 24 hours of concluding a significant incident exists or may exist.

Where necessary, Article 42 also requires an update within 72 hours of that determination, providing an initial assessment of the incident's severity and impact. Article 43 requires the end-of-significant-impact notification without undue delay and within 24 hours of the impact ending.

Article 44 requires the final report within 30 working days of the end-of-impact notification, describing the incident, its impact, the mitigating measures taken and the residual impact still present; an entity may also be asked for an interim report.

This clock differs from the calendar-day early-warning and one-calendar-month pattern used elsewhere in the corpus: Portugal's 30-day final-report deadline runs in working days from the end-of-impact notification rather than in calendar days from the initial notification. This Decree-Law transposes NIS2 Directive Article 23 and, by its own Article 9(b), repeals the Regime Jurídico da Segurança do Ciberespaço approved by Lei n.º 46/2018, de 13 de agosto, the predecessor NIS1 transposition.

A video-sharing platform provider must, among other adequate measures, create and manage systems to verify the age of the platform's users and audience, contributing to the protection of children and young people from content that could harm their physical, mental, or moral development, under Article 69.º-C, alínea e), of the Lei da Televisão e dos Serviços Audiovisuais a Pedido.

The same article requires a parental-control system under the end user's own control, and a transparent, easy-to-use, and effective complaint-handling procedure. Breach of Article 69.º-C is punishable by an administrative fine (coima) of 75,000 to 375,000 euros under Article 77.º(1) of the same Act. The ERC (Entidade Reguladora para a Comunicação Social) assesses the adequacy and effectiveness of the measures a provider adopts, under Article 69.º-D.

A press publisher established in an EU member state holds the exclusive right to authorize, itself or through its representatives, an information-society service provider's reproduction, communication to the public, or making available of the whole or part of its press publications online, per CDADC Article 188.º-A(1).

That right does not reach a private, non-commercial use by an individual, the establishment of a hyperlink, or the use of isolated terms or very short extracts of a press publication, per Article 188.º-A(2). The right lapses two years after the press publication's first publication, per Article 183.º(6), and does not apply to a press publication first published before 6 June 2019, per the decree's own Article 14.º.

Reproducing a legally accessible protected work, including a press publication, for text and data mining is a permitted exception under CDADC Article 75.º(2)(w), unless the rights holder has expressly reserved that use through a machine-readable means, such as optical reading of content made available to the public online, or another adequate means.

A separate, unconditional exception in Article 75.º(2)(v) covers a research organization or a cultural-heritage institution carrying out text and data mining on legally accessible works for scientific research, without the opt-out that limits the general exception.