European Union law applies in PortugalPortugal is a member state of the European Union, whose 223 researched instruments are listed on the European Union page, not here. The law of Portugal, described on this page below, applies here too.European Union law reaches Portugal two ways. A regulation, the EU AI Act and the GDPR among them, binds here as written, though Portugal names its own regulator, sets its own penalties within the EU ceiling and may add rules of its own beside it. A directive binds here only through the act Portugal passes to carry it into national law, and that act, listed on this page, is the one a court in Portugal applies. For a concern in Portugal, read both pages.
30 of 32 named instruments researched to a stage, across nine of the ten areas of law we track: 30 in force. As of .
When each starts28 of 30 carry a date, 2 do not. Earlier is before 2014.
in forcenot yet in forceblocked by a courtproposedno longer in force
The EU AI Act (Regulation (EU) 2024/1689) applies directly in Portugal and is not restated here as Portuguese law. Two Portuguese statutes add rules of their own on the use of AI: the Portuguese Charter of Human Rights in the Digital Age (Lei n.º 27/2021), Article 9, and the Labour Code as amended by Lei n.º 13/2023, which requires an employer to tell workers the parameters of the algorithms used in decisions about them.
Press reporting describes a government decision, announced , naming ANACOM as Portugal's national market surveillance authority and single point of contact under the EU AI Act, coordinating with sectoral authorities such as the CNPD and the Banco de Portugal. The European Commission's list of single points of contact for market surveillance names ANACOM for Portugal.
On that list, a single point of contact marked with an asterisk, as Portugal's is, has a national designation decision that is still pending final adoption. The Resolução do Conselho de Ministros n.º 2/2026, de 8 de janeiro de 2026, adopted a National Artificial Intelligence Agenda (ANIA) as government policy for infrastructure, innovation, skills, and governance; it does not impose a legal obligation on a private actor and is government strategy rather than a binding instrument.
Article 9(1) of the Portuguese Charter of Human Rights in the Digital Era provides that the use of artificial intelligence must be guided by respect for fundamental rights, balancing explainability, security, transparency and responsibility, and must set up processes to avoid bias and discrimination.
Article 9(2) provides that decisions with significant impact on the persons concerned that are taken through algorithms must be communicated to them and are open to appeal and audit as the law provides. Article 9(3) applies to the creation and use of robots the principles of beneficence, non-maleficence, respect for human autonomy and justice, and the principles and values of Article 2 of the Treaty on European Union. Article 23 provides that the Law takes effect 60 days after its publication. The Law was published in the Diário da República on , so it took effect on .
Lei n.º 13/2023 de 3 de abril (Agenda do Trabalho Digno), alterando o Código do Trabalho, arts. 3.º n.º 3 al. o), 24.º n.º 3 e 106.º n.º 3 al. s)Diário da República, Lei n.º 13/2023 (Portuguese text, verbatim)
In force since .Binds private bodies.
What this law does
Article 106(3), point s) of the Labour Code, as drafted by Law 13/2023, adds to the information that the employer gives the worker the parameters, criteria, rules and instructions on which algorithms or other artificial intelligence systems are based, where they affect decisions on access to and retention of employment and working conditions, including profiling and monitoring of professional activity.
Under Article 107(4) the information other than the items listed in Article 107(2) is communicated to the worker on paper or in electronic form within one month of the start of the contract. Article 24(3) extends the preceding paragraphs of Article 24 to decisions taken on the basis of algorithms or other artificial intelligence systems.
Article 3(3), point o) adds the use of algorithms, artificial intelligence and related matters, namely in work on digital platforms, to the matters listed in Article 3(3) of the Labour Code. Article 37(1) of Law 13/2023 provides that it takes effect on the first day of the month after its publication. Law 13/2023 was published in the Diário da República on , so it took effect on .
Portugal's private-sector regime is the General Data Protection Regulation (GDPR) plus Lei n.o 58/2019, de 8 de agosto (Lei de Execucao do RGPD), in force from , the day after its publication (Article 68(1)). Portugal is the genuinely divergent jurisdiction: the CNPD, in Deliberacao n.o 2019/494 of , announced it will decline to apply a set of Lei 58/2019's own provisions in its enforcement decisions on EU-law-primacy grounds, a supervisory stance rather than a repeal.
The deliberation lists Articles 2(1) and (2), 20(1), 23, 28(3)(a), 37(1)(a), (h) and (k) and (2), 38(1)(b) and (2), 39(1) and (3), 61(2) and 62(2).
A controller must notify the CNPD without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Portugal, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
Lei 58/2019 adds no timeline of its own: its Article 38(1)(j) and (k) treat a failure to meet General Data Protection Regulation (GDPR) Article 33, or to inform the person as Article 34 requires, as a serious administrative offense.
Portugal's private-sector regime is the General Data Protection Regulation (GDPR) plus Lei n.o 58/2019, de 8 de agosto (Lei de Execucao do RGPD, GDPR Implementation Law), in force from , the day after its publication (Article 68(1)).
Portugal is genuinely divergent here: the CNPD, in Deliberacao n.o 2019/494 of , announced it would decline to apply a set of Lei 58/2019's own provisions in its enforcement decisions, on the ground that those provisions restrict the GDPR's direct effect and full effectiveness contrary to the primacy of EU law.
The CNPD presents this as a decision to disapply the listed provisions in the future cases it examines, which it made public for the transparency of its future decision-making and for legal certainty.
Transferring personal data of a person in Portugal outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier.
Article 22 of Lei 58/2019 treats transfers to third countries or international organisations that public entities make, in the exercise of public authority powers, to comply with legal obligations as being in the public interest for the purposes of General Data Protection Regulation (GDPR) Article 49(4).
General Data Protection Regulation (GDPR) Article 22 gives a person in Portugal the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.
Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.
Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.
Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.
Lei n.o 58/2019 adds no rule of its own on automated decisions.
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Portugal can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. Lei n.o 58/2019 narrows these rights twice.
Article 20(1) bars the information and access rights of GDPR Articles 13 to 15 where a law imposes on the controller or processor a duty of secrecy that can be invoked against the person, and Article 31(2) sets aside access, rectification, restriction and objection, as far as necessary, for archiving, research and statistics that exercising them would make impossible or seriously impair. In Deliberacao 2019/494 the CNPD announced that it will not apply Article 20(1) in the cases it later examines.
In force since , effective .Binds public and private bodies.
What this law does
The CNPD is Portugal's supervisory authority and enforces General Data Protection Regulation (GDPR) Article 83 fines. In Deliberacao n.o 2019/494 of , the CNPD announced it will not apply a defined set of Lei 58/2019's own provisions in its enforcement practice, reasoning that an EU regulation has direct effect and primacy over conflicting national law under Article 288 TFEU and settled CJEU case law.
The deliberation lists Article 2(1) and (2), Article 20(1), Article 23, Article 28(3)(a), Article 37(1)(a), (h) and (k) and (2), Article 38(1)(b) and (2), Article 39(1) and (3), Article 61(2) and Article 62(2). It reasons that Article 28(3)(a) restricts the relevance of an employee's consent beyond what GDPR Articles 6(1)(a) and 9(2)(a) allow. It also reasons that national maximum fines below those of GDPR Article 83(4) and (5) violate the Regulation.
GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.
General Data Protection Regulation (GDPR) Article 9(1) classifies biometric data processed for unique identification as a special category. Article 28(6) of Lei 58/2019 treats the processing of employees' biometric data as legitimate only for attendance control and for control of access to the employer's premises, and requires that only representations of the biometric data are used and that the collection process does not allow the data to be reversed.
Portugal's computer-misuse law is Lei n.º 109/2009, de 15 de setembro (Lei do Cibercrime), whose Article 6.º punishes unauthorized access to a computer system with imprisonment up to one year or a fine, rising to imprisonment up to three years where a security control was bypassed and to imprisonment from one to five years where the access revealed a trade or industrial secret or produced a considerably high financial benefit.
Portugal's sui generis database right sits in a separate statute from the copyright code, Decreto-Lei n.º 122/2000, de 4 de julho, transposing the EU Database Directive (96/9/EC); unauthorized commercial extraction, communication, or making available of a protected database is a criminal offense under its Article 11.º, carrying imprisonment up to three years or a fine.
Both a general copyright text-and-data-mining exception and a widening of that database-right offense were added by Decreto-Lei n.º 47/2023, de 19 de junho, Portugal's transposition of the EU Digital Single Market Copyright Directive (2019/790): reproduction of a legally accessible work for text and data mining is permitted unless the rights holder has expressly reserved that use in an adequate way, in particular by optical reading for content made available online, and a research organization or cultural-heritage institution carries out text and data mining for scientific research without that opt-out limiting it.
Whether merely reading an openly served public page without defeating any security control falls inside or outside the Lei do Cibercrime's unauthorized-access offense is not settled by the statute's text or by any reported decision.
General contract law under Decreto-Lei n.º 446/85 (cláusulas contratuais gerais) includes general terms in a contract only by the visitor's acceptance, and can also bind a visitor who never clicked to accept them where the terms were communicated adequately and with the necessary advance notice and the visitor's continued use of the site amounts to a tacit acceptance the Civil Code recognizes, excluding a clause a normal visitor would not have noticed.
Overloading a site's servers is not a recognized claim under Portuguese law distinct from the offenses and rights above. The Código da Propriedade Industrial's general unfair-competition clause, article 311.º, reaches any act of competition contrary to the fair norms and usages of a trade, which could extend to a competitor's scraping done for a commercial purpose, though no reported decision applies it to web scraping specifically.
Whoever, without legal permission or authorization from the system's owner or another rights holder, accesses a computer system in any way is punished with imprisonment up to one year or a fine up to 120 day-fines.
The penalty rises to imprisonment up to three years or a fine where the access was achieved by breaching a security control, and to imprisonment from one to five years where the access revealed a trade or industrial secret or confidential data protected by law, or produced a considerably high financial benefit.
Producing, selling, distributing, or introducing into a computer system a device, program, executable instruction set, code, or other computer data intended to carry out that unauthorized access is punished under the same penalty.
Reproducing a legally accessible protected work for text and data mining is a permitted exception under CDADC Article 75.º(2)(w), unless the rights holder has expressly reserved that use in an adequate way, in particular by optical reading for content made available to the public online.
A separate exception in Article 75.º(2)(v), which carries no rights-holder reservation condition, covers a research organization or a cultural-heritage institution carrying out text and data mining on legally accessible works for scientific research. Article 75.º(6)(b) defines text and data mining as any automated analytical technique aimed at analyzing text and data in digital form to produce information such as patterns, trends, and correlations.
A database whose selection or arrangement of contents is an intellectual creation is protected by copyright under Article 4.º(1) of Decreto-Lei n.º 122/2000, Portugal's transposition of the EU Database Directive (96/9/EC).
A separate sui generis right in Article 12.º gives the database's maker the right to authorize or prohibit extraction or re-utilization of the whole or a substantial part of its contents where obtaining, verifying, or presenting that content represented a substantial investment.
Reproducing, disclosing, communicating, or making available to the public, for direct or indirect commercial purposes, a database protected under Article 4.º(1) or Article 12.º without authorization is a criminal offense under Article 11.º, carrying imprisonment up to three years or a fine.
Decreto-Lei n.º 47/2023 widened that offense in 2023 to also cover the sui generis right and to add making available to the public as a covered act, where the original 2000 text reached only a creative, copyright-protected database.
Since Decreto-Lei n.º 47/2023, Article 15.º(f) also exempts from the sui generis right the reproduction and extraction of legally accessible works and other material for text and data mining, unless the rights holders have expressly reserved that use in an adequate way, in particular by optical reading for content made available to the public online.
The decree does not state a general commencement day for the diploma; its Article 21.º backdates copyright protection under the diploma to but expressly excludes Article 11.º from that backdating. Article 11.º was later replaced by Decreto-Lei n.º 47/2023. A decree that fixes no day enters into force on the fifth day after its publication, under Article 2.º(2) of Lei n.º 74/98. That period counts from the day after publication.
Decreto-Lei n.º 122/2000 was published on , so Articles 4.º and 12.º, and Article 11.º in its original wording, applied from . Decreto-Lei n.º 47/2023 enters into force 15 days after its publication. It was published on , so its wording of Article 11.º and its Article 15.º(f) apply from .
Portugal completed its NIS2 transposition on . The Regime Jurídico da Cibersegurança (RJC), approved by Decreto-Lei n.º 125/2025, de 4 de dezembro, transposes Directive (EU) 2022/2555 and, by its own Article 9(b), repeals the predecessor Regime Jurídico da Segurança do Ciberespaço (RJSC), approved by Lei n.º 46/2018, de 13 de agosto, which had transposed the original NIS Directive.
Decreto-Lei n.º 125/2025 was approved by the Council of Ministers on , promulgated on , published on , and entered into force 120 days later, on (Article 11), so it now binds, except that Article 10(2) defers Article 27(1) and (2), Articles 28 to 30, Article 33 and the Article 61(1)(b), (c) and (f) fines until 24 months after publication of the regulations that Articles 8, 14, 26, 31, 32 and 83 of the Regime call for.
The RJC reaches 17 sectors plus a significant part of the Administração Pública, expanding well beyond the critical-infrastructure sectors the RJSC already covered to add IT service management, wastewater, space, manufacturing, postal and courier services, waste management, chemical production, food production and distribution, digital-service provision and research; it excludes national-security, public-security, defence and intelligence-service entities from its scope (Articles 2 and 6).
It classifies an entity as essential or important by sector type (Annexes I and II) and by whether it exceeds the EU medium-enterprise thresholds of Commission Recommendation 2003/361/EC, though a qualified trust service provider, a top-level-domain name registry and a DNS service provider are essential regardless of size (Article 6).
Annex II's digital-services sector names an online marketplace provider, an online search engine provider and a social-networking-services-platform provider expressly; Annex I's digital-infrastructure sector separately and expressly names a cloud-computing-service provider, a data-centre-service provider, a content-delivery-network provider, a trust-service provider and a top-level-domain registry, each reached at the medium-enterprise size threshold or above except the categories the Act designates as essential regardless of size.
The wider sector classes the RJC designates (energy, transport, banking, health, drinking water, public administration and the rest of the Annexes) are reached by declaring that you are an essential or important entity.
Portugal has no general reasonable-security or information-security-programme statute with no sector gate; the closest general duty is General Data Protection Regulation (GDPR) Article 32's security-of-processing obligation and Lei n.º 58/2019's breach-notification duties to the Comissão Nacional de Proteção de Dados (CNPD), both of which sit in the privacy topic rather than here.
The CNCS's Regulamento n.º 756/2026, published in the Diário da República on and in force the next day, sets the rules of the electronic platform through which a covered entity registers (Article 8(7)), the minimum measures and compliance levels (Article 26(5)) and the incident-notification procedures (Articles 40 to 45).
The Decreto-Lei n.º 84/2021, de 18 de outubro (Decree-Law 84/2021 of 18 October) sets the consumer's rights in the sale of goods and the supply of digital content and services, transposing Directives (EU) 2019/771 and (EU) 2019/770, and came into force on .
Article 8(1) requires a trader selling goods with digital elements to ensure that updates, including security updates, needed to keep the goods in conformity are communicated and supplied to the consumer for the period the consumer could reasonably expect, taking into account the type and purpose of the goods and digital elements and the circumstances and nature of the contract.
Where the digital content or service is supplied continuously, Article 8(2) and (3) fix the update period at two years for a supply of up to two years and at the duration of the contract for a longer supply. Article 29(1)(b) requires digital content or services to have the quantity, qualities and performance characteristics, including security, that are usual and expected in digital content or services of the same type.
Article 29(3) requires the trader, where the contract provides for a single act of supply or a series of individual acts of supply, to ensure that updates, including security updates, needed to keep the digital content or services in conformity are communicated and supplied to the consumer for the period the consumer could reasonably expect.
Article 29(4) extends the update duty, for a continuous supply, over the period for which the digital content or services must be supplied under the contract.
The trader is not liable for a lack of conformity that results only from the consumer's failure to install, within a reasonable time, an update supplied under Article 29(3) and (4), provided the trader told the consumer of the update and the consequences of not installing it and the failure was not due to defective installation instructions.
The Lei n.º 73/2025, de 23 de dezembro (Act 73/2025 of 23 December) executes Regulation (EU) 2022/2554 (DORA) in Portuguese law and transposes Directive (EU) 2022/2556, amending the sector regimes for credit institutions, securities, insurance, payment services, pension funds, investment firms and asset management.
The Act was published in the Diário da República on and contains no commencement article, so under the default rule of the Act on the publication of legislation it came into force on the fifth day after publication, . Article 3 names the Banco de Portugal, the Autoridade de Supervisão de Seguros e Fundos de Pensões (ASF) and the Comissão do Mercado de Valores Mobiliários (CMVM) as the competent authorities under DORA Article 46 for the entities each supervises.
The Banco de Portugal is the sole authority that receives reports of severe ICT-related incidents and voluntary notifications of significant cyber threats where credit institutions distribute insurance or credit and payment institutions provide crowdfunding services, and where an entity has more than one supervisor the authority responsible for its prudential supervision applies DORA Articles 19 and 22(1).
Article 5 requires a financial entity that makes a voluntary notification of a significant cyber threat under DORA Article 19(2) to send it, on the standard templates, to the national computer security incident response teams (CSIRTs). Article 10(1) makes it an administrative offence to give an authority or clients information that is not complete, true, current, clear, objective and lawful, or to fail to give it.
Article 11 sets the fine for a legal person that is a credit institution, investment firm, insurer, payment institution or other listed financial entity at between EUR 10,000 and EUR 5,000,000, and for a natural person between EUR 5,000 and EUR 2,500,000. Article 11(2) raises the maximum fine to the greater of three times the economic benefit obtained and, for a legal person that is one of those financial entities, 10 percent of turnover.
Article 26 requires an essential or important entity to take appropriate technical, operational and organisational measures to manage the risks to the network and information systems it uses in its operations, and to prevent or minimise an incident's impact on the recipients of its services and on other services, at a security level proportionate to the entity's risk exposure, size and the likelihood and severity of an incident, following a risk matrix the Centro Nacional de Cibersegurança (CNCS) defines and may update.
Article 27 lists the areas those measures must cover: incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure; policies to assess the effectiveness of the entity's risk-management measures; basic cyber-hygiene practices and staff training, including for members of top management bodies; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and multi-factor or continuous authentication, secure communications and secure emergency communication systems.
Article 25 requires the entity's management, direction and administration body to approve the Article 27 measures, supervise their application, ensure compliance with the supervision and enforcement measures of Chapter VI, and ensure regular cybersecurity training; a member of that body may be held liable, by act or omission, on a finding of intent (dolo) or gross negligence (culpa grave), for an infringement under this Decree-Law, and that responsibility may not be delegated except to another member of the same body.
Article 10(2) of the Decree-Law defers the effect of Article 27(1) and (2), Articles 28 to 30, Article 33 and the Article 61(1)(b), (c) and (f) fines until 24 months after publication of the regulations referred to in Articles 8, 14, 26, 31, 32 and 83 of the Regime. The Centro Nacional de Cibersegurança published Regulamento n.º 756/2026 in the Diário da República, 2.ª série, n.º 118, on .
The Regulation enters into force the day after publication, without prejudice to Article 10(2) of the Decree-Law. The Regulation sets out in one document the matters the Regime leaves to regulation, including those under Articles 8(7), 14(2) and (5), 26(5), 29(1), 30, 31(3), 32(3), 33(2), 40 to 45, 72(2) and 83(2).
This Decree-Law, Decreto-Lei n.º 125/2025, transposes NIS2 Directive Articles 20 and 21 and, by its own Article 9(b), repeals the Regime Jurídico da Segurança do Ciberespaço approved by Lei n.º 46/2018, de 13 de agosto, the predecessor NIS1 transposition.
Article 40 requires an essential, important or relevant public entity to notify the competent cybersecurity authority of any significant incident, weighed against the number of users affected, the incident's duration, the severity of the service disruption and its economic and social impact.
Article 41 sets three notification types per incident: an initial notification, a notification that the significant impact has ended, and a final report, with an entity whose incident resolves within two hours of detection required only to submit the end-of-impact notification. Article 42 requires the initial notification without undue delay and within 24 hours of concluding a significant incident exists or may exist.
Where necessary, Article 42 also requires an update within 72 hours of that determination, providing an initial assessment of the incident's severity and impact. Article 43 requires the end-of-significant-impact notification without undue delay and within 24 hours of the impact ending.
Article 44 requires the final report within 30 working days of the end-of-impact notification, describing the incident, its impact, the mitigating measures taken and the residual impact still present; an entity may also be asked for an interim report. Portugal's 30-day final-report deadline runs in working days from the end-of-impact notification rather than in calendar days from the initial notification.
This Decree-Law transposes NIS2 Directive Article 23 and, by its own Article 9(b), repeals the Regime Jurídico da Segurança do Ciberespaço approved by Lei n.º 46/2018, de 13 de agosto, the predecessor NIS1 transposition.
Portuguese law on contacting a person and capturing a communication sits mainly in Lei 41/2004, which transposes the ePrivacy Directive, as redrafted and supplemented by Lei 46/2012.
Article 4 requires companies offering electronic communications networks or services to guarantee the inviolability of communications, prohibits interception or surveillance by third parties without the users' prior and express consent, and allows recording in lawful commercial practice to prove a transaction when the data subject has been informed and consented.
Article 5 allows storing or reading information on a subscriber's or user's terminal equipment only with prior consent based on clear and complete information. Article 13-A subjects unsolicited direct marketing communications, including automated calls, fax, electronic mail and SMS, to the prior express consent of a subscriber who is a natural person, with a soft opt-in for a supplier's own similar products or services.
Decreto-Lei 7/2004 requires commercial communications online to be identifiable, and Lei 93/2021 allows an oral whistleblowing report to be recorded only with the whistleblower's consent. A data subject's right to object to direct marketing is held in the privacy row for General Data Protection Regulation (GDPR) Articles 12-21 and Lei 58/2019, Data Subject Rights in Portugal.
Article 21 of Decreto-Lei 7/2004 requires the advertising nature of a distance advertising communication provided by electronic means, the advertiser, and the promotional offers such as discounts, prizes and gifts and promotional contests or games, with their conditions, to be clearly identified so that an average recipient grasps them easily.
Under Article 20, paragraph 1, messages that merely identify or give access to an economic operator, or identify goods, services or an operator's image objectively in collections or lists, and messages promoting ideas, principles, initiatives or institutions, are not advertising communications in a network. Article 5 of Lei 46/2012 repealed Article 22 of Decreto-Lei 7/2004, the former rule on unsolicited communications, which Article 13-A of Lei 41/2004 now carries.
Decreto-Lei 7/2004 was published in the Diário da República of . Article 2(2) of Lei 74/98 brings an act with no fixed day into force on the 5th day after publication, and article 2(4) counts that period from the day after publication, so the Decreto-Lei entered into force on .
Article 13-A, paragraph 1 of Lei 41/2004 subjects the sending of unsolicited communications for direct marketing purposes, in particular by automated calling and communication systems that do not depend on human intervention, by fax machines or by electronic mail including SMS, EMS and MMS, to the prior express consent of the subscriber who is a natural person, or of the user.
Under paragraph 2, that rule does not apply to subscribers that are legal persons, to whom unsolicited direct marketing communications are allowed until they refuse future communications and register on the list provided for in Article 13-B. Under paragraph 3, a supplier that obtained its customers' electronic contact details in the context of a sale of a product or service may use them for direct marketing of its own similar products or services, provided that the customers are clearly and explicitly given a free and easy chance to refuse, at the time of collection and on the occasion of each message where the customer did not refuse initially.
Paragraph 4 prohibits sending electronic mail for direct marketing that conceals or disguises the identity of the person on whose behalf the communication is made, in breach of Article 21 of Decreto-Lei 7/2004, that gives no valid means of contact to which the recipient can send a request to stop, or that encourages recipients to visit websites that breach that Article. Article 3 of Lei 46/2012 added Article 13-A to Lei 41/2004. Lei 46/2012 entered into force on the day after its publication.
Article 5, paragraph 1 of Lei 41/2004 allows the storage of information, and the possibility of access to information stored, in the terminal equipment of a subscriber or user only if they have given their prior consent, on the basis of clear and complete information, in particular about the purposes of the processing.
Paragraph 2 provides that Article 5 and the preceding article do not prevent technical storage or access whose sole purpose is to transmit a communication through an electronic communications network, or that is strictly necessary for the provider to supply an information society service expressly requested by the subscriber or user. Article 2 of Lei 46/2012 gave Article 5 of Lei 41/2004 its present wording. Lei 46/2012 entered into force on the day after its publication.
Article 4, paragraph 1 of Lei 41/2004 requires companies that offer electronic communications networks or services to guarantee the inviolability of communications and of the related traffic data carried over public communications networks and publicly available electronic communications services.
Paragraph 2 prohibits eavesdropping, the installation of listening devices, storage or other means of interception or surveillance of communications and the related traffic data by third parties without the prior and express consent of the users, except in the cases provided for by law.
Paragraph 3 does not prevent lawfully authorized recordings of communications and the related traffic data made in lawful commercial practice to prove a commercial transaction or any other communication made within a contractual relationship, provided that the data subject has been informed and has given consent. Paragraph 4 authorizes recordings of communications to and from public services intended to deal with emergencies of any kind. Lei 41/2004 entered into force on the day after its publication.
Article 20, paragraph 3 of Lei 93/2021 requires reports made orally, through a recorded telephone line or another recorded voice message system, to be registered, with the whistleblower's consent, by a recording of the communication in a durable and retrievable medium or by a complete and accurate transcription. Paragraph 4 requires faithful minutes of the communication where the oral reporting channel used does not allow it to be recorded.
Paragraph 5 requires a report made at an in-person meeting to be registered, with the whistleblower's consent, by a recording or by faithful minutes. Under paragraph 6, the whistleblower must be allowed to see, correct and approve, by signing, the transcription or minutes of the communication or meeting. Under Article 8, paragraph 1, legal persons employing 50 or more workers, including the State and other public-law legal persons, must have internal reporting channels. Lei 93/2021 enters into force 180 days after its publication on , which is .
Portugal applies the Digital Services Act directly. Lei n.º 12-A/2026 of carries out the Act in national law: it makes the Autoridade Nacional de Comunicações (ANACOM) the competent administrative authority and Digital Services Coordinator, sets the content of the orders that authorities send to intermediary service providers, and sets fines of up to 6 percent of worldwide annual turnover.
It also repealed Articles 12 to 19 of Decreto-Lei n.º 7/2004, the articles that held the liability exemptions and the duties of network intermediary service providers, and Decreto-Lei n.º 20-B/2024, the decree that had first designated the authorities. Articles 19-A and 19-B of Decreto-Lei n.º 7/2004, on reporting possible crimes to the Public Prosecutor's Office and on blocking, remain in force in the consolidated text.
The Terrorist Content Online Regulation is carried out by Decreto-Lei n.º 25/2026, copyright-protected content is handled by the Inspeção-Geral das Atividades Culturais under Lei n.º 82/2021, and the liability regime for online content-sharing service providers sits in the Código do Direito de Autor e dos Direitos Conexos, Articles 175-A to 175-I. The Digital Services Act's own duties are held with the European Union's page and are not restated here.
Article 175-A(1) defines an online content-sharing service provider as a provider of an information society service whose main purpose, or one of whose main purposes, is to store and give the public access to a significant quantity of protected works uploaded by its users, which the provider organizes and promotes for direct or indirect economic or commercial gain.
Article 175-A(2) excludes services such as non-profit online encyclopedias, non-profit scientific and educational repositories, open source software platforms, electronic communications providers, online marketplaces, and business-to-business and personal-use cloud services. Article 175-B(2) requires such a provider to obtain authorization from the rights holders in order to communicate protected works to the public or make them available.
Article 175-C(1) makes the provider liable for unauthorized communication to the public unless it shows, cumulatively, best efforts to obtain authorization, best efforts to ensure the unavailability of specific works for which rights holders supplied information, and diligent action on a sufficiently substantiated notice to remove or block the work and best efforts to prevent its future upload.
Article 175-D limits those conditions for a new provider whose services have been available to the public in the Union for less than three years. Article 175-E requires the provider to give rights holders adequate information on its practices on request and to tell its users in its general conditions about the exceptions and limitations to copyright and the complaint procedures.
Article 175-F(1) requires the provider to create and make available an effective and rapid complaint and appeal mechanism for users against the improper removal or blocking of works they uploaded. Article 175-F(5) requires complaints to be processed without undue delay and subjects decisions to remove or block uploaded content to human review. Article 175-F(7) requires the procedures to be available and conducted in Portuguese. Article 15(1) of the Decreto-Lei provides that it enters into force 15 days after its publication.
Lei n.º 82/2021, de 30 de novembroText of Lei n.º 82/2021 as published in the Diário da República, Série I (Imprensa Nacional-Casa da Moeda)
In force since .Binds private bodies.
What this law does
Article 2 makes the Inspeção-Geral das Atividades Culturais (IGAC) the sectoral supervisory entity for copyright and related rights under the law and gives the inspector-general of cultural activities the power to determine the removal or blocking of access to protected content.
Article 3(1) requires the IGAC, when it identifies the unauthorized availability of protected content on a website or service, to notify the person responsible to stop it and remove the service or content within 48 hours. Article 3(4) requires the IGAC, once that period has run without the availability ending, to notify the network intermediary service providers to remove or block access to the content.
Article 5(1) obliges network intermediary service providers to comply, within 48 hours of notification, with the determinations of the inspector-general to remove or block access to protected content. Article 5(2) names the providers bound: mere-conduit and internet access providers, content-linking providers, and storage providers where the protected content is stored on their servers.
Article 5(4) also requires network intermediary service providers to inform the IGAC at once when they learn of manifestly unlawful activity through their services and to meet requests to identify recipients with whom they have storage agreements. Article 11(1) punishes a breach of Article 5(1), (2), (4) and (5) with a fine of EUR 5,000 to EUR 100,000.
Article 1(2) excludes the online content-sharing service providers defined in the Directive on copyright in the Digital Single Market, which are liable under Article 17 of that Directive and the legislation that transposes it. Article 13 provides that the law enters into force 60 days after its publication.
Article 2(1) makes the Polícia Judiciária (PJ) the competent authority to issue the removal or blocking decisions provided for in Article 3 of Regulation (EU) 2021/784 and to act on the decisions of other Member States under Article 4. Article 2(2) makes ANACOM the competent authority to supervise the specific measures under Article 5 of the Regulation and every obligation whose breach is an administrative offence, and to impose sanctions.
Article 3 requires the PJ to report each decision to the Public Prosecutor's Office, which must present it to an investigating judge for validation within 48 hours, and the decision lapses if it does not. Article 5(1)(a) and (b) make it an administrative offence (contraordenação) to fail to remove or block terrorist content within one hour of receiving a removal decision, and to fail to report the removal or blocking, with its date and hour.
Article 5(3) classifies the offences in points a), c), f), k), l), m) and n) of paragraph 1 as very serious administrative offences. Article 5(5) sets the fine for a very serious offence at EUR 8,000 to 20,500 for a natural person and up to EUR 5,000,500 for a large enterprise. Article 5(6) sets the maximum fine for a repeat of the offences in points a) and c) of paragraph 1 at 4 percent of the provider's worldwide turnover in the preceding financial year, if no higher limit applies.
Article 8 makes ANACOM the authority that opens and investigates these administrative proceedings, with its board of directors applying the fines. Article 17 provides that the decree-law enters into force 60 days after its publication.
Article 19-A of Decreto-Lei n.º 7/2004 requires providers of intermediary network services to inform the Ministério Público immediately on becoming aware of content made available through their services, or access to it, that may constitute a crime. The crimes that Article 19-A names are child pornography, discrimination and incitement to hatred and violence and, where the victim or a third party reports the conduct, intrusion into sexual or bodily privacy.
Article 19-B(1) requires those providers to block, within 48 hours, the sites identified as containing child pornography or related material and, on a request by the victim or a third party that helps indicate the unlawful conduct, the sites identified as containing intrusion into sexual or bodily privacy or related material.
The blocking must follow a transparent procedure with adequate safeguards, limit the restriction to what is necessary and proportionate, and tell users the reason for the restriction. Article 19-B(2) treats as identified every site on the lists that the competent national and international crime-prevention bodies draw up for that purpose. Article 19-B(3) has the bodies that draw up the lists communicate them to the providers and to the Procuradoria-Geral da República.
Article 19-B(4) lets the blocking be challenged before the competent judge under the general rules. Article 13-A lets the competent judicial or administrative authorities order the providers that supply intermediary services to a provider of information society services to give information and to act on illegal content, under Articles 4 and 3 of Lei n.º 12-A/2026 and Articles 10 and 9 of the Digital Services Regulation.
Failing to give the Article 19-A information or to block under Article 19-B(1) is an administrative offence punishable, where the failure is intentional, with a fine of EUR 5,000 to EUR 100,000, and, where it is negligent, with a fine of EUR 2,500 to EUR 50,000. Article 37(6) raises the upper and lower limits of the fine by one third when a legal person commits the infringement.
The central supervisory entity is the ICP - Autoridade Nacional de Comunicações (ICP-ANACOM), and the supervisory entities open and decide administrative offence proceedings. Articles 19-A and 19-B were added to the decree-law by Article 5 of Lei n.º 40/2020 from . Article 3 of Lei n.º 26/2023 amended both articles in their current wording from . Article 33 of Lei n.º 12-A/2026 added Article 13-A from .
Lei n.º 12-A/2026, de 15 de abrilText of Lei n.º 12-A/2026 as published in the Diário da República, Série I (Imprensa Nacional-Casa da Moeda)
In force since .Binds public and private bodies.
What this law does
Article 2 requires providers of intermediary services to comply, within the time the orders set, with the orders of the competent judicial authorities or administrative bodies to act on illegal content, to give information on specific individual recipients, and to supply lists of recipients or information on a group of unidentified recipients.
Article 5(1) designates the Autoridade Nacional de Comunicações (ANACOM) as the competent administrative authority and as the Digital Services Coordinator. Article 5(5) designates the Entidade Reguladora para a Comunicação Social (ERC) as the competent administrative authority for Article 14(3), Article 26(1) and (2) and Article 28(1) of the Regulation, and Article 5(6) designates the Comissão Nacional de Proteção de Dados (CNPD) for Article 26(3) and Article 28(2).
Article 6(1)(a) lets the Coordinator require providers of intermediary services, and other persons who may know of a suspected infringement, to provide information without undue delay and within the time fixed. Article 7(a) lets the Coordinator, once its other powers are exhausted, notify the management body of a provider in writing to analyze the situation, present an action plan, ensure its implementation and report on it.
Article 18(1)(e) and (f) make it an administrative offence to fail to designate a single point of contact or to fail to publish the information needed to identify and reach it. Article 20(2) sets the maximum fine for the offences it lists, including those in points e) to k) of Article 18(1), at 6 percent of a legal person's worldwide annual turnover in the preceding financial year, or 6 percent of a natural person's income in the preceding year.
Article 20(1) sets the maximum fine for the offences in points a) to d) and l) of Article 18(1), among others, at 1 percent of the same base. Article 28 lets the Coordinator impose a compulsory penalty payment of up to 5 percent of average daily worldwide turnover or income per day, for no more than 30 days. Article 35 repeals Articles 12 to 19 of Decreto-Lei n.º 7/2004 and Decreto-Lei n.º 20-B/2024. The Act took effect on .
Product and AI liability law1 instrument, 1 in force
Research summary (243 words)
Decreto-Lei n.º 383/89, de 6 de novembro, transposes Directive 85/374/EEC into Portuguese law. The Diário da República lists the Decree-Law as in force. Article 1 of the Decree-Law makes the producer liable, independently of fault, for damage caused by defects in the products it puts into circulation. Article 3(1) of the Decree-Law defines a product as any movable thing, even where incorporated in another movable or immovable thing.
Decreto-Lei n.º 131/2001, de 24 de abril, rewrote Articles 8 and 9 of the Decree-Law. The same Decree-Law of 2001 repealed paragraph 2 of Article 3 and paragraph 2 of Article 8. The preamble of the 1989 Decree-Law records that Portugal did not use the Directive's option to make producers liable for development risks. Directive (EU) 2024/2853 requires Member States to bring their transposing measures into force by .
The Directive repeals Directive 85/374/EEC with effect from but keeps it applying to products placed on the market or put into service before that date. No Portuguese act or bill transposing Directive (EU) 2024/2853 has been located, so Decreto-Lei n.º 383/89 is the only Portuguese product liability act identified.
No Portuguese statute written for the liability of AI systems or other automated agents has been located, and no statutory safe harbor that caps a software maker's liability has been located either. The Regime Jurídico da Cibersegurança (Decreto-Lei n.º 125/2025), which sets the Portuguese cybersecurity baseline, is recorded in the security topic.
Decreto-Lei n.º 383/89, de 6 de novembroConsolidated text of Decreto-Lei n.º 383/89 as amended by Decreto-Lei n.º 131/2001, published by the Procuradoria-Geral Distrital de Lisboa
In force.Binds private bodies.
What this law does
The Diário da República lists the Decree-Law as in force. Article 1 makes the producer liable, independently of fault, for damage caused by defects in the products it puts into circulation. Article 2(1) defines the producer as the manufacturer of the finished product, of a component or of a raw material, and anyone who presents itself as producer by putting its name, trade mark or another distinguishing sign on the product.
Article 2(2)(a) also treats as producer whoever, in the course of its commercial activity, imports products into the European Economic Community from outside it for sale, hire, leasing or another form of distribution. Article 2(2)(b) also treats as producer any supplier of a product whose Community producer or importer is not identified, unless within three months of written notice it tells the injured person in writing who the producer, the importer or a preceding supplier is.
Article 3(1) defines a product as any movable thing, even where incorporated in another movable or immovable thing. Article 202(1) of the Civil Code defines a thing as anything that can be the object of legal relations. Article 205(1) of the Civil Code treats as movable all things that are not immovable under Article 204.
Article 4(1) makes a product defective when it does not offer the safety that can legitimately be expected, taking all the circumstances into account, including its presentation, the use that can reasonably be made of it and the time it entered into circulation. Article 4(2) provides that a product is not defective merely because a more improved one is put into circulation afterwards. Article 5(a) frees the producer who proves that it did not put the product into circulation.
Article 5(b) frees the producer who proves that, in the circumstances, the defect can reasonably be taken not to have existed when the product entered into circulation. Article 5(c) frees the producer who proves that it did not make the product for sale or another form of distribution with an economic purpose, and did not produce or distribute it in the course of its professional activity.
Article 5(d) frees the producer who proves that the defect is due to the product's conformity with mandatory rules laid down by public authorities. Article 5(e) frees the producer who proves that the state of scientific and technical knowledge, when it put the product into circulation, did not allow the defect to be detected.
Article 5(f) frees the manufacturer of a component who proves that the defect is attributable to the design of the product in which it was incorporated or to the instructions given by that product's manufacturer. Article 6(1) makes several persons responsible for the same damage jointly liable. Article 7(1) lets the court reduce or exclude compensation where a culpable act of the injured person contributed to the damage.
Article 7(2) provides that, without prejudice to paragraphs 2 and 3 of Article 6, the producer's liability is not reduced where the intervention of a third party contributed to the damage. Article 8 makes compensable the damage resulting from death or personal injury and the damage to a thing other than the defective product, if the thing is normally intended for private use or consumption and the injured person used it mainly that way.
Article 9 makes damage to things compensable only to the extent that it exceeds EUR 500. Article 10 provides that liability to the injured person cannot be excluded or limited, and that stipulations to the contrary are treated as unwritten. Article 11 sets a limitation period of three years from the day the injured person knew, or should have known, of the damage, the defect and the identity of the producer.
Article 12 extinguishes the right to compensation ten years after the producer put the damaging product into circulation, unless an action brought by the injured person is pending. Article 13 leaves liability under other legal provisions untouched. Article 14 excludes damage from nuclear accidents governed by international conventions in force for the Portuguese State. Article 15 excludes damage caused by products put into circulation before the Decree-Law entered into force.
Decreto-Lei n.º 131/2001 rewrote Articles 8 and 9 of the Decree-Law. The same Decree-Law of 2001 repealed paragraph 2 of Article 3 and paragraph 2 of Article 8. The preamble of the 1989 Decree-Law records that Portugal did not use the Directive's option to make producers liable for development risks.
Portugal has no dedicated adult-content age-verification statute, social-media minor-access restriction, or app-store age-verification requirement on the books as of the date below.
Its principal age-related duty is a design-code style obligation on a video-sharing platform provider: Lei n.º 27/2007, de 30 de julho (Lei da Televisão e dos Serviços Audiovisuais a Pedido), as amended by Lei n.º 74/2020, de 19 de novembro, which transposed the EU Audiovisual Media Services Directive (2018/1808), requires the provider to create and manage a system to verify the age of the platform's users and audience, among other measures to protect children and young people from content that could harm their physical, mental, or moral development.
Breach of that duty is punishable by an administrative fine (coima) of 75,000 to 375,000 euros, and the ERC (Entidade Reguladora para a Comunicação Social) assesses the adequacy and effectiveness of the measures a provider adopts.
Lei n.º 27/2007 de 30 de julho (Lei da Televisão e dos Serviços Audiovisuais a Pedido), art. 69.º-C, alínea e), added by Lei n.º 74/2020, de 19 de novembro, art. 3.ºDiário da República Eletrónico
In force since .Binds private bodies.
What this law does
A video-sharing platform provider must, among other adequate measures, create and manage systems to verify the age of the platform's users and audience, contributing to the protection of children and young people from content that could harm their physical, mental, or moral development, under Article 69.º-C, alínea e), of the Lei da Televisão e dos Serviços Audiovisuais a Pedido.
The same article requires a parental-control system under the end user's own control, and a transparent, easy-to-use, and effective complaint-handling procedure. Breach of Article 69.º-C is punishable by an administrative fine (coima) of 75,000 to 375,000 euros under Article 77.º(1) of the same Act. The ERC (Entidade Reguladora para a Comunicação Social) assesses the adequacy and effectiveness of the measures a provider adopts, under Article 69.º-D.
Portugal created a press-publisher neighbouring right and adopted the EU's text-and-data-mining exception through Decreto-Lei n.º 47/2023, de 19 de junho, its transposition of the EU Digital Single Market Copyright Directive (2019/790).
CDADC Article 188.º-A gives a press publisher established in an EU member state the exclusive right to authorize online reproduction, communication to the public, or making available of its press publications, excluding private non-commercial use by individuals, hyperlinking, and the use of isolated terms or very short extracts; the right lapses two years after first publication and does not reach a publication first published before .
CDADC Article 75.º(2)(w) permits text and data mining of a legally accessible work unless the rights holder has expressly reserved that use in an adequate manner, in particular by optical reading of content made available online, and Article 75.º(2)(v) separately permits a research organization or cultural-heritage institution to mine for scientific research.
No compelled platform-to-publisher bargaining regime comparable to Australia's News Media Bargaining Code or Canada's Online News Act, and no hot-news or misappropriation doctrine distinct from the CDADC's own copyright and unfair-competition provisions, is identified.
A press publisher established in an EU member state holds the exclusive right to authorize, itself or through its representatives, an information-society service provider's reproduction, communication to the public, or making available of the whole or part of its press publications online, per CDADC Article 188.º-A(1).
That right does not reach a private, non-commercial use by an individual, the establishment of a hyperlink, or the use of isolated terms or very short extracts of a press publication, per Article 188.º-A(2). The right lapses two years after the press publication's first publication, per Article 183.º(6), and does not apply to a press publication first published before , per the decree's own Article 14.º.
Information-society service providers must give press publishers, or the collective management bodies that represent them, relevant and reliable information on their users' uses of the publishers' press publications, to the extent reasonable, necessary and proportionate, per Article 188.º-B(3).
Disputes between press publishers and information-society service providers over the right are subject to necessary arbitration where the publisher expressly opts to submit them to the arbitration centre referred to in Article 8.º of the decree, per Article 188.º-A(8).
CDADC art. 75.º(2)(v)-(w) Text and Data Mining Opt-Out for News Aggregation, as amended by Decreto-Lei n.º 47/2023, de 19 de junho, art. 3.ºDiário da República Eletrónico, dre.pt, official ELI text of Decreto-Lei n.º 47/2023
In force since .Binds public and private bodies.
What this law does
Reproducing a legally accessible protected work, including a press publication, for text and data mining is a permitted exception under CDADC Article 75.º(2)(w), unless the rights holder has expressly reserved that use in an adequate manner, in particular by optical reading of content made available to the public online.
A separate exception in Article 75.º(2)(v), which the reservation does not limit, covers a research organization or a cultural-heritage institution carrying out text and data mining on legally accessible works for scientific research, without the opt-out that limits the general exception.
No current case law for Portugal cybersecurity law
No current case law for Portugal communications law
No current case law for Portugal content moderation law
No current case law for Portugal product and AI liability law
No current case law for Portugal digital accessibility law
No current case law for Portugal age gating law
No current case law for Portugal reuse law
Reporting clocks that run here21 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Portugal comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Submit an initial notification without undue delay and within 24 hours of concluding that a significant incident exists or may exist, and, where necessary, update it within 72 hours with an initial assessment of the incident's severity and impact; if the incident resolves within two hours of detection, submit only the end-of-impact notification below.
Submit a notification that the incident's significant impact has ended, without undue delay and within 24 hours of that impact ending.
Submit a final report within 30 working days of your end-of-impact notification, describing the incident, its impact, the mitigating measures you took and any residual impact still present, and submit an interim report if the competent authority asks for one; if the incident is still ongoing when the final report falls due, submit that interim report at the authority's request every week until you submit the final report (Article 44(1) and (3)).
Notify the CNPD without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Portugal, unless the breach is unlikely to risk their rights and freedoms.
If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
The law of the European Union, which applies in Portugal
Share relevant information related to a reportable cyber-attack with your computer security incident response teams (CSIRTs) and your competent authority without undue delay and no later than four hours of becoming aware that the incident is reportable; a cyber-attack is reportable when you assess its criticality as ranging from high to critical on the classification scale methodology under Article 37(8) (Article 38(3) and (4)).
Provide your computer security incident response teams (CSIRTs) without undue delay with any information related to a reportable cyber threat that may have a cross-border effect (Article 38(6)).
Report a major ICT-related incident to the competent authority your sector's Union law designates under Article 46, the European Central Bank through your national supervisor if you are a credit institution classified as significant, using the templates referred to in Article 20, and submit an initial notification as early as possible and in any case within four hours of classifying the incident as major, and no later than 24 hours from becoming aware of it.
Where classification as major comes later than that, submit the initial notification within four hours of the classification instead.
Submit an intermediate report within 72 hours of the initial notification, and submit an updated intermediate report without undue delay and in any case when you have recovered regular activities.
Submit a final report no later than one month after the intermediate report, or your latest updated one, once you know the root cause and the actual impact figures.
If you cannot meet one of those deadlines, tell the competent authority without undue delay and before the deadline lapses, explaining why. A deadline falling on a weekend or bank holiday moves to noon of the next working day, unless you are a credit institution, a central counterparty, a trading venue operator, or an entity your Member State has designated essential or important under the NIS2 Directive, none of which get that extension for an initial notification or intermediate report.
Your competent authority may also decide, and notify you, that the extension does not apply to you if you are a financial entity that is significant or has a systemic character for the financial sector at national or Union level.
Notifying a significant cyber threat under Article 19(2) is voluntary, only where you judge it relevant to the financial system, service users, or your clients. Where a major ICT-related incident affects your clients' financial interests, tell them without undue delay as soon as you become aware of it, describing the incident and the mitigation measures you took, and, for a significant cyber threat, tell a potentially affected client of protection measures it could take, where applicable.
If you provide a publicly available electronic communications service, notify every personal data breach to the competent national authority (Article 2(1)), no later than 24 hours after its detection, where feasible, with the information set out in Annex I; detection is deemed to have taken place when you have acquired sufficient awareness that a security incident has occurred that led to personal data being compromised (Article 2(2)).
Where all the information in Annex I is not available and further investigation is required, you may make an initial notification no later than 24 hours after detection containing the information in Section 1 of Annex I, and you must then make a second notification as soon as possible and at the latest within three days following the initial notification, containing the information in Section 2 of Annex I (Article 2(3)).
If you cannot provide all the information within the three-day period, notify as much as you have within it, submit to the competent national authority a reasoned justification for the late notification of the remaining information, and notify the remaining information as soon as possible (Article 2(3)).
Notify the subscriber or individual without undue delay after detection of the breach, whether or not you have yet notified the competent national authority (Article 3(3)).
If you have a direct contractual relationship with the end user and, despite reasonable efforts, cannot identify within the timeframe all the individuals likely to be adversely affected, you may notify them through advertisements in major national or regional media in the relevant Member States within that timeframe, containing the Annex II information where necessary in a condensed form, and you must continue all reasonable efforts to identify and notify them as soon as possible (Article 3(7)).
If you are contracted to deliver part of the electronic communications service without a direct contractual relationship with subscribers, immediately inform the contracting provider in the case of a personal data breach (Article 5).
Notify the computer security incident response team (CSIRT) designated as coordinator for your main establishment and ENISA, through the single reporting platform, of any actively exploited vulnerability you become aware of in your product: an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure becomes available, the notification and the final report each unless the relevant information has already been provided.
Notify the same recipients of any severe incident affecting the security of your product on the same 24-hour early warning and 72-hour incident notification clock, followed by a final report within one month of the incident notification; the incident notification and the final report each apply unless the relevant information has already been provided. For either an exploited vulnerability or a severe incident, give the computer security incident response team (CSIRT) an intermediate report on relevant status updates if it asks for one.
Make each notification without undue delay and in any case no later than 24 hours after you become aware of the security breach or disruption (Article 19a(1), point (b)).
Notify your computer security incident response team (CSIRT), or the competent authority where applicable, of any incident with a significant impact on the provision of your services: an early warning within 24 hours of becoming aware, an incident notification within 72 hours of becoming aware (24 hours if you are a trust service provider), an intermediate report on relevant status updates if your CSIRT or competent authority asks for one, and a final report no later than one month after the incident notification, or, for an incident still ongoing at that point, a progress report then and a final report within one month of its handling.
Where appropriate, notify, without undue delay, the recipients of your services who a significant incident is likely to adversely affect, and communicate to recipients potentially affected by a significant cyber threat any measures or remedies they can take.
If you are a law enforcement deployer using a high-risk AI system for post-remote biometric identification in a targeted search for a suspected or convicted person, request authorisation from a judicial authority or a binding, judicially reviewable administrative authority, in advance or without undue delay and no later than 48 hours, unless you are using the system only for the initial identification of a potential suspect on objective and verifiable facts directly linked to the offence.
Report a serious incident not later than 15 days after you become aware of it, or immediately once you establish a causal link between your AI system and the incident, or the reasonable likelihood of one, whichever is sooner.
Report immediately, and not later than 2 days after becoming aware of it, a widespread infringement or a serious incident causing a serious and irreversible disruption to the management or operation of critical infrastructure.
Report a serious incident involving the death of a person not later than 10 days after becoming aware of it, and immediately once you establish, or suspect, a causal link between your AI system and the incident.
If you are a deployer of a high-risk AI system and identify a serious incident, Article 26(5) requires you to immediately inform first the provider, then the importer or distributor, and the relevant market surveillance authority; if you cannot reach the provider, report the incident yourself under the same rules that bind a provider. This does not require you to disclose sensitive operational data if you are a law enforcement authority.
After reporting a serious incident, without delay investigate it, including a risk assessment and corrective action, and cooperate with the competent authorities; do not alter the AI system in a way that could affect the investigation before telling the authorities.
Let a subject, or the subject's legally designated representative, withdraw from the testing at any time by revoking informed consent, without detriment and without having to provide any justification, and on request delete the subject's personal data immediately and permanently; the withdrawal does not affect the activities already carried out (Article 60(5)).
Report any serious incident identified in the course of the testing to the national market surveillance authority in accordance with Article 73, which requires the report immediately after a causal link, or the reasonable likelihood of one, is established and in any event not later than 15 days after you become aware of the incident, not later than two days for a widespread infringement or a serious and irreversible disruption of the management or operation of critical infrastructure, and not later than 10 days after you become aware of it where a person has died (Article 60(7)).
Submit a notification as soon as you know of the condition, and a report as soon as possible and not exceeding 72 hours from the time you know of it unless exceptional circumstances prevent this, in the form your competent authority defines (point IS.D.OR.230(c), points (1) and (2)).
Submit a notification as soon as you know of the condition, and a report as soon as possible and not exceeding 72 hours from the time you know of it unless exceptional circumstances prevent this, in the form your competent authority defines (point IS.I.OR.230(c), points (1) and (2)).
Make the report immediately after you have established a causal link between the EHR system and the serious incident or the reasonable likelihood of such a link and, in any event, not later than three days after you become aware of the serious incident (Article 44(7)).
Where the system presents a risk to the health or safety, or to fundamental rights, of persons within the meaning of Article 79(1) and you become aware of that risk, immediately investigate the causes, in collaboration with the reporting deployer where applicable, and inform the market surveillance authorities competent for the system and, where applicable, the notified body that issued its certificate under Article 44, in particular of the nature of the non-compliance and of any relevant corrective action taken.
Terminate the mandate if you consider or have reason to consider that the provider is acting contrary to its obligations under the Regulation, and immediately inform the relevant market surveillance authority and, where applicable, the relevant notified body of the termination and the reasons for it (Article 22(4)).
Where such a system presents a risk within the meaning of Article 79(1), immediately inform the provider or importer and the authorities competent for the system, giving details, in particular, of the non-compliance and of any corrective actions taken (Article 24(4)).
Where you have reason to consider that using the system per its instructions may present a risk to health, safety or fundamental rights, inform the provider or distributor and the relevant market surveillance authority without undue delay, and suspend use of the system.
Where you have identified a serious incident, immediately inform first the provider, then the importer or distributor and the relevant market surveillance authorities; if you cannot reach the provider, report the incident yourself as Article 73 requires of a provider.
Keep track of, document, and report to the AI Office, and as appropriate to national competent authorities, without undue delay, relevant information about serious incidents involving your model and any corrective measures you have taken or plan to take. The Regulation states no fixed number of days for this report and no explicit moment its clock starts from, only that it must be made without undue delay.
If you provide a publicly available electronic communications service and a personal data breach occurs, notify the breach to the competent national authority without undue delay (Article 4(3)).
Where the breach is likely to adversely affect the personal data or privacy of a subscriber or individual, also notify that subscriber or individual of the breach without undue delay (Article 4(3)).
Transmit the report to the certification body or the national cybersecurity certification authority, in accordance with Article 56(8) of Regulation (EU) 2019/881, without undue delay (Article 35(4)).
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
