Portugal

PT schema gdpri-v2 trajectory: not yet assessedregulated (omnibus)overlaps: AIC

Last updated 2026-09-28 · 10 categories · 30 claims · 17 sources in the cumulative register

10Categoriesbaseline.[]

57Sub-modulesbaseline..sub_modules{}

30Claimsbaseline..claims[]

2Tier-1 sourcesrun_metadata.t1_source_count

Traffic-light mix (sums to 10 rendered categories; click to filter)

Jurisdiction brief

Latest update · 28 September 2026

Lead Signal

Portugal's data-protection enforcement posture this cycle shows a pronounced gap between caseload volume and sanctioning output. The CNPD, the country's single national supervisory authority established under Law 43/2004 and operating under Law 58/2019 (the national GDPR-implementing act), opened 3,201 cases and conducted 2,037 investigations across 2025, yet applied only two fines totalling EUR 47,000 for the full year. That disproportion between intake and output is the defining enforcement-and-redress signal for Portugal this cycle, and it sits alongside a pending legislative proposal, reported as of mid-2026, to accelerate CNPD sanctioning proceedings through a new contraordenational regime.

The caseload-versus-sanctioning gap is not presented as evidence of leniency toward any particular sector; rather it reflects what appears to be a structural capacity constraint at the regulator, a reading consistent with the pending reform proposal aimed specifically at speeding up sanctioning procedures.

Other Developments

Constitutional Court confirmation of the Lisbon fine. The Portuguese Constitutional Court confirmed the CNPD's EUR 1.25 million fine against the Municipality of Lisbon for GDPR violations related to data transfers. This judicial confirmation reinforces the CNPD's fining criteria under Law 58/2019, which layer considerations of the offending entity's economic situation and turnover, the continuous nature of the infringement, and entity size or number of employees atop the GDPR's own statutory fine ceilings.

The INE census fine remains contested. Separately, the CNPD's December 2022 fine of EUR 4.3 million against Portugal's national statistics institute (INE), imposed for five GDPR infringements tied to the 2021 Census including an unlawful transfer of personal data to US-based servers without adequate safeguards, remains under an undecided court challenge as of mid-2026. The historic case illustrates that even the CNPD's largest enforcement actions can remain in litigation for years, a pattern relevant to reading the durability of any single enforcement figure.

A capacity-acceleration reform is pending, not enacted. The reported legislative proposal to speed CNPD sanctioning proceedings has not been independently corroborated against a primary CNPD or parliamentary source this cycle, and its passage, timing, and final scope remain open questions.

Cross-Monitor Connections

The INE case's unlawful cross-border transfer of personal data to US-based servers is a fact with intersecting relevance for the financial-integrity monitor's cross-border data-flow lens and for the crypto monitor's cross-border-transfer module, insofar as both track how Portuguese entities move data and value across borders under evolving compliance regimes; readers tracking those monitors' Portugal pages may find the INE precedent a useful frame for assessing transfer-adequacy risk generally, though this brief does not extend into either monitor's substantive analysis.

Outlook

The key variable for Portugal's enforcement trajectory is whether the pending contraordenational reform is enacted and, if so, whether it measurably closes the gap between the CNPD's caseload and its sanctioning output. Absent that reform, or absent a resolution of the INE litigation, Portugal's enforcement posture is likely to remain a watch item relative to more sanction-active EU peer regulators. The next cycle should prioritise direct retrieval from CNPD's own primary sources, which were not obtained this cycle, to corroborate the reform proposal's status and the INE case's procedural posture.

2 earlier updates not shown here.

Standing brief · as of 4 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

The Portuguese Constitutional Court has confirmed the CNPD's €1.25 million fine against the Municipality of Lisbon, upholding findings that the municipality unlawfully processed protesters' sensitive personal data and transferred it to the Russian Embassy. The confirmation extends a multi-year CNPD enforcement escalation that began with a €400,000 fine against Hospital do Barreiro in 2018, Portugal's first GDPR sanction, for deficient health-data access controls and security measures. That escalation continued through a €4.3 million fine against the national statistics institute INE, where the CNPD found the agency's 2021 Census data protection impact assessment insufficient, breaching GDPR Article 35. The CNPD is also understood to have fined the Municipality of Setúbal €170,000 in 2022 for data protection violations. Judicial confirmation of the Lisbon fine strengthens the CNPD's fining authority going forward.

Other Developments

The CNPD remains Portugal's sole data protection authority, carrying a general duty to supervise and monitor compliance with data protection law with strict respect for the Constitution of the Portuguese Republic. CNPD Decision No. 494/2019 continues to disapply certain provisions of the GDPR Implementation Law that the regulator regards as GDPR-inconsistent, including Article 28(3)(a) on employee consent. Portugal's digital age of consent remains set at 13 years old, the lower permissible bound of the GDPR Article 8 range. In the INE case, the CNPD used its Article 58(2)(j) emergency corrective powers to order the suspension within 12 hours of all data flows to the United States and other inadequate third countries. INE had contractually authorised transfer of data to the United States under standard contractual clauses without adopting supplementary measures. Decree-Law 125/2025 is understood to transpose the NIS2 Directive, expanding cybersecurity obligations on public and private entities. Bill 398/XVII/1, which is understood to set age limits and require parental consent for children online, remains pending before the legislature. The GDPR Implementation Law authorises fines of up to €20 million or 4% of total worldwide annual turnover for very serious offences by large companies.

Cross-Monitor Connections

Portugal's National AI Agenda and the CNPD's RLPD biometrics and AI working groups intersect with AI-Act-adjacent governance. Framing specific to the EU AI Act itself is routed to the artificial-intelligence monitor, while this monitor retains the Article 22 profiling and automated-decision-making transparency angle.

Outlook

The CNPD's enforcement trajectory across health, statistical, municipal and now judicially-tested cases points toward a regulator willing to use emergency corrective powers and pursue multi-million-euro penalties. Cross-border transfer scrutiny and children's-data legislation, including the still-pending Bill 398/XVII/1, are likely to remain focal points going forward. Several sectoral overlays, including financial services, credit scoring, education and insurance, together with regulator capacity and collective-redress mechanisms, remain unevidenced in Portugal and represent monitoring gaps rather than confirmed regulatory absences.

trust tier: ai_unverified

Latest update · 25 August 2026

Regulatory Status

Portugal's data-protection posture this cycle is defined by escalating CNPD enforcement, a materially extended DPIA prior-consultation procedure, a hardening cross-border-transfer compliance requirement following the 2010-form SCC phase-out, and a newly designated AI Act market-surveillance role at ANACOM operating alongside CNPD. Confirmed enforcement actions include a EUR 1.25 million fine against the Municipality of Lisbon, upheld by the Constitutional Court, and a EUR 4.3 million fine against the national statistics institute INE, partly grounded in an inadequate US transfer mechanism. Draft children's-online-protection legislation (Bill 398 XVII/1) and a rising role for collective-redress litigation round out a cycle whose common thread is enforcement breadth across multiple adjacent regimes rather than change concentrated in a single module.

Outlook

The 2 August 2026 AI Act high-risk-system deadline is the nearest firm date on Portugal's horizon. Primary-source confirmation of this cycle's two headline fines, and clarification of Draft Bill 398 XVII/1's legislative status, are the items most likely to move this jurisdiction's rating next cycle.

Standing brief · as of 4 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Regulatory Status

Portugal's data protection framework rests on the GDPR and Law No. 58/2019, which are fully applicable in Portugal. The CNPD, Portugal's sole data protection authority, carries a general duty to supervise and monitor compliance with data protection law, with strict respect for the Constitution of the Portuguese Republic. CNPD Decision No. 494/2019 continues to disapply certain provisions of the national implementation law it regards as GDPR-inconsistent. Portugal's digital age of consent is set at 13 years old. The CNPD has fined controllers €20,000 plus two further €2,000 penalties for right-of-access and Article 13 violations. The CNPD found INE's 2021 Census data protection impact assessment insufficient, breaching GDPR Article 35, as part of a €4.3 million fine. Using its Article 58(2)(j) corrective powers, the CNPD ordered INE to suspend within 12 hours all data flows to the United States and other inadequate third countries. In the same case, INE had contractually authorised transfer of data to the United States under standard contractual clauses without adopting supplementary measures. Decree-Law 125/2025 is understood to transpose the NIS2 Directive, expanding cybersecurity obligations. The EDPB is understood to have launched a 2026 Coordinated Enforcement Framework on transparency obligations involving the CNPD. Portugal's National AI Agenda is understood to focus on infrastructure, innovation, talent and ethics. Bill 398/XVII/1, which is understood to set age limits and require parental consent for children online, remains pending before the legislature. The Portuguese Constitutional Court has confirmed the CNPD's €1.25 million fine against the Municipality of Lisbon for processing protesters' sensitive data and transferring it to the Russian Embassy. The GDPR Implementation Law authorises fines of up to €20 million or 4% of total worldwide annual turnover for very serious offences.

Outlook

Portugal presents an elevated and tightening risk profile, with a judicially-affirmed enforcement record, active cross-border-transfer scrutiny, and pending children's-data legislation likely to shape the CNPD's agenda over the coming cycles, while financial-sector, education, insurance and collective-redress overlays remain open research gaps.

10 of 10 categories

Signal

Density

Selections OR within a group, AND across groups. Press / to search.

#

Fully GDPR-aligned; sole national DPA identified with statutory basis and active enforcement record.

Primary frameworkRegulation (EU) 2016/679 (GDPR) as implemented by Law No. 58/2019

Supervisory authorityComissão Nacional de Proteção de Dados (CNPD)

Traffic-light rationale — GreenFully GDPR-aligned; sole national DPA identified with statutory basis and active enforcement record.

Sub-modules (5)

Regulator And AuthorityGreen

CNPD is confirmed as the national supervisory authority with a constitutional and statutory mandate to supervise data protection compliance.

Claims (1):

The CNPD's general duty is to supervise and monitor compliance with data protection law with strict respect for the Constitution of the Portuguese Republic.

Act And InstrumentsGreen

GDPR and Law No. 58/2019 are both fully applicable; CNPD has disapplied conflicting national provisions.

Claims (2):

Both the GDPR and Law No. 58/2019 (the GDPR Implementation Law) are fully applicable in Portugal.
In September 2019 the CNPD approved Decision No. 494/2019, disapplying certain articles of the GDPR Implementation Law (including Art 28(3) on employee consent, Art 39(1) on fine determination, and Art 20(1) on right to information) to preserve GDPR primacy.

Material ScopeGreen

Material scope covers all processing activity carried out in Portugal irrespective of controller's public/private nature.

Claims (1):

The scope of the GDPR Implementation Law encompasses all processing activity carried out in Portugal, regardless of the private or public nature of the controller, including processing for legal-obligation compliance or public-interest missions.

Territorial ScopeAmber

No Portugal-specific derogation from GDPR Art 3 territorial scope was identified in research; general GDPR extraterritorial rules apply.

Absence provenance: unavailable. Searched: Portugal GDPR territorial scope derogation Article 3.

Regulator Registration And FilingAmber

No general controller registration/filing regime found (GDPR abolished blanket notification); sector rules (e.g. video surveillance) impose specific restrictions rather than a filing obligation.

Claims (1):

Video surveillance is restricted to protection of people and assets; cameras may not target public roads, client/worker-reserved interior areas, or capture ATM keypads.

Category narrative59 words

Portugal operates a GDPR-aligned omnibus regime. The CNPD (Comissão Nacional de Proteção de Dados) is the sole national supervisory authority, and Law No. 58/2019 (the GDPR Implementation Law) sits alongside the directly-applicable GDPR. The CNPD has, via Decision 494/2019, disapplied several provisions of the national law it considers contrary to GDPR, giving the Regulation practical primacy in supervisory practice.

no periodic updates on record for this sub-brief

Sources and claims (5)

ConfirmedDataGuidance — The CNPD's general duty is to supervise and monitor compliance with data protection law with strict respect for the Constitution of the Portuguese Republic.observed 2026-08-04
ConfirmedDataGuidance — Both the GDPR and Law No. 58/2019 (the GDPR Implementation Law) are fully applicable in Portugal.observed 2026-08-04
ConfirmedDataGuidance — In September 2019 the CNPD approved Decision No. 494/2019, disapplying certain articles of the GDPR Implementation Law (including Art 28(3) on employee consent, Art 39(1) on fine determination, and Art 20(1) on right to information) to preserve GDPR primacy.observed 2026-08-04
ConfirmedIAPP — The scope of the GDPR Implementation Law encompasses all processing activity carried out in Portugal, regardless of the private or public nature of the controller, including processing for legal-obligation compliance or public-interest missions.observed 2026-08-04
ConfirmedIAPP — Video surveillance is restricted to protection of people and assets; cameras may not target public roads, client/worker-reserved interior areas, or capture ATM keypads.observed 2026-08-04

#

GDPR bases apply directly; national elaborations exist for consent age and health/genetic data with active CNPD oversight.

Primary frameworkGDPR Arts 6-9; Law No. 58/2019

Supervisory authorityComissão Nacional de Proteção de Dados (CNPD)

Traffic-light rationale — GreenGDPR bases apply directly; national elaborations exist for consent age and health/genetic data with active CNPD oversight.

Sub-modules (4)

Lawful BasesGreen

GDPR Art 6 bases apply; CNPD disapplied Law 58/2019 Art 28(3) on employee consent as GDPR-inconsistent.

Claims (1):

CNPD Decision 494/2019 disapplies Article 28(3) of the GDPR Implementation Law concerning employee consent to data processing as inconsistent with GDPR.

Special CategoriesAmber

Law 58/2019 Art 29 imposes a data-subject notification duty whenever health or genetic data is accessed, going further than GDPR baseline and drawing CNPD/legal-commentary scrutiny.

Claims (1):

Article 29 of the GDPR Implementation Law requires data controllers to notify data subjects whenever their health or genetic data is accessed, including access by occupational-medicine personnel.

Pseudonymisation And AnonymisationAmber

No Portugal-specific pseudonymisation/anonymisation safe-harbour beyond GDPR Recitals/Art 4(5) was identified.

Absence provenance: unavailable. Searched: Portugal CNPD pseudonymisation anonymisation guidance.

Category narrative28 words

Lawful processing follows GDPR Art 6 with Portugal-specific elaborations on consent age and special-category (health/genetic) data, some of which the CNPD itself has disapplied where conflicting with GDPR.

no periodic updates on record for this sub-brief

Sources and claims (4)

ConfirmedDataGuidance — CNPD Decision 494/2019 disapplies Article 28(3) of the GDPR Implementation Law concerning employee consent to data processing as inconsistent with GDPR.observed 2026-08-04
ConfirmedIAPP — The age of digital consent in Portugal is 13 years old; processing personal data of a child under 13 is only lawful if a representative has consented through a means of secure authentication.observed 2026-08-04
ConfirmedEUR-Lex — GDPR Article 8 permits Member States to set the digital consent age between 13 and 16; Portugal has adopted the lower permissible bound of 13.observed 2026-08-04
ProbableDataGuidance — Article 29 of the GDPR Implementation Law requires data controllers to notify data subjects whenever their health or genetic data is accessed, including access by occupational-medicine personnel.observed 2026-08-04

#

Core GDPR rights operative with documented enforcement; some national qualifications on erasure/access timing.

Primary frameworkGDPR Arts 12-22; Law No. 58/2019

Supervisory authorityComissão Nacional de Proteção de Dados (CNPD)

Traffic-light rationale — GreenCore GDPR rights operative with documented enforcement; some national qualifications on erasure/access timing.

Sub-modules (5)

Access RightGreen

CNPD has fined controllers (e.g., Hospital do Barreiro, €20,000 in 2019) for noncompliance with the right of access.

Claims (1):

In 2019 the CNPD applied a fine of €20,000 for noncompliance with a data subject's right of access, alongside two €2,000 fines for GDPR Article 13 violations.

Rectification And ErasureAmber

The right to be forgotten under Portuguese law can only be exercised once the applicable retention period has elapsed.

Claims (1):

Under the GDPR Implementation Law, the right to be forgotten can only be exercised at the end of the applicable retention period.

Restriction And ObjectionAmber

Information/access rights under GDPR Arts 13-15 cannot be exercised where a statutory secrecy duty opposable to the data subject applies.

Claims (1):

The rights to information and access under GDPR Articles 13-15 cannot be exercised where the controller or processor is subject to a secrecy duty opposable to the data subject.

Data PortabilityAmber

No Portugal-specific derogation from GDPR Art 20 portability was identified.

Absence provenance: unavailable. Searched: Portugal data portability derogation Lei 58/2019.

Deadlines And Response WindowsAmber

No Portugal-specific deviation from the GDPR one-month (extendable) response window was identified in research.

Absence provenance: unavailable. Searched: Portugal CNPD statutory response deadline data subject request.

Category narrative40 words

Data subject rights follow the GDPR framework, with Portugal-specific limits: secrecy-duty exceptions to information/access rights, and a right-to-erasure that only becomes exercisable at the end of the applicable statutory retention period. Enforcement history shows the CNPD actively sanctioning access-right violations.

no periodic updates on record for this sub-brief

Sources and claims (3)

ConfirmedIAPP — In 2019 the CNPD applied a fine of €20,000 for noncompliance with a data subject's right of access, alongside two €2,000 fines for GDPR Article 13 violations.observed 2026-08-04
ProbableIAPP — Under the GDPR Implementation Law, the right to be forgotten can only be exercised at the end of the applicable retention period.observed 2026-08-04
ProbableIAPP — The rights to information and access under GDPR Articles 13-15 cannot be exercised where the controller or processor is subject to a secrecy duty opposable to the data subject.observed 2026-08-04

#

Strong enforcement record on DPIA/security failures evidences an operative, active accountability regime; ROPA and joint-controller specifics not independently confirmed.

Primary frameworkGDPR Arts 24-39; Law No. 58/2019

Supervisory authorityComissão Nacional de Proteção de Dados (CNPD)

Traffic-light rationale — GreenStrong enforcement record on DPIA/security failures evidences an operative, active accountability regime; ROPA and joint-controller specifics not independently confirmed.

Sub-modules (7)

Accountability And DpiaGreen

CNPD fined the National Statistics Institute (INE) €4.3M in part for lack of a valid DPIA covering the 2021 Census.

Claims (1):

The CNPD found the INE's DPIA for the 2021 Census 'limited in scope, and insufficient in relation to the data processing', breaching GDPR Art 35(1)-(3)(b), as part of a €4.3 million fine.

Dpo RequirementsAmber

DPOs must be appointed on professional qualities/specialised knowledge and exercise functions with technical autonomy; CNPD has criticised national-law-added DPO functions as inconsistent with GDPR.

Claims (1):

The DPO must be appointed based on professional qualities and specialised knowledge of data protection law and practice, and exercises the function with technical autonomy; the CNPD has noted that additional statutory DPO functions beyond GDPR constitute a violation of the Regulation.

Ropa RequirementsAmber

No Portugal-specific ROPA elaboration beyond GDPR Art 30 was identified.

Absence provenance: unavailable. Searched: Portugal CNPD records of processing activities guidance.

Joint Controller ArrangementsAmber

No Portugal-specific joint-controller guidance beyond GDPR Art 26 was identified in research.

Absence provenance: unavailable. Searched: Portugal CNPD joint controller guidance.

Security MeasuresGreen

CNPD's first GDPR fine (Hospital do Barreiro, €400,000/€100,000 component under Art 32) targeted deficient technical and organisational security measures for health data access.

Claims (1):

The CNPD fined Hospital do Barreiro €100,000 under GDPR Article 32(1)(b) for failing to ensure confidentiality, integrity, availability and resilience of processing systems, including a lack of regular security testing.

Breach NotificationAmber

General GDPR Arts 33-34 breach-notification timelines apply; no Portugal-specific deviation identified. CNPD has used Art 58(2)(j) corrective powers (data-flow suspension) in lieu of/alongside breach process in the INE case.

Claims (1):

Using Article 58(2)(j) GDPR corrective powers, the CNPD ordered the INE to suspend, within 12 hours, all data flows to the US and any other third country lacking an adequate level of protection.

Retention And DisposalGreen

Retention is governed by sector-specific statutory periods or, absent one, by the period necessary for the processing purpose; social-security contribution data for retirement purposes may be retained indefinitely subject to adequate safeguards.

Claims (1):

Personal data relating to social security contributions for retirement purposes may be retained indefinitely, provided adequate technical and organisational measures guarantee data subject rights.

Category narrative43 words

Controller/processor duties track GDPR Arts 24-39. Enforcement history (INE Census 2021, Hospital do Barreiro) shows the CNPD actively pursuing DPIA, security-measures, and accountability failures. DPO appointment rules broadly track GDPR but the CNPD has criticized national-law additions to DPO functions as ultra vires.

Periodic update · new data 2026-09-21

Controller/Processor Duties

The CNPD's prior-consultation requirement for data protection impact assessments carries meaningful practical timeline exposure for controllers operating in Portugal. Where a DPIA concludes that residual risk to data subjects cannot be adequately mitigated, controllers are understood to be required to consult the CNPD before commencing the processing activity in question. This consultation process can extend to eight weeks, with a possible further six-week extension in complex cases, meaning organisations planning high-risk processing activities should factor a potential fourteen-week regulatory dependency into their project and product-launch timelines.

This obligation sits within Portugal's standing accountability framework under the GDPR and Law 58/2019, and while it does not represent a change to the underlying legal requirement for prior consultation, the specific timeline figures reported this cycle underscore the practical operational burden the requirement imposes, particularly for organisations undertaking novel or higher-risk processing activities such as large-scale profiling, biometric processing, or systematic monitoring, where an unmitigated-residual-risk DPIA outcome is more likely to arise.

Outlook

Organisations conducting DPIAs in Portugal for high-risk processing activities should build realistic timeline buffers around the CNPD prior-consultation process into project planning, given the confirmed potential for consultation periods extending to fourteen weeks in complex cases.

1 earlier distinct update(s)

Periodic update · new data 2026-08-25

Controller/Processor Duties

Portuguese controllers face a materially extended data protection impact assessment (DPIA) prior-consultation procedure relative to the GDPR default. Where a DPIA concludes that residual risk cannot be adequately mitigated, the controller must consult CNPD before commencing the processing activity, and this prior-consultation process can extend to eight weeks, with a possible further six-week extension in complex cases. This is a national procedural variance layered on top of the GDPR's general prior-consultation mechanism, and it creates a distinct compliance-timeline risk for any Portuguese controller planning a high-risk processing launch.

Outlook

Controllers scoping high-risk processing activity in Portugal should plan for a prior-consultation window of up to fourteen weeks in complex cases; independent confirmation of CNPD's current practice against this stated timeline would be the clearest signal of whether the procedure is being applied as described.

Sources and claims (5)

ConfirmedEuropean Data Protection Board — The CNPD found the INE's DPIA for the 2021 Census 'limited in scope, and insufficient in relation to the data processing', breaching GDPR Art 35(1)-(3)(b), as part of a €4.3 million fine.observed 2026-08-04
ProbableIAPP — The DPO must be appointed based on professional qualities and specialised knowledge of data protection law and practice, and exercises the function with technical autonomy; the CNPD has noted that additional statutory DPO functions beyond GDPR constitute a violation of the Regulation.observed 2026-08-04
ConfirmedIAPP — The CNPD fined Hospital do Barreiro €100,000 under GDPR Article 32(1)(b) for failing to ensure confidentiality, integrity, availability and resilience of processing systems, including a lack of regular security testing.observed 2026-08-04
ConfirmedEuropean Data Protection Board — Using Article 58(2)(j) GDPR corrective powers, the CNPD ordered the INE to suspend, within 12 hours, all data flows to the US and any other third country lacking an adequate level of protection.observed 2026-08-04
ProbableIAPP — Personal data relating to social security contributions for retirement purposes may be retained indefinitely, provided adequate technical and organisational measures guarantee data subject rights.observed 2026-08-04

#

Transfer mechanisms are operative and enforced (SCC/TIA scrutiny confirmed), but PT has no independent adequacy-granting/receiving competence, and no PT-specific data-localisation mandate was found.

Primary frameworkGDPR Arts 44-49 (Chapter V)

Supervisory authorityComissão Nacional de Proteção de Dados (CNPD)

Traffic-light rationale — AmberTransfer mechanisms are operative and enforced (SCC/TIA scrutiny confirmed), but PT has no independent adequacy-granting/receiving competence, and no PT-specific data-localisation mandate was found.

Sub-modules (6)

Transfer MechanismsAmber

SCCs, BCRs and Art 49 derogations are available per GDPR Chapter V; CNPD actively enforces against inadequate supplementary safeguards.

Claims (1):

GDPR Chapter V transfer mechanisms (adequacy, SCCs, BCRs, Art 49 derogations) apply directly in Portugal and are actively enforced by the CNPD.

Adequacy ReceivedAmber

Adequacy is an EU-level competence, not a PT-national one; no PT-specific adequacy-received finding applies (would duplicate EU-level JID).

Absence provenance: unavailable. Searched: Portugal national adequacy decisions received.

Adequacy GrantedAmber

Adequacy-granting is an EU Commission competence; no separate PT-national adequacy-granted determination exists.

Absence provenance: unavailable. Searched: Portugal national adequacy decisions granted.

Sccs And BcrsRed

SCC use was confirmed in the INE case; the controller authorised SCC-based transfers to the US without adopting supplementary safeguards.

Claims (1):

The INE controller contractually authorised its processor to transfer data to the US under SCCs without adopting any supplementary measures, and permitted onward sub-processing in third countries lacking equivalent protection.

Transfer Impact AssessmentRed

CNPD enforcement in the INE case highlighted absence of a transfer impact assessment/supplementary measures for US-bound SCC transfers post-Schrems II.

Claims (1):

The CNPD identified the controller's lack of control over and knowledge of respondents' data once it entered the processor's network, and full processor control of encryption/decryption tools, as an aggravating factor in its transfer-related infringement finding.

Data LocalisationAmber

No general PT data-localisation mandate was identified; the CNPD's INE order was a case-specific corrective suspension, not a standing localisation law.

Absence provenance: unavailable. Searched: Portugal data localisation law personal data.

Category narrative63 words

As an EU Member State, Portugal's transfer regime operates within the GDPR Chapter V framework (adequacy decisions, SCCs, BCRs, derogations) administered at EU level; the CNPD applies these mechanisms directly, as shown in the INE case where SCC use without Schrems-II supplementary measures triggered enforcement. Adequacy decisions themselves are an EU (not PT-national) competence, so PT-specific 'received'/'granted' adequacy findings are not separately meaningful.

Periodic update · new data 2026-09-21

Cross-Border & Adequacy

Organisations transferring personal data internationally in connection with Portugal remain exposed to an active legal-basis risk if they have not migrated away from the 2010-form Standard Contractual Clauses. These clauses were repealed for new contracts from 27 September 2021 and for all contracts, including those already in place, from 27 December 2022. Any 2010-form SCC still in use for a Portugal-connected international data transfer today is confirmed to be invalid and must be migrated to the current SCC framework without delay.

This is not a new development in the sense of a fresh legislative change this cycle, but its confirmed, active-enforcement-relevant status means it remains a live and material compliance risk: organisations that have not completed the migration exercise are transferring personal data on an invalid contractual basis, which exposes them to enforcement risk from the CNPD independent of any other compliance gap. Given the CNPD's demonstrated willingness to impose and defend substantial fines, evidenced by the Constitutional-Court-confirmed EUR 1.25 million penalty against the Municipality of Lisbon this cycle, organisations should treat legacy-SCC migration as a genuine enforcement-priority item rather than a historical footnote.

Outlook

Organisations with any Portugal-connected international transfer arrangement should audit their SCC inventory now, if this has not already been completed, to confirm no 2010-form clauses remain in active use.

1 earlier distinct update(s)

Periodic update · new data 2026-08-25

Cross-Border & Adequacy

CNPD treats Article 49 GDPR derogations as last-resort transfer mechanisms, requiring an adequacy decision or Standard Contractual Clauses accompanied by a Transfer Impact Assessment as the primary route for international transfers. Separately, the old-form (2010) Standard Contractual Clauses were repealed for new contracts from 27 September 2021 and for all contracts from 27 December 2022; any 2010-form SCC still relied upon in 2026 is invalid. This transition is directly relevant to enforcement activity elsewhere this cycle, where an inadequate transfer mechanism formed part of the basis for a fine against a Portuguese public body.

Outlook

The item to watch is whether any Portuguese controller is found still relying on an invalid 2010-form SCC, which would be a direct enforcement trigger under CNPD's stated approach to Article 49 and SCC adequacy.

Sources and claims (3)

ConfirmedEuropean Data Protection Board — GDPR Chapter V transfer mechanisms (adequacy, SCCs, BCRs, Art 49 derogations) apply directly in Portugal and are actively enforced by the CNPD.observed 2026-08-04
ConfirmedEuropean Data Protection Board — The INE controller contractually authorised its processor to transfer data to the US under SCCs without adopting any supplementary measures, and permitted onward sub-processing in third countries lacking equivalent protection.observed 2026-08-04
ConfirmedEuropean Data Protection Board — The CNPD identified the controller's lack of control over and knowledge of respondents' data once it entered the processor's network, and full processor control of encryption/decryption tools, as an aggravating factor in its transfer-related infringement finding.observed 2026-08-04

#

Health and employment overlays are well evidenced; financial, credit, education and insurance sectoral overlays could not be confirmed and are flagged as gaps.

Primary frameworkGDPR; Law No. 58/2019; Decree-Law 125/2025 (NIS2); Law No. 59/2025

Supervisory authorityComissão Nacional de Proteção de Dados (CNPD)

Traffic-light rationale — AmberHealth and employment overlays are well evidenced; financial, credit, education and insurance sectoral overlays could not be confirmed and are flagged as gaps.

Sub-modules (7)

Financial Sector OverlayRed

No PT-specific financial-sector DP overlay (banking secrecy vs GDPR interaction) was found in this research pass.

Absence provenance: unavailable. Searched: Portugal financial sector data protection overlay CNPD banking secrecy.

Health Sector OverlayGreen

Law 58/2019 Art 29 imposes health/genetic-data access-notification duties; historic CNPD enforcement (Hospital do Barreiro) targeted health-data security gaps.

Claims (1):

Article 29 of the GDPR Implementation Law requires data controllers to notify data subjects whenever their health or genetic data is accessed, including access by occupational-medicine personnel.

Telecoms And EprivacyAmber

Telecoms/cyber overlay is evolving through NIS2 transposition and DSA implementation, both subject to CNPD opinions.

Claims (1):

Portugal's Decree-Law 125/2025 transposes the NIS2 Directive, imposing new cybersecurity obligations on public and private entities, with CNCS and ANACOM given specific cybersecurity roles.

Employment DataAmber

Law 58/2019 Art 28(3) on employee consent to processing was disapplied by CNPD Decision 494/2019 as GDPR-inconsistent.

Claims (1):

CNPD Decision 494/2019 disapplies Article 28(3) of the GDPR Implementation Law concerning employee consent to data processing as inconsistent with GDPR.

Credit And ScoringRed

No PT-specific credit-scoring DP overlay was found in this research pass.

Absence provenance: unavailable. Searched: Portugal credit scoring data protection CNPD.

EducationRed

No PT-specific education-sector DP overlay distinct from the general children's-online-safety bill was found.

Absence provenance: unavailable. Searched: Portugal education sector data protection CNPD schools.

InsuranceRed

No PT-specific insurance-sector DP overlay was found in this research pass.

Absence provenance: unavailable. Searched: Portugal insurance sector data protection CNPD.

Category narrative50 words

Sectoral overlays confirmed in research center on health data (statutory notification duties, historic hospital enforcement) and employment data (disapplied consent provision). Telecoms/cyber overlay is expanding via NIS2 transposition (Decree-Law 125/2025, Law 59/2025) and DSA implementation (ANACOM). Financial-sector, credit-scoring, education-sector and insurance-sector DP overlays were not evidenced in this research pass.

no periodic updates on record for this sub-brief

Sources and claims (1)

ProbableDataGuidance — Portugal's Decree-Law 125/2025 transposes the NIS2 Directive, imposing new cybersecurity obligations on public and private entities, with CNCS and ANACOM given specific cybersecurity roles.observed 2026-08-04

#

Only a general EU-level enforcement-coordination signal was confirmed; no PT-specific adtech instrument evidenced across any sub-module.

Primary frameworkePrivacy Directive 2002/58/EC; GDPR

Supervisory authorityComissão Nacional de Proteção de Dados (CNPD)

Traffic-light rationale — RedOnly a general EU-level enforcement-coordination signal was confirmed; no PT-specific adtech instrument evidenced across any sub-module.

Sub-modules (6)

Cookies And TrackersAmber

The CNPD participates in the EDPB's 2026 Coordinated Enforcement Framework assessing GDPR transparency/information obligations, which bears on cookie/tracker consent practices, but no PT-specific cookie statute was found.

Claims (1):

The EDPB launched the 2026 Coordinated Enforcement Framework (CEF) to assess compliance with GDPR transparency and information obligations, involving 25 DPAs including the CNPD in enforcement and fact-finding actions.

Dark PatternsRed

No PT-specific dark-pattern prohibition was found in this research pass.

Absence provenance: unavailable. Searched: Portugal CNPD dark patterns guidance.

Opt Out SignalsRed

No PT-specific recognition of Global Privacy Control or equivalent opt-out signals was found.

Absence provenance: unavailable. Searched: Portugal Global Privacy Control opt-out signal CNPD.

Clean Rooms And DcrRed

No PT-specific clean-room/data-collaboration-room rule was found.

Absence provenance: unavailable. Searched: Portugal data clean room CNPD guidance.

Cross Context AdvertisingRed

No PT-specific cross-context-advertising ('sale'/'share') rule analogous to US state law was found; general GDPR consent/legitimate-interest rules apply.

Absence provenance: unavailable. Searched: Portugal cross-context advertising data protection.

Direct MarketingRed

No PT-specific direct-marketing suppression/consent rule beyond general GDPR Art 21 objection right was found in this research pass.

Absence provenance: unavailable. Searched: Portugal direct marketing consent suppression list CNPD.

Category narrative51 words

No Portugal-specific cookie/tracker statute, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or cross-context-advertising rule distinct from general GDPR/ePrivacy was identified in this research pass. The 2026 EDPB Coordinated Enforcement Framework (CEF), in which the CNPD participates as one of 25 DPAs, targets GDPR transparency/information obligations relevant to commercial data practices including adtech.

Periodic update · new data 2026-09-21

AdTech & Commercial Privacy

The European Data Protection Board is understood to have launched its 2026 Coordinated Enforcement Framework, an exercise assessing compliance with GDPR transparency and information obligations, involving 25 data protection authorities including the CNPD. This represents a coordinated EU-wide enforcement sweep targeting how organisations disclose their data-processing practices to individuals, a topic with direct relevance to commercial adtech and tracking practices where transparency notices and consent mechanisms are frequently scrutinised.

For organisations operating in Portugal with adtech or commercial-privacy exposure, this CEF sweep signals a heightened near-term likelihood of CNPD scrutiny specifically directed at transparency and information-obligation compliance, distinct from the CNPD's general enforcement activity. The coordinated, multi-authority nature of the exercise, spanning 25 data protection authorities, also suggests findings and enforcement patterns emerging in one jurisdiction could inform CNPD's own approach in Portugal.

Outlook

Organisations with adtech or commercial-tracking operations touching Portugal should review transparency notices and information-obligation compliance ahead of potential CNPD scrutiny arising from the 2026 Coordinated Enforcement Framework sweep.

1 earlier distinct update(s)

Periodic update · new data 2026-08-25

AdTech & Commercial Privacy

The single most common CNPD finding in cookie-consent audits conducted between 2024 and 2026 is an asymmetric banner design, treated by CNPD as a failure to obtain valid consent. This finding is sourced this cycle only from commercial compliance-vendor commentary rather than primary CNPD guidance, and should be treated as an assessed rather than confirmed practice pattern pending corroboration.

Outlook

Primary-source CNPD guidance or published audit findings on asymmetric-banner consent failures would be the clearest confirmation of this practice pattern; absent that, commercial-sector operators in Portugal should treat symmetric consent-banner design as the lower-risk default.

Sources and claims (1)

ProbableDataGuidance — The EDPB launched the 2026 Coordinated Enforcement Framework (CEF) to assess compliance with GDPR transparency and information obligations, involving 25 DPAs including the CNPD in enforcement and fact-finding actions.observed 2026-08-04

#

Institutional AI/biometric governance activity confirmed (working groups, national AI agenda) but no binding PT-specific ADM/biometric/genetic statute identified.

Primary frameworkGDPR Art 22; EU AI Act (interface)

Supervisory authorityComissão Nacional de Proteção de Dados (CNPD)

Traffic-light rationale — AmberInstitutional AI/biometric governance activity confirmed (working groups, national AI agenda) but no binding PT-specific ADM/biometric/genetic statute identified.

Sub-modules (6)

Profiling RestrictionsAmber

No PT-specific profiling restriction beyond GDPR Art 22 was identified.

Absence provenance: unavailable. Searched: Portugal CNPD profiling restrictions guidance.

Automated Decision Making TransparencyAmber

No PT-specific ADM transparency/explanation-right instrument beyond GDPR Art 22 was identified.

Absence provenance: unavailable. Searched: Portugal automated decision making transparency CNPD.

Ai Risk AssessmentsAmber

Portugal's National AI Agenda focuses on infrastructure, innovation, talent and ethics, including AI research and public-sector training actions.

Claims (1):

Portugal's National AI Agenda focuses on infrastructure, innovation, talent, and ethics, with key actions to promote AI research, collaboration, and public-sector training.

Biometric RegimeAmber

The CNPD's RLPD has formed internal working groups addressing biometrics, AI, video surveillance and data transfers, indicating active regulatory attention but no confirmed standalone biometric statute.

Claims (1):

The CNPD's internal RLPD structure has formed working groups to address privacy issues in biometrics, AI, video surveillance, and data transfers.

Genetic DataAmber

Law 58/2019 Art 29 imposes specific processing conditions and access-notification duties for genetic data.

Claims (1):

Article 29 of the GDPR Implementation Law requires data controllers to notify data subjects whenever their health or genetic data is accessed, including access by occupational-medicine personnel.

State Surveillance CarveoutsRed

No PT-specific state-surveillance/national-security carve-out analysis was identified in this research pass.

Absence provenance: unavailable. Searched: Portugal national security data protection carveout CNPD.

Category narrative49 words

Portugal has no PT-specific Art 22 ADM/profiling statute or ADM-transparency instrument confirmed in research; however, the CNPD has formed internal working groups (RLPD) covering biometrics, AI, video surveillance and data transfers, and Portugal has launched a National AI Agenda. General GDPR Art 22 and EU AI Act interfaces apply.

Periodic update · new data 2026-09-21

Algorithmic, Biometric & Surveillance Governance

Portugal is understood to have designated ANACOM in September 2025 as the national market-surveillance authority and single point of contact for EU AI Act enforcement. Full application of obligations for most high-risk AI systems is understood to begin 2 August 2026, a deadline now approaching within the current reporting horizon. This institutional designation positions ANACOM as the primary enforcement body for AI Act compliance in Portugal, working alongside the CNPD where algorithmic governance and data-protection obligations overlap, for example in relation to automated decision-making systems that process personal data and fall within the AI Act's high-risk categorisation.

This is a probable-confidence development reflecting institutional build-out ahead of a binding EU-level deadline rather than a completed enforcement framework; the practical coordination mechanism between ANACOM and the CNPD for jointly-relevant cases has not been independently detailed this cycle.

Outlook

The approach of the 2 August 2026 high-risk-obligations deadline makes ANACOM's operational readiness, and the clarity of its coordination arrangement with the CNPD on overlapping algorithmic-governance and data-protection matters, the key development to watch in the immediate term.

1 earlier distinct update(s)

Periodic update · new data 2026-08-25

Algorithmic, Biometric & Surveillance Governance

Portugal designated ANACOM in September 2025 as the national market-surveillance authority and single point of contact for EU AI Act enforcement, with ANACOM coordinating with CNPD on matters at the intersection of AI governance and data protection. Full obligations for most high-risk AI systems become applicable in Portugal from 2 August 2026. This designation creates a near-term implementation deadline sitting directly at the boundary between AI governance and data-protection compliance, since many high-risk AI systems process personal data as a core function.

Outlook

The 2 August 2026 deadline is the nearest firm date on this module's horizon; the item to watch is how the ANACOM-CNPD coordination mechanism operates in practice once full high-risk-system obligations become applicable.

Sources and claims (2)

ProbableDataGuidance — Portugal's National AI Agenda focuses on infrastructure, innovation, talent, and ethics, with key actions to promote AI research, collaboration, and public-sector training.observed 2026-08-04
ProbableDataGuidance — The CNPD's internal RLPD structure has formed working groups to address privacy issues in biometrics, AI, video surveillance, and data transfers.observed 2026-08-04

#

Core age-of-consent rule is in force and confirmed; the more expansive children's-online-safety bill remains pending, and education-settings/dependent-adults sub-modules are unevidenced.

Primary frameworkGDPR Art 8; Law No. 58/2019; Bill 398/XVII/1 (pending)

Supervisory authorityComissão Nacional de Proteção de Dados (CNPD)

Traffic-light rationale — AmberCore age-of-consent rule is in force and confirmed; the more expansive children's-online-safety bill remains pending, and education-settings/dependent-adults sub-modules are unevidenced.

Sub-modules (5)

Age VerificationAmber

The AEPD and CNPD have jointly called for urgent adoption of age-verification systems, aligned with data-protection rules, to prevent minors' access to adult content.

Claims (1):

The AEPD and CNPD called for the urgent adoption of measures enabling detection of problematic digital-device use and prevention of minors' access to adult content through age-verification systems aligned with data-protection regulations.

Minor Profiling BansAmber

Pending Bill 398/XVII/1 aims to protect children online by setting age limits and requiring parental consent; the CNPD has issued an opinion emphasizing GDPR compliance.

Claims (1):

Bill 398/XVII/1, aimed at protecting children online in Portugal, sets age limits and requires parental consent, with the CNPD issuing an opinion emphasizing GDPR compliance.

Education SettingsRed

No PT-specific education-settings children's-data rule was identified in this research pass.

Absence provenance: unavailable. Searched: Portugal education settings children data protection CNPD.

Dependent AdultsRed

No PT-specific dependent-adults (elderly/incapacitated) data-protection provision was identified in this research pass.

Absence provenance: unavailable. Searched: Portugal dependent adults data protection vulnerable groups CNPD.

Category narrative65 words

The digital consent age is 13, with secure-authentication verification for parental consent below that age. A pending Bill (398/XVII/1) seeks to strengthen online protection of minors by setting age limits and requiring parental consent, and has received a CNPD opinion emphasizing GDPR compliance. Iberian cooperation (AEPD-CNPD) has called for age-verification systems to prevent minors accessing adult content. No PT-specific education-settings or dependent-adults provisions were identified.

Periodic update · new data 2026-09-21

Children & Vulnerable Groups

Bill 398 XVII/1 is understood to aim at protecting children online in Portugal, setting age limits and requiring parental consent for certain online activities or services. The CNPD has been reported to emphasise GDPR compliance considerations in its public commentary on the bill, suggesting the data protection authority is engaged with the legislative process even though the bill's substantive provisions originate outside the GDPR framework itself.

This claim carries only uncertain confidence: the bill's precise legislative stage as of this cycle's cutoff has not been independently confirmed beyond aggregator-level reporting, and the specific age thresholds and parental-consent mechanisms it would introduce have not been independently verified. Organisations offering online services to children in Portugal should treat this as an early-stage legislative signal to monitor rather than a settled compliance requirement at this time.

Outlook

Confirmation of Bill 398 XVII/1's current legislative stage, and independent verification of its specific age-limit and parental-consent provisions, are the key items to resolve before this development can be treated as a confirmed compliance requirement.

1 earlier distinct update(s)

Periodic update · new data 2026-08-25

Children & Vulnerable Groups

Draft Bill 398 XVII/1 aims to protect children online in Portugal by setting age limits and requiring parental consent for certain online activities, with CNPD publicly emphasising GDPR-compliance alignment in its commentary on the proposal. The bill's current legislative status and full citation were not confirmed this cycle, and the finding is assessed rather than confirmed pending further sourcing.

Outlook

Confirmation of Draft Bill 398 XVII/1's legislative progress, including whether it has advanced beyond committee stage, is the item most likely to change this module's rating next cycle.

Sources and claims (2)

ProbableAgencia Española de Protección de Datos (AEPD) — The AEPD and CNPD called for the urgent adoption of measures enabling detection of problematic digital-device use and prevention of minors' access to adult content through age-verification systems aligned with data-protection regulations.observed 2026-08-04
ProbableDataGuidance — Bill 398/XVII/1, aimed at protecting children online in Portugal, sets age limits and requires parental consent, with the CNPD issuing an opinion emphasizing GDPR compliance.observed 2026-08-04

#

Sustained, escalating enforcement record (multiple seven-figure fines, judicial confirmation) demonstrates an active and empowered regulator.

Primary frameworkGDPR Arts 58, 77-84; Law No. 58/2019

Supervisory authorityComissão Nacional de Proteção de Dados (CNPD)

Traffic-light rationale — GreenSustained, escalating enforcement record (multiple seven-figure fines, judicial confirmation) demonstrates an active and empowered regulator.

Sub-modules (6)

Regulator Powers And PenaltiesGreen

CNPD exercises full Art 58(2) corrective powers (including emergency transfer-suspension orders) and can levy fines up to €20 million or 4% of global turnover for the most serious infringements.

Claims (2):

Large companies may be subject, for very serious offences, to fines between €5,000 and €20 million or 4% of total worldwide annual turnover, whichever is higher, under the GDPR Implementation Law.
Using Article 58(2)(j) GDPR corrective powers, the CNPD ordered the INE to suspend, within 12 hours, all data flows to the US and any other third country lacking an adequate level of protection.

Enforcement Activity IndexGreen

Multiple significant fines issued 2018-2026: Hospital do Barreiro (2018), INE Census (2022, €4.3M), Setúbal Municipality (2022, €170,000), Lisbon Municipality (€1.25M, Constitutional-Court-confirmed 2026).

Claims (4):

In 2018 the CNPD applied a major fine of €400,000 to Hospital do Barreiro, Portugal's first GDPR fine, for deficient health-data access controls and security measures.
The CNPD found the INE's DPIA for the 2021 Census 'limited in scope, and insufficient in relation to the data processing', breaching GDPR Art 35(1)-(3)(b), as part of a €4.3 million fine.
The CNPD fined the Municipality of Setúbal €170,000 in 2022 for data protection violations.
The Portuguese Constitutional Court confirmed the CNPD's €1.25 million fine against the Municipality of Lisbon for GDPR violations related to the processing of protestors' sensitive personal data and its transfer to the Russian Embassy.

Regulator Funding And CapacityRed

No specific CNPD funding/headcount data was identified in this research pass.

Absence provenance: unavailable. Searched: CNPD budget headcount funding capacity Portugal.

Collective Redress And Class ActionsRed

No PT-specific collective-redress/class-action mechanism for data protection was independently confirmed in this research pass.

Absence provenance: unavailable. Searched: Portugal collective redress class action data protection ação popular.

Private Right Of ActionAmber

GDPR Arts 77-79 and 82 grant data subjects a right to lodge complaints, seek judicial remedy, and claim compensation; no PT-specific expansion or restriction was identified.

Absence provenance: unavailable. Searched: Portugal private right of action data protection GDPR Article 82.

Recent Developments 180DGreen

Within the last 180 days: the Portuguese Constitutional Court confirmed the CNPD's €1.25M Lisbon Municipality fine; the EDPB launched its 2026 CEF (transparency/information obligations); CNPD issued an opinion on Bill 398/XVII/1 protecting minors online; NIS2 transposition continued via Decree-Law 125/2025 and Law 59/2025 with CNPD opinions on both the DSA and NIS2 implementation bills; CNPD signed cooperation instruments with Morocco's CNDP and with CNCS.

Claims (4):

The Portuguese Constitutional Court confirmed the CNPD's €1.25 million fine against the Municipality of Lisbon for GDPR violations related to the processing of protestors' sensitive personal data and its transfer to the Russian Embassy.
The EDPB launched the 2026 Coordinated Enforcement Framework (CEF) to assess compliance with GDPR transparency and information obligations, involving 25 DPAs including the CNPD in enforcement and fact-finding actions.
Bill 398/XVII/1, aimed at protecting children online in Portugal, sets age limits and requires parental consent, with the CNPD issuing an opinion emphasizing GDPR compliance.
Portugal's Decree-Law 125/2025 transposes the NIS2 Directive, imposing new cybersecurity obligations on public and private entities, with CNCS and ANACOM given specific cybersecurity roles.

Category narrative99 words

The CNPD holds full GDPR Art 58 investigative/corrective powers and Art 83 fining authority (up to €20M / 4% global turnover for the most serious offences, per the national implementing law). Enforcement activity is well-documented: Hospital do Barreiro (€400,000 aggregate, 2018 - first PT GDPR fine), INE Census 2021 (€4.3M, 2022), Setúbal Municipality (€170,000, 2022), and Lisbon Municipality (€1.25M, for processing protestors' sensitive data transferred to the Russian Embassy), with the Constitutional Court confirming the Lisbon fine in early 2026. No PT-specific collective-redress/class-action mechanism was independently confirmed in this pass; GDPR Art 79/82 judicial-remedy and compensation rights apply generally.

Periodic update · new data 2026-09-28

Enforcement & Redress

Portugal's data-protection enforcement landscape in 2025 exhibits a striking imbalance between the volume of matters brought before the CNPD and the volume of sanctions it ultimately imposes. The CNPD opened 3,201 cases and conducted 2,037 investigations over the year, yet issued only two fines totalling EUR 47,000 across the entire twelve-month period. This is a caseload of a scale that would typically be expected to yield a materially larger sanctioning record, and the disproportion is significant enough to be characterised as the CNPD's defining enforcement signal for the year rather than a marginal statistical curiosity.

The CNPD's fining framework itself is well established: under Law 58/2019, the national act implementing the GDPR domestically, the regulator applies criteria that account for the economic situation and turnover of the offending entity, the continuous nature of any infringement, and the entity's size or number of employees, all layered atop the GDPR's own statutory fine ceilings. This framework was tested and upheld this cycle when the Portuguese Constitutional Court confirmed the CNPD's EUR 1.25 million fine against the Municipality of Lisbon for GDPR violations connected to data transfers, providing judicial validation of the CNPD's approach to quantifying penalties in at least one significant case.

Against that backdrop, the CNPD's historic December 2022 fine of EUR 4.3 million against Portugal's national statistics institute (INE), imposed over five GDPR infringements tied to the 2021 Census including an unlawful transfer of personal data to US-based servers without adequate safeguards, remains unresolved: INE's court challenge to the fine had not been decided as of mid-2026. The case stands as the CNPD's largest publicly known sanction, and its multi-year suspension in litigation illustrates how even Portugal's most significant enforcement actions can take years to become final, which bears on how confidently any single fine figure should be read as settled.

A legislative proposal reported as pending parliamentary approval as of mid-2026 would establish a new contraordenational regime intended to accelerate CNPD sanctioning proceedings. This proposal has not been independently corroborated against a primary CNPD or parliamentary source this cycle, so its substance, timeline, and likelihood of passage remain open. If enacted, it would directly address the caseload-to-sanction gap that characterises the CNPD's current enforcement record, and its progress is the single most consequential variable for Portugal's enforcement trajectory going forward.

Outlook

Whether Portugal's enforcement posture converges toward more sanction-active EU peer regulators depends substantially on the fate of the pending contraordenational reform and on the eventual resolution of the INE litigation. Absent movement on either front, the CNPD's low 2025 sanction count against its large caseload is likely to persist as a watch item. Future cycles should seek direct CNPD primary-source confirmation of the reform's status, which was not obtained this cycle, and should track any court ruling in the INE case as a signal of how durable the CNPD's largest fines prove to be.

2 earlier distinct update(s)

Periodic update · new data 2026-09-21

Enforcement & Redress

The Portuguese Constitutional Court is understood to have confirmed the CNPD's EUR 1.25 million fine against the Municipality of Lisbon for GDPR violations related to data transfers. This is a significant enforcement outcome both for its financial magnitude and for its confirmation at the highest level of judicial review, reinforcing the durability of CNPD's enforcement decisions against subsequent legal challenge. The precise current status and outcome date of this confirmation was not independently pinned down beyond aggregator-level reporting this cycle, but the underlying fine and its judicial confirmation are reported with probable confidence.

Separately, judicial actions, particularly collective ones led by associations such as Ius Omnibus, are reported to be gaining relevance in the Portuguese data-protection redress landscape, suggesting a growing role for collective/class-style redress mechanisms alongside CNPD's own administrative enforcement powers. This dual-track development, administrative fines confirmed on judicial review plus a rising collective-litigation channel, indicates an increasingly multi-layered enforcement and redress environment in Portugal.

Outlook

Independent confirmation of the exact status and date of the Constitutional Court's ruling on the Lisbon Municipality fine, and continued monitoring of collective-action activity led by organisations such as Ius Omnibus, are the key items to track for the next cycle.

Periodic update · new data 2026-08-25

Enforcement & Redress

Portugal's data-protection enforcement environment escalated materially this cycle. The Portuguese Constitutional Court confirmed CNPD's EUR 1.25 million fine against the Municipality of Lisbon for GDPR violations related to data transfers, and CNPD separately fined the national statistics institute INE EUR 4.3 million, partly on the basis of an inadequate transfer mechanism to the United States. CNPD has authority to impose administrative fines, order the suspension of processing, and refer serious cases to the Portuguese courts. Judicial collective redress actions, particularly those led by associations such as Ius Omnibus, are gaining relevance in Portugal's digital-sector enforcement landscape, and the EDPB launched its 2026 Coordinated Enforcement Framework assessing GDPR transparency and information-obligation compliance across 25 data protection authorities including CNPD. Both the Lisbon Municipality and INE fine amounts rest on Tier-3 secondary summaries this cycle rather than primary CNPD text.

Outlook

Primary-source CNPD confirmation of the Lisbon Municipality and INE fine details would materially raise confidence in this cycle's two headline enforcement findings; the EDPB's 2026 Coordinated Enforcement Framework outcome, once published, is the next scheduled item likely to generate further Portugal-specific enforcement material.

Sources and claims (4)

ConfirmedIAPP — Large companies may be subject, for very serious offences, to fines between €5,000 and €20 million or 4% of total worldwide annual turnover, whichever is higher, under the GDPR Implementation Law.observed 2026-08-04
ConfirmedIAPP — In 2018 the CNPD applied a major fine of €400,000 to Hospital do Barreiro, Portugal's first GDPR fine, for deficient health-data access controls and security measures.observed 2026-08-04
ProbableDataGuidance — The CNPD fined the Municipality of Setúbal €170,000 in 2022 for data protection violations.observed 2026-08-04
ConfirmedDataGuidance — The Portuguese Constitutional Court confirmed the CNPD's €1.25 million fine against the Municipality of Lisbon for GDPR violations related to the processing of protestors' sensitive personal data and its transfer to the Russian Embassy.observed 2026-08-04

No categories match.

Filters combine as OR inside a group and AND across groups.

Publication gate

No failing checks.

`schema_valid`	pass
`min_t1_per_instrument_met`	n/a — no subject in this jurisdiction
`min_quoted_text_present`	waived — floor 0%
`translation_provenance_recorded`	n/a — no subject in this jurisdiction
`egress_verified`	pass
`source_tier_integrity_ok`	pass
`jurisdiction_source_floor_met`	pass
`tier_a_b_national_primary_pct`	23.08
`aggregator_only_jurisdiction_count`	0
`manual_override`

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for Portugal
Field	Value
`trust.lawyer_review.status`	never_reviewed
`trust.lawyer_review.reviewer`	no reviewer on record
`trust.content_source`	ai_generated

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-02. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 30 claim(s) (30 category placement(s)), 17 source(s) in the cumulative register.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map

GDPR article to category mapping
Article	Category	Sub-module
`Art. 5`	Controller/Processor Duties	accountability and dpia
`Art. 6`	Lawful Processing & Special Data	lawful bases
`Art. 7`	Lawful Processing & Special Data	consent thresholds
`Art. 9`	Lawful Processing & Special Data	special categories
`Art. 13`	Data Subject Rights	access right
`Art. 14`	Data Subject Rights	access right
`Art. 15`	Data Subject Rights	access right
`Art. 16`	Data Subject Rights	rectification and erasure
`Art. 17`	Data Subject Rights	rectification and erasure
`Art. 18`	Data Subject Rights	restriction and objection
`Art. 19`	Data Subject Rights	rectification and erasure
`Art. 20`	Data Subject Rights	data portability
`Art. 21`	Data Subject Rights	restriction and objection
`Art. 22`	Algorithmic, Biometric & Surveillance Governance	automated decision making transparency
`Art. 25`	Controller/Processor Duties	accountability and dpia
`Art. 28`	Controller/Processor Duties	joint controller arrangements
`Art. 30`	Controller/Processor Duties	ropa requirements
`Art. 32`	Controller/Processor Duties	security measures
`Art. 33`	Controller/Processor Duties	breach notification
`Art. 34`	Controller/Processor Duties	breach notification
`Art. 35`	Controller/Processor Duties	accountability and dpia
`Art. 37`	Controller/Processor Duties	dpo requirements
`Art. 38`	Controller/Processor Duties	dpo requirements
`Art. 39`	Controller/Processor Duties	dpo requirements
`Art. 44`	Cross-Border & Adequacy	transfer mechanisms
`Art. 45`	Cross-Border & Adequacy	adequacy received
`Art. 46`	Cross-Border & Adequacy	sccs and bcrs
`Art. 47`	Cross-Border & Adequacy	sccs and bcrs
`Art. 48`	Cross-Border & Adequacy	transfer mechanisms
`Art. 49`	Cross-Border & Adequacy	transfer mechanisms
`Art. 77`	Enforcement & Redress	private right of action
`Art. 78`	Enforcement & Redress	private right of action
`Art. 79`	Enforcement & Redress	private right of action
`Art. 80`	Enforcement & Redress	collective redress and class actions
`Art. 81`	Enforcement & Redress	regulator powers and penalties
`Art. 82`	Enforcement & Redress	private right of action
`Art. 83`	Enforcement & Redress	regulator powers and penalties
`Art. 84`	Enforcement & Redress	regulator powers and penalties

Self-audit

regulator_and_framework, lawful_processing_and_special_data, data_subject_rights, controller_processor_duties, cross_border_and_adequacy, and enforcement_and_redress are populated with a mix of T1 (GDPR/EUR-Lex) and T2/T3 sources (EDPB national-news republication of CNPD decisions, IAPP/DataGuidance commentary), grounded in concrete CNPD enforcement decisions (Hospital do Barreiro 2018, INE Census 2022, Setúbal 2022, Lisbon 2022/2026). sectoral_watch and children_and_vulnerable_groups are partially populated (health/employment overlay, age-of-consent, pending children's bill) but several sub-modules (financial, credit, education, insurance sectoral overlays; education-settings and dependent-adults protections) carry explicit absent_field_provenance. adtech_and_commercial_privacy and algorithmic_biometric_and_surveillance_governance rely almost entirely on T3/T4-adjacent secondary compilation (DataGuidance jurisdiction digest) with only institutional/process signals (EDPB CEF, CNPD RLPD working groups, National AI Agenda) rather than binding PT-specific instruments; most sub-modules there are empty with documented absent_field_provenance.

Unresolved questions (6):

Does Portugal impose sector-specific DP overlays for financial services, credit scoring, insurance, or education beyond the general GDPR/Law 58/2019 regime?
What are the current numeric thresholds (if any) triggering mandatory DPO appointment beyond the GDPR Art 37 criteria as interpreted by CNPD?
Is there a Portugal-specific data-localisation mandate in any sector (e.g., health, public administration cloud) beyond the ad hoc INE transfer-suspension order?
What is the current status/outcome of Bill 398/XVII/1 on minors' online protection following the CNPD opinion?
Does Portuguese law provide a collective-redress or class-action ('ação popular') mechanism specifically usable for GDPR claims?
What is CNPD's current funding and headcount, and how does it compare to caseload/enforcement volume?

Escalate to primary-source review: yes

Portugal

Jurisdiction brief

Latest update · 28 September 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Standing brief · as of 4 August 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Latest update · 25 August 2026

Regulatory Status

Outlook

Standing brief · as of 4 August 2026

Regulatory Status

Outlook

regulator_and_frameworkRegulator & Framework5 sub-modules5 claimsGreen▾#

Sub-modules (5)

Regulator And AuthorityGreen

Act And InstrumentsGreen

Material ScopeGreen

Territorial ScopeAmber

Regulator Registration And FilingAmber

lawful_processing_and_special_dataLawful Processing & Special Data4 sub-modules4 claimsGreen▾#

Sub-modules (4)

Lawful BasesGreen

Consent ThresholdsGreen

Special CategoriesAmber

Pseudonymisation And AnonymisationAmber

data_subject_rightsData Subject Rights5 sub-modules3 claimsGreen▾#

Sub-modules (5)

Access RightGreen

Rectification And ErasureAmber

Restriction And ObjectionAmber

Data PortabilityAmber

Deadlines And Response WindowsAmber

controller_processor_dutiesController/Processor Duties7 sub-modules5 claimsGreen▾#

Sub-modules (7)

Accountability And DpiaGreen

Dpo RequirementsAmber

Ropa RequirementsAmber

Joint Controller ArrangementsAmber

Security MeasuresGreen

Breach NotificationAmber

Retention And DisposalGreen

Controller/Processor Duties

Outlook

Controller/Processor Duties

Outlook

cross_border_and_adequacyCross-Border & Adequacy6 sub-modules3 claimsAmber▾#

Sub-modules (6)

Transfer MechanismsAmber

Adequacy ReceivedAmber

Adequacy GrantedAmber

Sccs And BcrsRed

Transfer Impact AssessmentRed

Data LocalisationAmber

Cross-Border & Adequacy

Outlook

Cross-Border & Adequacy

Outlook

sectoral_watchSectoral Watch7 sub-modules1 claimAmber▾#

Sub-modules (7)

Financial Sector OverlayRed

Health Sector OverlayGreen

Telecoms And EprivacyAmber

Employment DataAmber

Credit And ScoringRed

EducationRed

InsuranceRed

adtech_and_commercial_privacyAdTech & Commercial Privacyred6 sub-modules1 claimRed▾#

Sub-modules (6)

Cookies And TrackersAmber

Dark PatternsRed

Opt Out SignalsRed

Clean Rooms And DcrRed

Cross Context AdvertisingRed

Direct MarketingRed

#

#

#

#

#

#

#

#

#

#