GDPR and Data Protection in Portugal

Diagram text version

Find the EU establishment. Locate the processing. Choose the lawful basis.

When the GDPR applies in Portugal and what a company must do about notices, records, DPOs, breaches and data rights.

When does the GDPR apply in Portugal?

GDPR Article 3(1) applies when personal data are processed in the context of an establishment in the Union, regardless of where the processing takes place. Article 3(2) reaches a non-EU controller or processor that offers goods or services to people in the Union or monitors their behaviour there. Your company should identify the establishment, the people concerned and the processing purpose before deciding which territorial paragraph applies.

The territorial test concerns the activity, not a company’s marketing description. A Portuguese office can bring processing into Article 3(1) even where a supplier hosts the system elsewhere. A business outside the Union can fall within Article 3(2) for a particular EU-facing activity. The data flows and the contractual parties determine which paragraph applies.

GDPR Article 27 generally calls for a representative in the Union where Article 3(2) applies, subject to its exceptions. You should record who determines the purposes and means of processing and who acts on those instructions. That distinction governs later duties for notices, processor contracts and breach reports.

Which lawful basis permits processing?

GDPR Article 5 requires lawful, fair and transparent processing for specified purposes and restricts collection to data necessary for those purposes. Article 6(1) supplies six alternative lawful bases, including consent, contract necessity, legal obligation and legitimate interests. Your company should identify a basis for each purpose before it starts using the data.

A contract with a customer does not turn every later use of customer data into contract necessity. The precise use has to match the Article 6 condition claimed for it. You should record why the chosen basis applies and ensure the notice reflects that choice. Article 5(2) places accountability for compliance on the controller.

GDPR Article 9(1) separately prohibits processing specified special categories, such as health data, unless an Article 9(2) condition applies. Your company should identify whether a dataset contains those categories before applying a general customer-data policy to it.

What must a privacy notice say and when?

GDPR Article 13 requires a controller collecting data directly from a person to provide the prescribed information at collection. Article 14 applies to indirectly obtained data and generally sets a reasonable period no later than one month, or the first communication or disclosure where that occurs earlier. Your company should identify the collection route before deciding which notice and timing rule applies.

The articles call for the controller’s identity and contact details, purposes and bases, recipients or recipient categories, retention information, rights and information about transfers and automated decisions where relevant. The required list differs with the collection route and the circumstances. Each collection route, such as a customer form, an employee record or an externally sourced contact list, has to be matched to Article 13 or Article 14.

GDPR Article 12 requires concise, transparent, intelligible and easily accessible information in clear language. You should place the information where the person receives or first encounters the data request. Article 14 has exceptions, including cases where the person already has the information, and each exception depends on the actual source and use.

When are records and an impact assessment required?

GDPR Article 30 requires controllers and processors to maintain specified records of processing. Article 30(5) provides a limited under-250-person exception, but its exception is subject to the processing and risk conditions in that paragraph. Your company should catalogue each recurring activity and the data categories before relying on the exception.

A controller record includes purposes, categories of people and data, recipient categories, transfers, envisaged deletion periods where possible and a general security description. A processor record has a different list under Article 30(2). In a supplier arrangement each organisation keeps the record that fits its own role.

GDPR Article 35 requires a data-protection impact assessment before processing likely to create high risk. Its examples include systematic and extensive automated evaluation with significant effects, large-scale special-category processing and large-scale systematic monitoring of public areas. You should assess a proposed operation before deployment and record the reasons for the risk conclusion.

When must a company appoint a DPO?

GDPR Article 37 requires a data-protection officer for a public authority or body, and for specified large-scale monitoring or large-scale special-category or criminal-offence processing. Your company should assess its core activity, scale and the data categories against each Article 37 trigger.

GDPR Articles 38 and 39 require access, independence and defined tasks for the officer. You should decide how the officer can advise on impact assessments, monitor compliance and act as a contact point. CNPD explains that an organisation must publish the DPO’s contact details and communicate them to CNPD through its dedicated form.

CNPD states that it does not certify DPOs. Its guidance calls for each Portuguese group company obliged to appoint a DPO to make its own notification. Article 37(2) governs whether a shared officer arrangement is permitted, and each obliged group company must still make its own CNPD communication.

What happens after a personal-data breach?

GDPR Article 33(1) requires a controller to notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness when a breach is likely to create risk to people’s rights and freedoms. The controller must give reasons for a notification made after 72 hours. Your company should establish the awareness time and risk basis from the incident record.

Article 33(2) requires a processor to notify its controller without undue delay after becoming aware. Article 33(5) requires the controller to document every personal-data breach, including its facts, effects and remedial action, even where notification is unnecessary. Your company should preserve that record and distinguish a processor message from the controller’s report to CNPD.

GDPR Article 34 requires communication to affected people without undue delay when the risk is high, subject to its listed exceptions. CNPD provides its breach-notification channel and guidance. The incident’s actual data, exposure and mitigation are compared with the two separate thresholds to decide what each communication contains.

What must supplier contracts and transfers cover?

GDPR Article 28(3) requires a controller-processor contract or legal act with specified terms, including subject, duration, purposes, data categories, documented instructions, confidentiality, security and assistance with rights and incidents. Your company should identify which supplier processes data on its instructions and make the operative terms part of that relationship.

GDPR Article 32 calls for appropriate technical and organisational security measures in light of risk. The article names examples such as pseudonymisation, encryption, resilience and regular assessment. Your company should relate each measure to the data and threats in the particular system, then keep evidence that the measures operate.

GDPR Chapter V governs transfers of personal data to a third country or international organisation. Articles 45 and 46 set routes through an adequacy decision or appropriate safeguards; Article 49 contains specific derogations. The destination, recipient and transfer mechanism are identified before a cross-border contract is signed.

How quickly must a company answer a rights request?

GDPR Article 12(3) requires a controller to tell a person what action it took on an Articles 15 to 20 request without undue delay and within one month of receipt. A complex request or several requests can justify an extension of two further months, but the controller must explain the extension within the first month. Your company should record receipt and the response decision.

The rights include access, rectification, erasure, restriction, portability and objection under their respective conditions. The controller identifies the right invoked, verifies identity when justified and assesses any statutory limitation. You should avoid treating a request for access as automatic entitlement to another person’s confidential information.

GDPR Article 77 allows a person to complain to a supervisory authority. Lei n.º 58/2019 Article 3 identifies the Comissão Nacional de Proteção de Dados as the Portuguese authority. You should keep the request, response and reasons together because a later complaint may concern both timing and substance.

Which Portuguese law applies alongside the GDPR?

Lei n.º 58/2019 implements the GDPR in Portugal and identifies the Comissão Nacional de Proteção de Dados in Article 3. Its Articles 13 and 14 address data-protection officers in the Portuguese framework, and Articles 37 to 45 address sanctions and related procedure. Your company should read the national provisions with the directly applicable GDPR article that governs the processing.

The Portuguese statute does not replace the Article 6 lawful-basis test, Article 13 and 14 notice duties or Article 33 breach threshold. Some Portuguese provisions add a local rule to the Union framework. You should keep the current statute and the GDPR version used for a decision with the compliance record.

The case may concern employment, customer analytics or a supplier outside the Union. Each creates a different fact pattern under the same articles. The actual data flow, contracts and notices show which rules apply to the activity that occurs.

Published by Advisors in Portugal Published: 20 Sept 2026 Last reviewed: 7 Oct 2026