Data protection & privacy law in Portugal (2026)

Legal framework

EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) as the directly-applicable baseline, executed nationally by Lei n.º 58/2019 of 8 August; supervised by the Comissão Nacional de Proteção de Dados (CNPD)

GDPR & data protection in Portugal

In Portugal, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the National Data Protection Commission (CNPD).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the National Data Protection Commission (CNPD)

Applies to

any organisation processing the personal data of people in Portugal, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Portugal supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Portugal

1. 01Comprehensive regime: GDPR + Lei 58/2019

   The GDPR applies directly. Law no. 58/2019 of 8 August does not transpose the GDPR but 'ensures its execution' in Portugal, filling the discretionary openings the Regulation leaves to member states (e.g., processing in employment, health, special data, minors' digital-consent age set at 13).

   gdprhub.eu dlapiperdataprotection.com

2. 02Supervisory authority: CNPD

   The Comissão Nacional de Proteção de Dados is the national data protection authority, an independent administrative body with legal personality and administrative/financial autonomy operating under the Portuguese Parliament. It holds investigative and corrective powers, can impose administrative fines, issues binding decisions, opinions on legislation and sectoral guidelines.

   www2.gov.pt gdprhub.eu

3. 03CNPD disapplied parts of the national law

   In Deliberation 494/2019, weeks after Law 58/2019 entered into force, the CNPD decided not to apply several of its provisions (including aspects of fines, retention, and public-interest processing), holding them incompatible with the directly-applicable GDPR, a notable feature of how the regime operates in practice.

   espanhaassociados.pt gdprhub.eu

4. 04Law-enforcement data: Lei 59/2019

   Law no. 59/2019 of 8 August governs the processing of personal data for the prevention, detection, investigation or prosecution of criminal offences and enforcement of penalties, transposing the EU Law Enforcement Directive (Directive (EU) 2016/680).

   dlapiperdataprotection.com gdprhub.eu

5. 05ePrivacy / cookies: Lei 41/2004

   Law no. 41/2004 of 18 August transposes the ePrivacy Directive (2002/58/EC), regulating privacy in electronic communications. Cookies and similar trackers require prior informed consent unless strictly necessary to provide a user-requested service; the CNPD has issued guidance on cookies and electronic direct marketing.

   cms.law dlapiperdataprotection.com

6. 06Core obligations and data-subject rights

   Controllers/processors must observe GDPR principles (lawfulness, transparency, purpose/data minimisation, security), maintain records, conduct DPIAs, appoint DPOs where required, and report breaches. Data subjects hold GDPR rights, access, rectification, erasure, restriction, portability and objection, enforceable via the CNPD, whose binding decisions are appealable to the administrative courts.

   gdprhub.eu practiceguides.chambers.com

GDPR in Portugal: FAQ

Timeline of decisions

1. 31 Dec 2025Enforcement
   CNPD 2025 enforcement: only 2 fines (€47,000 total) despite 3,201 opened processes

   Portugal's data watchdog opened a record 3,201 investigation processes and received 472 breach notifications in 2025, a 42 % rise from 2024, yet issued just 2 sanctions totalling €47,000, a collapse attributed to severe resource constraints with only 36 staff and procedural backlogs.

   ppc.land (citing CNPD 2025 Annual Report)

2. 23 Jan 2025Law · official
   Law 2/2025: Portugal implements the EU Data Governance Act nationally

   Law 2/2025 of 23 January transposed Regulation (EU) 2022/868 into domestic law, establishing rules on the re-use of public-sector data, data intermediary services, and data altruism organisations, extending Portugal's data regulatory perimeter beyond personal-data protection.

   Diário da República Eletrónico (DRE)

3. 26 Mar 2024Enforcement · official
   CNPD orders Worldcoin to suspend biometric data collection for 90 days

   Portugal's data-protection authority issued Deliberação 2024/137 ordering the Worldcoin Foundation to cease iris-scan ('Orb') collection nationwide for 90 days, citing collection of minors' biometric data, denial of erasure and consent-revocation rights, and inadequate data-subject information. The investigation had been opened in August 2023 after 300,000 Portuguese had already registered; this was Portugal's first major enforcement action directly targeting an AI-powered biometric system.

   CNPD

4. 1 Dec 2022Enforcement · official
   CNPD fines national statistics institute INE €4.3 M, Portugal's largest-ever GDPR penalty

   The CNPD imposed a record €4.3 million fine on INE (Instituto Nacional de Estatística) for five violations during the 2021 national census, including unlawful processing of special-category data and failure to provide transparency notices. INE appealed to Portuguese courts; the case remained pending as of mid-2026.

   European Data Protection Board (EDPB)

5. 1 Dec 2021Enforcement
   CNPD fines Municipality of Lisbon €1.25 M for sharing protest organisers' data with foreign embassies

   The CNPD found that Lisbon's mayor's office had transmitted personal data of 52 protest organisers to foreign embassies, including Russia, on 225 occasions between 2018 and 2021, violating Articles 5 and 6 GDPR. At the time this was the largest public-body GDPR fine in Southern Europe.

   DataGuidance (citing CNPD decision)

6. 9 Aug 2019Law · official
   Lei 58/2019: Portugal's national GDPR execution law enters into force

   Law 58/2019 of 8 August exercised Portugal's GDPR member-state discretions, setting the digital consent age at 13, confirming CNPD as the sole supervisory authority, and establishing national rules for employee data, scientific research, and public-interest processing. It formally repealed Lei 67/98.

   Diário da República Eletrónico (DRE)

7. 8 Aug 2019Law
   Law 58/2019: Portugal enacts national GDPR implementation act

   Law 58/2019 adapted Portuguese law to the EU General Data Protection Regulation, confirming the CNPD (Comissão Nacional de Proteção de Dados) as the national supervisory authority. It introduced mandatory Data Protection Officers for public bodies and addressed special-category data processing, directly strengthening online privacy protections for users in Portugal.

   Osservatorio sulle Fonti / Diário da República

8. 17 Jul 2018Enforcement
   CNPD issues Portugal's first GDPR fine, €400,000 against a public hospital

   Centro Hospitalar Barreiro Montijo was fined €400,000, among the earliest GDPR fines in Europe, for granting medical-records access to 985 user accounts (only 296 were physicians), including non-medical staff, and for failing to conduct a Data Protection Impact Assessment under Article 35 GDPR.

   IAPP

9. 18 Aug 2012Law
   Law 46/2012: ePrivacy amendment, mandatory opt-in consent for cookies

   Portugal amended Law 41/2004 with Law 46/2012 to align with the revised EU ePrivacy Directive (2009/136/EC), replacing implied consent with a requirement for explicit, informed, prior opt-in consent before placing non-essential cookies. This directly shaped how Portuguese websites and online services handle user-tracking and advertising.

   ConsentStack / Diário da República

10. 18 Aug 2004Law · official
    Law 41/2004: Foundational ePrivacy law for electronic communications

    Portugal enacted Law 41/2004 to transpose EU Directive 2002/58/EC, establishing the foundational rules on privacy in electronic communications, covering confidentiality, unsolicited marketing, traffic data, and the original cookie consent framework. It remains the cornerstone ePrivacy instrument for online services, as amended in 2012 and 2022.

    Law Library of Congress

11. 18 Aug 2004Law · official
    Lei 41/2004: Portugal transposes the ePrivacy Directive, establishing cookie consent requirements

    Law 41/2004 transposed Directive 2002/58/EC, regulating confidentiality of electronic communications, traffic-data retention, and, critically, requiring prior informed consent before accessing or storing information on users' terminal equipment, creating the legal basis for cookie-consent obligations in Portugal.

    WIPO Lex (Council of Europe)

12. 26 Oct 1998Law · official
    Lei 67/98: Portugal transposes EU Data Protection Directive 95/46/EC and renames the supervisory authority CNPD

    Law 67/98 of 26 October fully transposed Directive 95/46/EC, replacing Law 10/91, introducing data subject rights of access and rectification, restricting third-country transfers, and renaming the supervisory authority from CNPDPI to the current Comissão Nacional de Proteção de Dados (CNPD).

    ANACOM (official Portuguese regulatory authority)

13. 7 Jan 1994Decision · official
    CNPDPI begins operating as Portugal's first dedicated data protection supervisory authority

    Created by Law 10/91, the Comissão Nacional de Protecção de Dados Pessoais Informatizados (CNPDPI) became operational on 7 January 1994, four years before the EU directive required member states to establish such bodies, marking the start of formal independent data-protection supervision in Portugal.

    CNPD (official)

14. 29 Apr 1991Law · official
    Law 10/91: Portugal's first comprehensive data protection statute

    Law 10/91 of 29 April was Portugal's inaugural dedicated data protection law, implementing the principles of Council of Europe Convention 108 (1981) and creating the supervisory authority (CNPDPI). It covered automated processing of personal data and laid the enforcement architecture that successive laws have built upon.

    Diário da República Eletrónico (DRE)

15. 2 Apr 1976Law · official
    Article 35 of the Portuguese Constitution embeds digital privacy rights at constitutional level

    Portugal's post-revolution Constitution, a direct response to PIDE/DGS secret-police surveillance under the Salazar dictatorship, included Article 35 ('Use of Information Technology'), guaranteeing citizens the right to access, correct, and control their computerised personal data. This pre-dated the GDPR by four decades and remains the supreme legal anchor for data protection in Portugal.

    Assembleia da República (Portuguese Parliament)

Sources

1. 1.www2.gov.pt/en-GB/entidades/comissao-nacional-de-protecao-de-dados
2. 2.gdprhub.eu/Data_Protection_in_Portugal
3. 3.gdprhub.eu/CNPD_(Portugal)
4. 4.dlapiperdataprotection.com/index.html?t=law&c=PT
5. 5.cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
6. 6.espanhaassociados.pt/deliberation-2019-494-cnpds-position-on-law-no-58-2019/?lang=en
7. 7.practiceguides.chambers.com/practice-guides/data-protection-privacy-2021/portugal