Support Centre



Law: Law No. 58/2019, which Ensures the Implementation in the National Legal Order of the General Data Protection Regulation (Regulation (EU) 2016/679) on the Protection of Individuals with Regards the Processing of Personal Data and the Free Movement of Such Data (only available in Portuguese here) ('the GDPR Implementation Law') and the General Data Protection Regulation (Regulation (EU) 2016/679)

Regulator: Portuguese data protection authority ('CNPD')

Summary: Both the GDPR and the GDPR Implementation Law are fully applicable in Portugal. However, in September 2019, the CNPD approved Decision 494/2019 (only available in Portuguese here), which sought to ensure the rule of EU law and the full effectiveness of the GDPR by disregarding certain articles of the GDPR Implementation Law, including Article 28(3) regarding employee consent to data processing, Article 39(1) regarding the determination of fines, and Article 20(1) regarding data subjects' right to information. The CNPD's general duty is to supervise and monitor compliance with the laws and regulations in the area of personal data protection with strict respect for human rights and the fundamental freedoms and guarantees enshrined in the Constitution of the Portuguese Republic 1976 ('the Constitution') and the law.


Considering the growing number of attacks on personal data and the need to further create protective measures and provide for some degree of regulatory certainty, the Portuguese data protection authority ('CNPD') published a set of guidelines ('the Guidelines')1 in which it details a list of measures that controllers and processors can take into consideration in relation to the processing (and protection) of personal data. Pedro Marques Gaspar, Manager at PwC, explores the Guidelines and what companies can expect.

On 25 January 2022, the Portuguese data protection authority ('CNPD') approved guidance on the processing of personal data in the context of direct marketing electronic communications ('the Guidance'). João Peixe, Senior Associate at Vasconcelos Arruda & Associados, discusses the contents of the Guidance.