Law: Law No. 58/2019, which Ensures the Implementation in the National Legal Order of the General Data Protection Regulation (Regulation (EU) 2016/679) on the Protection of Individuals with Regards the Processing of Personal Data and the Free Movement of Such Data (only available in Portuguese here) ('the GDPR Implementation Law') and the General Data Protection Regulation (Regulation (EU) 2016/679)

Regulator: Portuguese data protection authority ('CNPD')

Summary: Both the GDPR and the GDPR Implementation Law are fully applicable in Portugal. However, in September 2019, the CNPD approved Decision 494/2019 (only available in Portuguese here), which sought to ensure the rule of EU law and the full effectiveness of the GDPR by disregarding certain articles of the GDPR Implementation Law, including Article 28(3) regarding employee consent to data processing, Article 39(1) regarding the determination of fines, and Article 20(1) regarding data subjects' right to information. The CNPD's general duty is to supervise and monitor compliance with the laws and regulations in the area of personal data protection with strict respect for human rights and the fundamental freedoms and guarantees enshrined in the Constitution of the Portuguese Republic 1976 ('the Constitution') and the law.