Portugal

The Portuguese implementing statute is Lei n.º 58/2019 of 8 August 2019. Its Article 2 states that the statute applies to processing carried out in national territory whatever the nature of the controller, and extends to controllers established outside the European Union where they offer goods or services to data subjects in Portugal. In Deliberação/2019/494 of 3 September 2019 the national regulator decided not to apply Article 2(1) and 2(2) in the cases it handles, on the ground that the territorial scope of the Regulation is set by Article 3 of the Regulation itself and a member state cannot narrow it, widen it or restate it. In practice, therefore, scope is decided by Article 3 of the Regulation and by Article 27 on European representatives, not by the Portuguese text. Health regulator guidance restates the same territorial wording, which is why a naive reading of the Portuguese statute alone will mislead you.

Sector by sector, checked on 18 August 2026. ONLINE GAMBLING — the hardest wall in the country. The Legal Framework for Online Games and Betting requires licensed operators to install the entry-and-registration infrastructure in national territory, to store gambling activity data in national territory for ten years, and to keep every component of the technical gaming system in premises the regulator can enter at any time, with remote access from the regulator's own offices whatever the location of the equipment. Rating: a copy must stay in the country. TAX, INVOICING AND ACCOUNTING RECORDS — a real and widely missed rule. Books, records and supporting documents must be kept for ten calendar years at premises inside Portugal; electronic archiving escapes the national-premises rule only if complete online access to the data is guaranteed. An electronic archive may sit anywhere in the European Union without asking. Outside the European Union it needs prior authorisation from the tax office, and locating the invoicing software itself in a third country needs a separate prior authorisation plus a user account that lets the tax office query the live system in real time from terminals inside Portugal. Rating: data can leave with paperwork, with a case-by-case government permission for third countries. BANKING, PAYMENTS, INSURANCE AND SECURITIES — no Portuguese localisation rule found, checked 18 August 2026. These firms are governed by the European Union's Digital Operational Resilience Act since 17 January 2025, which requires you to disclose where data is processed, to keep audit and exit rights, and imposes no storage location. The Banco de Portugal published a notice in December 2025 on registering and reporting outsourcing arrangements; we could not open the bank's own site to verify its text and treat it as a reporting duty, not a location duty. Rating: data can leave with paperwork, low-to-medium confidence. HEALTH — no localisation rule found, checked 18 August 2026. What Portugal adds instead is secrecy and traceability: health and genetic data may only be handled on a need-to-know basis by people bound by professional secrecy, and the patient must be told about every access to their record. Rating: data can leave with paperwork. TELECOMS — no localisation rule found, checked 18 August 2026. The obligation runs the other way: connection data must be erased or anonymised once it is no longer needed to carry the communication. GOVERNMENT — no binding localisation rule found. The National Sovereign Cloud Plan approved on 14 May 2026 sorts public data and processes by importance and attaches security rules to each level, rather than naming a country. Public bodies must classify their processes by 30 June 2027. Rating: data can leave with paperwork today, with an obvious route to something stricter through procurement rules. EDUCATION, DEFENCE, MAPPING AND GEOSPATIAL DATA — no rule found, checked 18 August 2026, medium confidence. We did not locate a mapping or aerial-imagery storage restriction on an official site. At European level, Regulation (EU) 2018/1807 forbids member states from imposing storage location rules on non-personal data except on public-security grounds, which is one reason Portugal's walls are drawn around gambling supervision and tax inspection rather than around data as such.

European layer, verified 18 August 2026. Approved destinations are Andorra, Argentina, Brazil (new, 26 January 2026, mutual), Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the United States but only for organisations self-certified under the European Union-United States Data Privacy Framework, plus the European Patent Organisation. None has been withdrawn or suspended. The 2021 standard contractual clauses remain the operative set and are unamended; the promised new clauses for importers already directly caught by the Regulation are still not adopted. Binding corporate rules remain available. The narrow derogations, including consent, are not a basis for routine or bulk transfers. A transfer impact assessment is still expected. The Data Privacy Framework is the most time-sensitive item on this page. It is in force and legally valid today, but the General Court dismissed the Latombe challenge on 3 September 2025 and an appeal to the Court of Justice was lodged on 31 October 2025 and is pending; separately, on 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether changes to United States oversight bodies affect the decision's validity. The Commission has neither suspended nor revoked it. Never build a single-mechanism architecture on it. Portuguese layer. In December 2022 the national regulator fined the national statistics institute 4.3 million euro (roughly 4.7 million United States dollars) over the 2021 census, and one of the five findings was an unlawful transfer: the contract with a United States provider contained the Commission's standard clauses but no supplementary measures against access by that country's authorities. The lesson is that in Portugal the paperwork alone is not treated as sufficient. For tax records the model is different again: inside the European Union, no permission; outside, a case-by-case authorisation from the tax office, requested electronically, in which you identify the third country and show the legal conditions are met.

The regulator's own activity report for 2025, approved on 24 March 2026, is unusually candid. Headcount rose from 28 to 36 people after nineteen recruitments, which the report still calls insufficient. Two members left in August and September 2025 and had not been replaced by the date the report was approved, leaving a five-member body chaired by Paula Cristina Meira Lourenço. In 2025 it opened 3,201 files (up 12 percent), of which 2,037 were investigations; it started 88 administrative-offence proceedings; it issued 267 draft accusations and 262 final decisions; it adopted 480 decisions in data-breach files; and it gave 85 formal opinions on draft laws. It applied two fines totalling 47,000 euro, one against a local authority and one against a private company for unsolicited marketing messages, and it states that the 88 open proceedings could have produced 90 fines had they been completed. So the machine works and the tap is nearly closed; the correct planning assumption is that fines will rebound as staffing improves, and that in the meantime the real risk is an order to stop processing rather than a cheque. The regulator is willing to use blunt powers. In June 2022 it ordered every telecommunications provider to delete, within 72 hours, all data retained under the provision the Constitutional Court had just struck down. In December 2022 it fined a public body 4.3 million euro. Other enforcers: the gambling regulator inside Turismo de Portugal licenses and audits online operators and can enter the premises hosting the gaming system; the tax office authorises and can refuse third-country archives; the communications regulator supervises telecoms; the National Cybersecurity Centre runs the incident regime; the central bank, the insurance authority and the securities commission supervise financial firms. Rating: active, with the honest caveat about fine volume.

Floors verified on official sources. Ten calendar years for books, records and supporting documents under the value added tax code, kept in good order and, on paper, at premises inside Portugal. Ten years inside Portugal for online gambling activity data. Health records carry secrecy and access-notification duties rather than a single national deletion date. Ceilings. Under the electronic communications privacy statute, traffic data must be erased or anonymised when no longer needed to transmit the communication; processing for billing is allowed only until the end of the period in which the bill can lawfully be contested or payment claimed; anything beyond that, such as marketing or value-added services, needs the subscriber's prior consent, revocable at any time. How the conflict is resolved. Portugal does not have a single tie-break rule. In practice the answer is the ordinary European one: a specific statutory duty to keep a document is a legal obligation that justifies keeping it, but only that document, only for the stated period and only for that purpose. The trap is treating a ten-year tax duty as permission to keep the whole customer database for ten years. There is no longer a blanket duty on telecommunications operators to keep everyone's connection records: the Constitutional Court struck that down in April 2022 and the regulator ordered the stored data deleted.

Clock one, privacy. The 72-hour deadline to notify the supervisory authority and the duty to warn individuals where the risk is high come straight from the European Regulation and are enforced by the national commission, which took 480 decisions in breach files in 2025 and recorded 472 breach reports, 42 percent more than the year before. Human error was the leading cause with 128 cases, phishing second with 72. Clock two, telecoms. Providers of publicly available electronic communications services report personal data breaches under the European rules made for that sector, which set a 24-hour first notification to the competent authority. Clock three, cybersecurity. The new national cybersecurity regime, approved by decree-law published on 4 December 2025 under a parliamentary authorisation of 22 October 2025, transposes Europe's second network and information security directive. That directive's pattern is an early warning within 24 hours, a fuller incident notification within 72 hours and a final report within one month, and registration of in-scope organisations with the national centre. We could not open the official Portuguese text to confirm each deadline as enacted, so treat the Portuguese specifics as medium confidence. The overlap is the operational risk. One ransomware incident at a Portuguese telecoms firm can trigger all three clocks, run by three different authorities, with the shortest one being 24 hours.

One. Age of consent. Portugal set 13 as the minimum age at which a child can consent to online services, the lowest band the European Regulation allows and three years below the default. The education ministry's own guidance confirms it and adds that services should verify age using secure authentication. If your global product assumes 16, you are over-blocking Portuguese teenagers; if it assumes 13 everywhere, you are under-protecting children elsewhere. Two. Health data traceability. Access to health and genetic data runs on a need-to-know principle, must be handled by someone bound by professional secrecy, and the person the data is about must be notified of any access to it, with the organisation responsible for providing the traceability and notification mechanism. Very few electronic record systems ship with this switched on. Three. Criminal liability. The Portuguese privacy statute creates criminal offences, including using data in a way incompatible with the purpose it was collected for, improper access to personal data, and breach of the duty of secrecy. On top of that the Criminal Code punishes revealing a secret learned through your job with up to one year in prison or a fine. These attach to people, not only companies, and no cyber-insurance policy fixes them. Four. The tax stack. Invoicing software used in Portugal must be certified in advance by the tax office and appear on its published list. Paper accounting archives must be at premises in Portugal. An electronic archive may sit anywhere in the European Union, but outside it you need prior authorisation, and if the invoicing system itself sits in a third country you must create a tax-office user account able to query the live system in real time from terminals inside Portugal. Foreign software-as-a-service billing platforms fail this test more often than anything else on this page. Five. The statute you cannot trust to a text search. Since September 2019 the regulator has publicly refused to apply nine sets of provisions of the national implementing statute, including its scope rule, parts of the fining rules and two transitional provisions, on the ground that they contradict the European Regulation. They remain printed in the law. A search of the statute will therefore return rules that will not be enforced, and advice built on them is wrong in both directions. Sixth, smaller: you must tell the regulator who your data protection officer is. Portugal set no deadline for doing so, which is exactly why organisations forget.

Dated items. 12 January 2027: under the European Data Act all cloud switching charges and data egress fees must fall to zero. 30 June 2027: Portuguese public bodies must have classified their processes, data and systems under the National Sovereign Cloud Plan approved on 14 May 2026, with the qualification methodology set by the state transformation agency and the National Cybersecurity Centre. Through 2026 and 2027: staged application of the national cybersecurity regime published on 4 December 2025, including registration with the National Cybersecurity Centre. Also live: the appeal against the European Union-United States Data Privacy Framework before the Court of Justice, and the European Data Protection Board's letter of 31 July 2026 asking the Commission to re-examine that framework. Dormant switches, which matter more than pending bills. First, general retention of everyone's telephone and internet connection records. Parliament has legislated for it before, the Constitutional Court struck the rules down in April 2022 and struck down a replacement in December 2023, and the 2024 statute deliberately replaced blanket retention with judge-ordered preservation in serious-crime cases. Political pressure to try again is constant, and a new law could be passed and in force within weeks. Second, the tax office's authorisation power: it decides whether your archive or invoicing system may sit outside Europe, it can attach conditions, and nothing stops it tightening its practice without new legislation. Third, the gambling regulator's power to require that every component of the technical gaming system be somewhere it can reach, which is an access rule that can be exercised as a location rule. Fourth, sovereign cloud classification: the plan is deliberately risk-based rather than location-based today, but the classification exercise is exactly the machinery through which a location rule could be introduced later at procurement level, with no new statute.