Portugal

The Portuguese law is Lei n.º 58/2019 of 8 August 2019. Its Article 2 says the law covers any use of data in Portugal, whoever is doing it. It also says it covers companies based outside the European Union that offer goods or services to people in Portugal. In Deliberação/2019/494 of 3 September 2019 the national regulator decided not to apply Article 2(1) and 2(2) in the cases it handles. Its reason was that Article 3 of the European Regulation already sets who is covered. A member state cannot narrow it, widen it or restate it. So who is covered is decided by Article 3 of the Regulation. When you need a European representative is decided by Article 27 of the Regulation. The Portuguese text decides neither. Health regulator guidance repeats the same Portuguese wording. That is why reading the Portuguese law on its own will mislead you.

Industry by industry, checked on 18 August 2026. ONLINE GAMBLING has the strictest rule in the country. The Legal Framework for Online Games and Betting covers licensed operators. They must install the entry-and-registration system in Portugal. They must store gambling activity data in Portugal for ten years. Every part of the technical gaming system must sit in premises the regulator can enter at any time. The regulator must also be able to reach it remotely from its own offices, wherever the equipment is. Rating: a copy must stay in the country TAX, INVOICING AND ACCOUNTING RECORDS is a real rule that people miss. Books, records and supporting documents must be kept for ten calendar years at premises inside Portugal. An electronic archive escapes that only if you guarantee complete online access to the data. An electronic archive may sit anywhere in the European Union without asking. Outside the European Union you need the tax office's permission first. Putting the invoicing software itself outside the European Union needs a second, separate permission. You must also give the tax office an account that can query the live system in real time from terminals inside Portugal. Rating: data can leave only if conditions are met, with government permission decided case by case for countries outside the European Union. BANKING, PAYMENTS, INSURANCE AND SECURITIES: we found no Portuguese rule keeping data in the country, checked 18 August 2026. These firms follow the European Union's Digital Operational Resilience Act, which started on 17 January 2025. It makes you say where data is handled and keep audit and exit rights. It sets no storage location. The Banco de Portugal published a notice in December 2025 about registering and reporting outsourcing deals. We could not open the bank's own site to check the text. We treat it as a reporting duty, not a location duty. Rating: data can leave only if conditions are met, low-to-medium confidence. HEALTH: we found no rule keeping data in the country, checked 18 August 2026. Portugal adds secrecy and traceability instead. Health and genetic data may only be handled on a need-to-know basis. The people handling it must be bound by professional secrecy. The patient must be told about every access to their record. Rating: data can leave only if conditions are met TELECOMS: we found no rule keeping data in the country, checked 18 August 2026. The duty runs the other way. Connection data must be erased or made anonymous once it is no longer needed to carry the communication. GOVERNMENT: we found no binding rule keeping data in the country. The National Sovereign Cloud Plan was approved on 14 May 2026. It sorts public data and work by importance and attaches security rules to each level. It does not name a country. Public bodies must classify their work by 30 June 2027. Rating: data can leave only if conditions are met today. Buying rules are the obvious route to something stricter later. EDUCATION, DEFENCE, MAPPING AND GEOSPATIAL DATA: we found no rule, checked 18 August 2026, medium confidence. We did not find a mapping or aerial-imagery storage restriction on an official site. At European level, Regulation (EU) 2018/1807 stops member states from making storage location rules for data that is not about people. The only exception is public security. That is one reason Portugal's rules are drawn around gambling supervision and tax inspection instead.

European layer, checked 18 August 2026. The officially approved destinations are Andorra, Argentina, Brazil, Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, Uruguay, and the European Patent Organisation. Brazil is new, approved on 26 January 2026, and that approval runs both ways. South Korea's first review was confirmed on 23 July 2026. The United Kingdom's approval was renewed on 19 December 2025 and runs to 2031. The United States counts only for organisations that have self-certified under the European Union-United States Data Privacy Framework. None has been withdrawn or suspended. The 2021 standard contractual clauses are still the set in use and are unchanged. New clauses were promised for recipients already directly covered by the Regulation. They are still not adopted. Approved group-wide rules remain available. The narrow exceptions, including consent, cannot be used for routine or bulk transfers. You are still expected to write a transfer impact assessment. The Data Privacy Framework is the item on this page most likely to change. It is in force and legally valid today. The General Court dismissed the Latombe challenge on 3 September 2025. An appeal to the Court of Justice was lodged on 31 October 2025 and is pending. Separately, the European Data Protection Board wrote to the Commission on 31 July 2026. It asked the Commission to examine whether changes to United States oversight bodies affect the decision's validity. The Commission has neither suspended nor revoked it. Do not make it your only route. Portuguese layer. In December 2022 the national regulator fined the national statistics institute 4.3 million euro (roughly 4.7 million United States dollars) over the 2021 census. One of the five findings was an unlawful transfer. The contract with a United States supplier used the Commission's standard clauses. It had no extra measures against access by that country's authorities. In Portugal, the paperwork on its own is not treated as enough. Tax records work differently again. Inside the European Union you need no permission. Outside it, you ask the tax office case by case. You apply electronically, name the country and show the legal conditions are met.

The regulator's own activity report for 2025 was approved on 24 March 2026. It is unusually honest. Headcount rose from 28 to 36 people after nineteen recruitments. The report still calls that insufficient. Two members left in August and September 2025 and had not been replaced when the report was approved. That leaves a five-member body chaired by Paula Cristina Meira Lourenço. In 2025 it opened 3,201 files, up 12 percent. Of those, 2,037 were investigations. It started 88 administrative-offence cases. It issued 267 draft accusations and 262 final decisions. It took 480 decisions in data-breach files. It gave 85 formal opinions on draft laws. It applied two fines totalling 47,000 euro. One was against a local authority. The other was against a private company for unsolicited marketing messages. The report says the 88 open cases could have produced 90 fines had they been finished. So the machine works but almost nothing comes out of it. Plan for fines to rebound as staffing improves. Until then, your real risk is an order to stop using the data, not a bill. The regulator will use blunt powers. In June 2022 it ordered every telecommunications provider to delete all data kept under the rule the Constitutional Court had just struck down. It gave them 72 hours. In December 2022 it fined a public body 4.3 million euro. Other enforcers. The gambling regulator inside Turismo de Portugal licenses and audits online operators. It can enter the premises holding the gaming system. The tax office approves or refuses archives outside the European Union. The communications regulator supervises telecoms. The National Cybersecurity Centre runs incident reporting. The central bank, the insurance authority and the securities commission supervise financial firms. Rating: active, with the honest warning about how few fines it issues.

Minimums, checked against official sources. Ten calendar years for books, records and supporting documents under the value added tax code. They must be kept in good order. On paper, they must be at premises inside Portugal. Ten years inside Portugal for online gambling activity data. Health records carry secrecy and access-notification duties instead of a single national deletion date. Maximums. Under the electronic communications privacy law, traffic data must be erased or made anonymous when it is no longer needed to carry the communication. You may keep it for billing only until the period for disputing the bill or claiming payment ends. Anything beyond that, such as marketing or extra services, needs the subscriber's consent first. The subscriber can withdraw that consent at any time. How the clash is resolved. Portugal has no single tie-break rule. The answer is the ordinary European one. A specific legal duty to keep a document is a lawful reason to keep it. But only that document, only for the stated period and only for that purpose. The trap is treating a ten-year tax duty as permission to keep your whole customer database for ten years. Telephone and internet companies no longer have to keep everyone's connection records. The Constitutional Court struck that down in April 2022. The regulator then ordered the stored data deleted.

Clock one, privacy. You have 72 hours to tell the supervisory authority. You must warn individuals where the risk to them is high. Both come straight from the European Regulation. The national commission enforces them. In 2025 it took 480 decisions in breach files and recorded 472 breach reports, 42 percent more than the year before. Human error was the leading cause with 128 cases. Phishing was second with 72. Clock two, telecoms. Companies providing public electronic communications services report personal data breaches under the European rules for that industry. Those rules set a 24-hour first notification to the competent authority. Clock three, cybersecurity. Portugal's new national cybersecurity law was published as a decree-law on 4 December 2025. It rests on a parliamentary authorisation of 22 October 2025. It brings in Europe's second network and information security directive. That directive's pattern is an early warning within 24 hours, a fuller notification within 72 hours and a final report within one month. Covered organisations must also register with the national centre. We could not open the official Portuguese text to confirm each deadline as enacted. Treat the Portuguese details as medium confidence. The overlap is the real operational risk. One ransomware attack at a Portuguese telecoms firm can start all three clocks. Three different authorities are involved. The shortest deadline is 24 hours.

One. Age of consent. Portugal set 13 as the youngest age at which a child can agree to online services. That is the lowest the European Regulation allows and three years below the default. The education ministry's guidance confirms it. It adds that services should check age using secure log-in. If your global product assumes 16, you are blocking Portuguese teenagers who are allowed in. If it assumes 13 everywhere, you are under-protecting children elsewhere. Two. Health data traceability. Access to health and genetic data runs on a need-to-know basis. It must be handled by someone bound by professional secrecy. The person the data is about must be told of any access to it. Your company has to provide the tracking and notification tool. Very few electronic record systems come with this switched on. Three. Criminal liability. The Portuguese privacy law creates crimes. They include using data in a way that does not match why it was collected, improper access to personal data, and breaking the duty of secrecy. The Criminal Code also punishes revealing a secret you learned through your job. That carries up to one year in prison or a fine. These attach to people, not only companies. No cyber-insurance policy fixes them. Four. The tax stack. Invoicing software used in Portugal must be approved in advance by the tax office and appear on its published list. Paper accounting archives must be at premises in Portugal. An electronic archive may sit anywhere in the European Union. Outside it you need permission first. If the invoicing system itself sits outside the European Union, you must create a tax office account. That account must be able to query the live system in real time from terminals inside Portugal. Foreign cloud billing platforms fail this test more often than anything else on this page. Five. The law you cannot trust to a text search. Since September 2019 the regulator has publicly refused to apply nine sets of rules in the national law. They include its scope rule, parts of the fining rules and two transitional rules. The regulator says they contradict the European Regulation. They are still printed in the statute. A search of Portuguese law will return rules that will not be enforced. Advice built on them is wrong in both directions. Six, smaller. You must tell the regulator who your data protection officer is. Portugal set no deadline for doing so. That is exactly why companies forget.

Dated items. 12 January 2027: under the European Data Act, all cloud switching charges and data export fees must fall to zero. 30 June 2027: Portuguese public bodies must have classified their work, data and systems under the National Sovereign Cloud Plan approved on 14 May 2026. The state transformation agency and the National Cybersecurity Centre set the method. Through 2026 and 2027: the national cybersecurity law published on 4 December 2025 comes into force in stages. That includes registering with the National Cybersecurity Centre. Also live: the appeal against the European Union-United States Data Privacy Framework before the Court of Justice. And the European Data Protection Board's letter of 31 July 2026 asking the Commission to look at that decision again. Powers that already exist and could be switched on. These matter more than pending bills. First, keeping everyone's telephone and internet connection records. Parliament has legislated for it before. The Constitutional Court struck the rules down in April 2022 and struck down a replacement in December 2023. The 2024 law deliberately swapped blanket keeping for judge-ordered preservation in serious-crime cases. Political pressure to try again is constant. A new law could be passed and in force within weeks. Second, the tax office's permission power. It decides whether your archive or invoicing system may sit outside Europe. It can attach conditions. Nothing stops it tightening its practice without new legislation. Third, the gambling regulator's power to demand that every part of the technical gaming system sit somewhere it can reach. That is an access rule that can be used as a location rule. Fourth, sovereign cloud classification. The plan sorts by risk rather than by country today. But the sorting exercise is exactly the machinery for adding a location rule later through buying rules, with no new statute.