Key Data and Cybersecurity Laws | Portugal | Global Data and Cyber Handbook Lite

What are the key data privacy laws and regulations?

Last review date: 26 December 2025

Please note that this chapter focuses solely on specific local laws and regulations. Please refer to the EU chapter of the Global Data & Cyber Handbook for detailed information on EU-wide data privacy and other data-related legislation applicable across all EU Member States, such as the EU GDPR and the EU AI Act.

Personal Data Protection and Telecommunication Privacy Act (Law no. 41/2004, of 18 August, as amended by Law 46/2012 of 29 August)
Portuguese law that implemented the GDPR (Law no. 58/2019, of 8 August) and replaced the Portuguese Data Protection Act (Law no. 67/98)
Law no. 59/2019, of 8 August, concerning personal data for prevention, detection, investigation or repression of criminal infractions¹.
Regulation no. 798/2018 that foresees a list of personal data processing activities that must be subject to a Data Protection Impact Assessment ("DPIA").
Law no. 46/2018 that establishes the legal framework for cyberspace security, transposing Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (which was repealed by Decree-Law no. 125/2025, but remains applicable until such Decree enters into force).
Decree-Law no. 65/2021 that regulates the Legal Framework for Cyberspace Security and defines cybersecurity certification obligations in implementation of Regulation (EU) 2019/881 of the European Parliament of 17 April 2019 (which was repealed by Decree-Law no. 125/2025, but remains applicable until such Decree enters into force)
Regulation nº 183/2022 , establishing technical instructions on communications between entities and the CNCS (which was repealed by Decree-Law no. 125/2025, but remains applicable until such Decree enters into force).
Law no. 18/2024, that regulates access to metadata relating to electronic communications for criminal investigation purposes, amending Law no. 32/2008, of 17 July, which transposes Directive 2006/24/EC of the European Parliament and of the Council of 15 March on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks into the national legal order.
Law no. 21/2019, that regulates the transfer by air carriers of passenger name record data and the processing of such data, transposing Directive (EU) 2016/681 of the European Parliament and of the Council of April 27, 2016, and makes the third amendment to Law no. 53/2008 of August 29, approving the Internal Security Law.

[1] A note is necessary to clarify that, although this statute remains in effect, some of its crucial provisions have been declared unconstitutional (and thus inapplicable) in a final and binding decision of the Constitutional Court. In 2022, the Court issued a ruling striking down those provisions. The legislator responded in October 2023 with a proposed revised version; however, this revised text was also found unconstitutional and was subsequently set aside by the Constitutional Court. No further legislative proposal has been introduced.

What are the key cybersecurity laws and regulations?

Last review date: 26 December 2025

Please note that this chapter focuses solely on specific local laws and regulations. Please refer to the EU chapter of the Global Data & Cyber Handbook for detailed information on EU-wide cybersecurity and other data-related legislation applicable across all EU Member States, including the Cybersecurity Act, DORA, and the NIS 2 Directive.

National law:

Law no. 46/2018 that establishes the legal framework for cyberspace security, transposing Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union.
Decree-Law no. 65/2021, of 30 June, that regulates the legal framework for cyberspace security and defines the obligations in matters of certification of cybersecurity, in execution of Regulation (EU) 2019/881, of the European Parliament, of 19 April 2019.
Regulation no. 183/2022 establishing technical instructions on communications between entities and the National Cyber Security Centre (CNCS) (which was repealed by Decree-Law no. 125/2025, but remains applicable until such Decree enters into force).
Decree-Law no. 22/2025 which transposes Directive (EU) 2022/2557 on the identification, designation and strengthening of the resilience of critical entities.
Decree-Law no. 125/2025, which transposes Directive (EU) 2022/2555 on measures to ensure a high common level of cybersecurity across the Union (which will enter into force on 3 April 2026).
Law no. 73/2025 which ensures the implementation of European legal acts in the national legal system relating to the digital operational resilience of the financial sector (which entered into force on 29 December 2025).

What are the key laws and regulations relating to non-personal data?

Last review date: 26 December 2025

Please note that this chapter focuses solely on specific local laws and regulations. Please refer to the EU chapter of the Global Data & Cyber Handbook for detailed information on EU-wide legislation related to non-personal data, also applicable in all EU Member States, such as the Regulation on the free flow of non-personal data, the Data Governance Act, the Data Act, etc.

Global Data and Cyber Handbook Lite

Portugal

Select a Topic