Portugal

Portugal data protection & cybersecurity regulation

Portugal applies GDPR through Lei 58/2019, enforced by the CNPD. After missing the original EU deadline and receiving a European Commission reasoned opinion, Portugal's NIS2 transposition (Decreto-Lei n.º 125/2025) finally entered into force on 3 April 2026.

Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.

Applicable laws

General Data Protection Regulation(GDPR)

EU-wide regulation on personal data processing, directly applicable in Portugal without transposition.

Source

Lei n.º 58/2019, de 8 de agosto(Lei 58/2019)

Portugal's national data protection act, in force since 8 August 2019, implementing GDPR's opening clauses (digital age of consent set at 13; specific video-surveillance and employee-data rules). The CNPD itself declared via Deliberation 2019/494 that it would disapply several of the law's own provisions it considered incompatible with GDPR.

Source

Regime Jurídico da Cibersegurança(Decreto-Lei n.º 125/2025)

Portugal's NIS2 transposition, published 4 December 2025, in force since 3 April 2026. Expands the regulated population from roughly 1,000 operators to an estimated 7,000-9,000 organizations, supervised by the CNCS.

Source

Breach notification

72 hours

GDPR Article 33 applies uniformly: notify the CNPD without undue delay and, where feasible, within 72 hours of becoming aware of a breach.

Notify: CNPD

Source

Statutory maximum fines

Published legal maximums, not a personalized estimate, not legal advice.

GDPR Article 83(5)

Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher

Source

Decreto-Lei n.º 125/2025 (Regime Jurídico da Cibersegurança / NIS2)

Up to €10,000,000 or 2% of worldwide annual turnover for essential entities; up to €7,000,000 or 1.4% for important entities, whichever is higher. Separate personal fines of up to €125,000 apply to managers/directors

Secondary sources describe a phased adaptation period (registration from mid-2026, full regime by 2027-2028) but disagree on exact mechanics, not verified against the official Diário da República text directly; treat the phase-in dates as indicative.

Source

NIS2 status

Applicable , as of 2026-09-08

Transposed via Decreto-Lei n.º 125/2025, published 4 December 2025, in force since 3 April 2026. Portugal missed the original 17 October 2024 EU deadline and received a European Commission reasoned opinion on 7 May 2025 before finally enacting the law. The CNCS (Centro Nacional de Cibersegurança) is the lead competent authority, with CERT.PT as the national CSIRT.

Source

Primary authority

Comissão Nacional de Proteção de Dados(CNPD)

Visit authority site

Working in Portugal?

See our regional security services

Tools

Frequently asked

Has Portugal finished transposing NIS2?

Yes, after significant delay. Decreto-Lei n.º 125/2025 was published on 4 December 2025 and entered into force on 3 April 2026. Portugal had missed the original 17 October 2024 EU deadline and received a European Commission reasoned opinion on 7 May 2025 before finally transposing.

Who enforces GDPR in Portugal?

The Comissão Nacional de Proteção de Dados (CNPD), based in Lisbon, is Portugal's national GDPR supervisory authority.

Do NIS2 fines apply immediately in Portugal?

Sources describe a phase-in rather than immediate full enforcement, with the complete sanctions regime reported to ramp up between 2027 and 2028, not fully confirmed against the official legal text, so verify current enforcement posture directly with CNCS.