Portugal. Comprehensive data protection. Act
Lei 58/2019Law No. 58/2019 ensuring the implementation of the GDPR in the national legal order
Partly verified
Medium confidence.DRE URL not re-verified.
§1Summary
- Synopsis
Portugal's Law 58/2019 implements the GDPR nationally, including employee data, video surveillance and health data rules. The CNPD has declared several provisions incompatible with the GDPR and does not apply them.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 13. CNPD Deliberation 2019/494 disapplies several articles (e.g. fine ranges and public body exemptions); public entities could request waiver from fines; specific rules on CCTV and deceased persons' data.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text diariodarepublica.pt
- Authority
- Comissão Nacional de Proteção de Dados (CNPD)
§5Where it applies
- Domestic law of
- Portugal
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.DRE URL not re-verified.