---
title: "Portugal Data Protection & Privacy Regulation | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/portugal/
source_html: /jurisdictions/portugal/index.html
description: "Portugal data protection and privacy regulation: 10 categories, 63 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border…"
generated_at: 2026-11-07T14:58:19Z
content_sha256: 671ad7f8aac0587665fd4d0103374d1457322922105ff6c65a951a9a07a0fef6
generator: "fe-fleet/md-twin@1.0"
---
# Portugal Data Protection & Privacy Regulation

schema gdpri-v2
trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence

Last updated 2026-10-25 · 10 categories · 63
claims · 30 sources in the cumulative register

Download report (PDF) Expand all

The Portuguese Constitutional Court has confirmed the CNPD's €1.25 million fine against the Municipality of Lisbon, upholding findings that the municipality unlawfully processed protesters' sensitive personal data and transferred it to the Russian Embassy.

Data collected 2026-10-25 · Data published 2026-10-25

AI-assembled from cited sources

Not fully checked this cycle: Sectoral Watch, Enforcement & Redress (3 open gaps).

Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

[Open in Co-Pilot ↗](/reports/?type=copilot&j=PORTUGAL)[Build Report](/reports/?j=PORTUGAL)[Compare](/compare/?j=PORTUGAL)

Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified

Lead supervisory authority Comissão Nacional de Proteção de Dados (CNPD) Primary statutory & supervisory perimeter

Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record

Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain

10 Categories

1 Red categories 57 Sub-modules

63 Claims

2 Tier-1 sources

Traffic-light mix 5 green 4 amber 1 red
(sums to 10 rendered categories; click to filter)

1 category flagged red

Law made at European Economic Area (Bloc) level that applies in Portugal is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Portugal’s own layer: implementation, national authorities, national options and local enforcement.

## Jurisdiction brief

Jurisdiction lead brief 713 Full executive summary 516

###### Latest update · 11 October 2026

#### Lead Signal

Portugal's AI Act and Digital Services Act governance architecture has been clarified through Lei 12-A/2026: ANACOM is designated as the national AI Act authority and as DSA Coordinator, while CNPD retains its GDPR mandate together with a narrowly scoped DSA competence limited to sensitive-data and minor-targeted profiling advertisements. This settles a question of institutional division of labour that had previously been ambiguous, separating platform and AI-systems oversight from the core data-protection regulator's traditional remit.

#### Other Developments

ANACOM's Article 5 consultation ran from 16 June to 16 July 2026 on draft recommendations implementing AI Act Article 5, which addresses prohibited AI practices. The final version of these recommendations is still pending, leaving the practical scope of Portugal's prohibited-practices guidance unresolved for the present period.

#### Cross-Monitor Connections

The AI Act and DSA authority split connects most directly to the crypto and financial-integrity monitors' tracking of Portugal's broader regulatory-authority architecture this period, where Banco de Portugal and CMVM have likewise had their respective MiCA mandates clarified; the pattern across monitors is one of Portuguese regulators settling previously ambiguous authority allocations across adjacent digital and financial frameworks.

#### Outlook

The principal item to watch is whether ANACOM finalises its Article 5 AI Act recommendations following the close of the 16 July 2026 consultation, expected within the second half of 2026. Until finalised, the practical content of Portugal's prohibited-AI-practices regime remains in draft form.

3 earlier updates not shown here.

###### Standing brief · as of 4 August 2026

Written before the update above. Where they differ, the update is the more recent position.

#### Lead Signal

The Portuguese Constitutional Court has confirmed the CNPD's €1.25 million fine against the Municipality of Lisbon, upholding findings that the municipality unlawfully processed protesters' sensitive personal data and transferred it to the Russian Embassy. The confirmation extends a multi-year CNPD enforcement escalation that began with a €400,000 fine against Hospital do Barreiro in 2018, Portugal's first GDPR sanction, for deficient health-data access controls and security measures. That escalation continued through a €4.3 million fine against the national statistics institute INE, where the CNPD found the agency's 2021 Census data protection impact assessment insufficient, breaching GDPR Article 35. The CNPD is also understood to have fined the Municipality of Setúbal €170,000 in 2022 for data protection violations. Judicial confirmation of the Lisbon fine strengthens the CNPD's fining authority going forward.

#### Other Developments

The CNPD remains Portugal's sole data protection authority, carrying a general duty to supervise and monitor compliance with data protection law with strict respect for the Constitution of the Portuguese Republic. CNPD Decision No. 494/2019 continues to disapply certain provisions of the GDPR Implementation Law that the regulator regards as GDPR-inconsistent, including Article 28(3)(a) on employee consent. Portugal's digital age of consent remains set at 13 years old, the lower permissible bound of the GDPR Article 8 range. In the INE case, the CNPD used its Article 58(2)(j) emergency corrective powers to order the suspension within 12 hours of all data flows to the United States and other inadequate third countries. INE had contractually authorised transfer of data to the United States under standard contractual clauses without adopting supplementary measures. Decree-Law 125/2025 is understood to transpose the NIS2 Directive, expanding cybersecurity obligations on public and private entities. Bill 398/XVII/1, which is understood to set age limits and require parental consent for children online, remains pending before the legislature. The GDPR Implementation Law authorises fines of up to €20 million or 4% of total worldwide annual turnover for very serious offences by large companies.

#### Cross-Monitor Connections

Portugal's National AI Agenda and the CNPD's RLPD biometrics and AI working groups intersect with AI-Act-adjacent governance. Framing specific to the EU AI Act itself is routed to the artificial-intelligence monitor, while this monitor retains the Article 22 profiling and automated-decision-making transparency angle.

#### Outlook

The CNPD's enforcement trajectory across health, statistical, municipal and now judicially-tested cases points toward a regulator willing to use emergency corrective powers and pursue multi-million-euro penalties. Cross-border transfer scrutiny and children's-data legislation, including the still-pending Bill 398/XVII/1, are likely to remain focal points going forward. Several sectoral overlays, including financial services, credit scoring, education and insurance, together with regulator capacity and collective-redress mechanisms, remain unevidenced in Portugal and represent monitoring gaps rather than confirmed regulatory absences.

Read full brief · 713 words

###### Latest update · 25 August 2026

#### Regulatory Status

Portugal's data-protection posture this cycle is defined by escalating CNPD enforcement, a materially extended DPIA prior-consultation procedure, a hardening cross-border-transfer compliance requirement following the 2010-form SCC phase-out, and a newly designated AI Act market-surveillance role at ANACOM operating alongside CNPD. Confirmed enforcement actions include a EUR 1.25 million fine against the Municipality of Lisbon, upheld by the Constitutional Court, and a EUR 4.3 million fine against the national statistics institute INE, partly grounded in an inadequate US transfer mechanism. Draft children's-online-protection legislation (Bill 398 XVII/1) and a rising role for collective-redress litigation round out a cycle whose common thread is enforcement breadth across multiple adjacent regimes rather than change concentrated in a single module.

#### Outlook

The 2 August 2026 AI Act high-risk-system deadline is the nearest firm date on Portugal's horizon. Primary-source confirmation of this cycle's two headline fines, and clarification of Draft Bill 398 XVII/1's legislative status, are the items most likely to move this jurisdiction's rating next cycle.

###### Standing brief · as of 4 August 2026

#### Regulatory Status

Portugal's data protection framework rests on the GDPR and Law No. 58/2019, which are fully applicable in Portugal. The CNPD, Portugal's sole data protection authority, carries a general duty to supervise and monitor compliance with data protection law, with strict respect for the Constitution of the Portuguese Republic. CNPD Decision No. 494/2019 continues to disapply certain provisions of the national implementation law it regards as GDPR-inconsistent. Portugal's digital age of consent is set at 13 years old. The CNPD has fined controllers €20,000 plus two further €2,000 penalties for right-of-access and Article 13 violations. The CNPD found INE's 2021 Census data protection impact assessment insufficient, breaching GDPR Article 35, as part of a €4.3 million fine. Using its Article 58(2)(j) corrective powers, the CNPD ordered INE to suspend within 12 hours all data flows to the United States and other inadequate third countries. In the same case, INE had contractually authorised transfer of data to the United States under standard contractual clauses without adopting supplementary measures. Decree-Law 125/2025 is understood to transpose the NIS2 Directive, expanding cybersecurity obligations. The EDPB is understood to have launched a 2026 Coordinated Enforcement Framework on transparency obligations involving the CNPD. Portugal's National AI Agenda is understood to focus on infrastructure, innovation, talent and ethics. Bill 398/XVII/1, which is understood to set age limits and require parental consent for children online, remains pending before the legislature. The Portuguese Constitutional Court has confirmed the CNPD's €1.25 million fine against the Municipality of Lisbon for processing protesters' sensitive data and transferring it to the Russian Embassy. The GDPR Implementation Law authorises fines of up to €20 million or 4% of total worldwide annual turnover for very serious offences.

#### Outlook

Portugal presents an elevated and tightening risk profile, with a judicially-affirmed enforcement record, active cross-border-transfer scrutiny, and pending children's-data legislation likely to shape the CNPD's agenda over the coming cycles, while financial-sector, education, insurance and collective-redress overlays remain open research gaps.

Read full brief · 516 words

Key regulatory facts for Portugal Regulatory Dimension Portugal Standing Position

Jurisdiction Portugal (PT)

Regulatory Scope Data Protection & Privacy Regulation (10 modules, 63 sourced findings)

Regulator & Framework Fully GDPR-aligned; sole national DPA identified with statutory basis and active enforcement record.

Lawful Processing & Special Data GDPR bases apply directly; national elaborations exist for consent age and health/genetic data with active CNPD oversight.

Data Subject Rights Core GDPR rights operative with documented enforcement; some national qualifications on erasure/access timing.

Controller/Processor Duties Strong enforcement record on DPIA/security failures evidences an operative, active accountability regime; ROPA and joint-controller specifics not independently confirmed.

Primary Instruments Cited DataGuidance, IAPP, aiact-portugal.pt, Security Magazine Portugal, ANACOM / Diário da República

Last Confirmed / Updated 2026-10-25 (30 sources in cumulative register)

10 of 10 categories

Signal
Red
Amber
Green

Density
Comfortable
Compact

Expand all sources
Reset all

Selections OR within a group, AND across groups. Press / to search.

### Portugal: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Fully GDPR-aligned; sole national DPA identified with statutory basis and active enforcement record.

Primary framework Regulation (EU) 2016/679 (GDPR) as implemented by Law No. 58/2019

Supervisory authority [Comissão Nacional de Proteção de Dados (CNPD)](https://www.cnpd.pt/)

Traffic-light rationale — Green Fully GDPR-aligned; sole national DPA identified with statutory basis and active enforcement record.

#### Sub-modules (5)

#### Regulator And AuthorityGreen

CNPD is confirmed as the national supervisory authority with a constitutional and statutory mandate to supervise data protection compliance.

Claims (7):

- The CNPD's general duty is to supervise and monitor compliance with data protection law with strict respect for the Constitution of the Portuguese Republic.
- ANACOM was designated Portugal's AI Act national supervisory authority and single point of contact on 19 September 2025, coordinating fourteen sectoral authorities; CNPD retains its GDPR role in parallel and is separately named under Lei 12-A/2026 for DSA Arts 26(3)/28(2)
- CNPD — 2027-2029 Multiannual Activity Plan approved 13 July 2026 following public consultation, setting 20 priority strategic actions including AI/digital regulation focus and digitisation of sanctions procedures.
- CNPD — 36 staff at end-2025, up from 28 at end-2024.
- CNPD approved a 2027-2029 strategic plan on 13 July 2026 focused on AI and digital regulation.
- CNPD is Portugal's single national data-protection supervisory authority, exercising powers under GDPR as implemented by Lei n.º 58/2019.
- Comissão Nacional de Proteção de Dados (CNPD) — Portugal's single national data protection supervisory authority, administratively independent and not assigned to any specific ministry, with an annual budget of approximately EUR 3.7 million

#### Act And InstrumentsGreen

GDPR and Law No. 58/2019 are both fully applicable; CNPD has disapplied conflicting national provisions.

Claims (5):

- Both the GDPR and Law No. 58/2019 (the GDPR Implementation Law) are fully applicable in Portugal.
- In September 2019 the CNPD approved Decision No. 494/2019, disapplying certain articles of the GDPR Implementation Law (including Art 28(3) on employee consent, Art 39(1) on fine determination, and Art 20(1) on right to information) to preserve GDPR primacy.
- Lei n.º 12-A/2026 — ANACOM designated as DSA Digital Services Coordinator (15 April 2026); CNPD given specific competence over profiling-based advertising using special-category data (Art.26(3)) and profiling-based advertising to minors (Art.28(2)).
- CNPD Deliberation 494/2019 — Decided not to apply certain provisions of Law 58/2019 as contrary to GDPR, exercising a Costanzo-mandate direct-effect disapplication.
- Law No. 58/2019 — The GDPR in the Portuguese national legal order; both instruments are fully applicable in Portugal

#### Material ScopeGreen

Material scope covers all processing activity carried out in Portugal irrespective of controller's public/private nature.

Claims (1):

- The scope of the GDPR Implementation Law encompasses all processing activity carried out in Portugal, regardless of the private or public nature of the controller, including processing for legal-obligation compliance or public-interest missions.

#### Territorial ScopeAmber

No Portugal-specific derogation from GDPR Art 3 territorial scope was identified in research; general GDPR extraterritorial rules apply.

#### Regulator Registration And FilingAmber

No general controller registration/filing regime found (GDPR abolished blanket notification); sector rules (e.g. video surveillance) impose specific restrictions rather than a filing obligation.

Claims (1):

- Video surveillance is restricted to protection of people and assets; cameras may not target public roads, client/worker-reserved interior areas, or capture ATM keypads.

Portugal operates a GDPR-aligned omnibus regime. The CNPD (Comissão Nacional de Proteção de Dados) is the sole national supervisory authority, and Law No. 58/2019 (the GDPR Implementation Law) sits alongside the directly-applicable GDPR. The CNPD has, via Decision 494/2019, disapplied several provisions of the national law it considers contrary to GDPR, giving the Regulation practical primacy in supervisory practice.

Periodic update · new data 2026-10-11

#### Regulator & Framework

Portugal's regulatory architecture for AI and digital-platform oversight has been settled through Lei 12-A/2026. ANACOM, the national communications regulator, has been designated as Portugal's AI Act competent authority and as its Digital Services Act Coordinator. CNPD, Portugal's data-protection authority, retains its full GDPR supervisory mandate and additionally holds a narrowly scoped DSA competence, limited specifically to matters involving sensitive-data processing and advertising that targets minors through profiling.

This division allocates the bulk of AI-systems and platform-governance oversight to ANACOM while preserving CNPD's core data-protection role and carving out a specific, bounded DSA function for CNPD where processing touches sensitive categories of data or minors. The clarification resolves what had previously been an ambiguous allocation of authority between the two regulators and establishes which body a market participant must engage for which type of compliance question going forward.

#### Outlook

With the authority allocation now settled, the next material development to watch is how ANACOM exercises its new AI Act and DSA Coordinator functions in practice, including the finalisation of its Article 5 prohibited-practices recommendations (addressed separately under Algorithmic, Biometric & Surveillance Governance).

Sources and claims (14)
- [DataGuidance](https://www.dataguidance.com/jurisdictions/6244) — The CNPD's general duty is to supervise and monitor compliance with data protection law with strict respect for the Constitution of the Portuguese Republic.
- [DataGuidance](https://www.dataguidance.com/jurisdictions/6244) — Both the GDPR and Law No. 58/2019 (the GDPR Implementation Law) are fully applicable in Portugal.
- [DataGuidance](https://www.dataguidance.com/jurisdictions/6244) — In September 2019 the CNPD approved Decision No. 494/2019, disapplying certain articles of the GDPR Implementation Law (including Art 28(3) on employee consent, Art 39(1) on fine determination, and Art 20(1) on right to information) to preserve GDPR primacy.
- [IAPP](https://iapp.org/news/a/portugals-data-protection-law-went-into-effect) — The scope of the GDPR Implementation Law encompasses all processing activity carried out in Portugal, regardless of the private or public nature of the controller, including processing for legal-obligation compliance or public-interest missions.
- [IAPP](https://iapp.org/news/a/portugals-data-protection-law-went-into-effect) — Video surveillance is restricted to protection of people and assets; cameras may not target public roads, client/worker-reserved interior areas, or capture ATM keypads.
- [aiact-portugal.pt](https://aiact-portugal.pt/pages/implementacao-portugal.html) — ANACOM was designated Portugal's AI Act national supervisory authority and single point of contact on 19 September 2025, coordinating fourteen sectoral authorities; CNPD retains its GDPR role in parallel and is separately named under Lei 12-A/2026 for DSA Arts 26(3)/28(2)
- [Security Magazine Portugal](https://www.securitymagazine.pt/2026/09/09/cnpd-aprova-plano-estrategico-2027-2029-com-foco-reforcado-na-ia-regulacao-digital-e-modernizacao-celere/) — CNPD — 2027-2029 Multiannual Activity Plan approved 13 July 2026 following public consultation, setting 20 priority strategic actions including AI/digital regulation focus and digitisation of sanctions procedures.
- [ANACOM / Diário da República](https://www.anacom.pt/render.jsp?contentId=1833941) — Lei n.º 12-A/2026 — ANACOM designated as DSA Digital Services Coordinator (15 April 2026); CNPD given specific competence over profiling-based advertising using special-category data (Art.26(3)) and profiling-based advertising to minors (Art.28(2)).
- [PPC Land](https://ppc.land/portugals-data-watchdog-issued-just-2-fines-in-all-of-2025/) — CNPD — 36 staff at end-2025, up from 28 at end-2024.
- [PPC Land](https://ppc.land/portugals-data-watchdog-issued-just-2-fines-in-all-of-2025/) — CNPD approved a 2027-2029 strategic plan on 13 July 2026 focused on AI and digital regulation.
- [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/index.html?t=authority&c=PT) — CNPD Deliberation 494/2019 — Decided not to apply certain provisions of Law 58/2019 as contrary to GDPR, exercising a Costanzo-mandate direct-effect disapplication.
- [Recording Law](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/portugal-data-privacy-laws/) — CNPD is Portugal's single national data-protection supervisory authority, exercising powers under GDPR as implemented by Lei n.º 58/2019.
- [Baker McKenzie Resource Hub](https://resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/portugal/topics/regulators-enforcement-priorities-and-penalties) — Comissão Nacional de Proteção de Dados (CNPD) — Portugal's single national data protection supervisory authority, administratively independent and not assigned to any specific ministry, with an annual budget of approximately EUR 3.7 million
- [DataGuidance](https://www.dataguidance.com/jurisdictions/6244) — Law No. 58/2019 — The GDPR in the Portuguese national legal order; both instruments are fully applicable in Portugal

### Portugal: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾

GDPR bases apply directly; national elaborations exist for consent age and health/genetic data with active CNPD oversight.

Primary framework GDPR Arts 6-9; Law No. 58/2019

Supervisory authority [Comissão Nacional de Proteção de Dados (CNPD)](https://www.cnpd.pt/)

Traffic-light rationale — Green GDPR bases apply directly; national elaborations exist for consent age and health/genetic data with active CNPD oversight.

D2 · Lawful Processing — Full Module Record 4 sub-modules · 28 words · 4 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Portugal: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Core GDPR rights operative with documented enforcement; some national qualifications on erasure/access timing.

Primary framework GDPR Arts 12-22; Law No. 58/2019

Supervisory authority [Comissão Nacional de Proteção de Dados (CNPD)](https://www.cnpd.pt/)

Traffic-light rationale — Green Core GDPR rights operative with documented enforcement; some national qualifications on erasure/access timing.

#### Sub-modules (5)

#### Access RightGreen

CNPD has fined controllers (e.g., Hospital do Barreiro, €20,000 in 2019) for noncompliance with the right of access.

Claims (1):

- In 2019 the CNPD applied a fine of €20,000 for noncompliance with a data subject's right of access, alongside two €2,000 fines for GDPR Article 13 violations.

#### Rectification And ErasureAmber

The right to be forgotten under Portuguese law can only be exercised once the applicable retention period has elapsed.

Claims (1):

- Under the GDPR Implementation Law, the right to be forgotten can only be exercised at the end of the applicable retention period.

#### Restriction And ObjectionAmber

Information/access rights under GDPR Arts 13-15 cannot be exercised where a statutory secrecy duty opposable to the data subject applies.

Claims (1):

- The rights to information and access under GDPR Articles 13-15 cannot be exercised where the controller or processor is subject to a secrecy duty opposable to the data subject.

#### Data PortabilityAmber

No Portugal-specific derogation from GDPR Art 20 portability was identified.

#### Deadlines And Response WindowsAmber

No Portugal-specific deviation from the GDPR one-month (extendable) response window was identified in research.

Data subject rights follow the GDPR framework, with Portugal-specific limits: secrecy-duty exceptions to information/access rights, and a right-to-erasure that only becomes exercisable at the end of the applicable statutory retention period. Enforcement history shows the CNPD actively sanctioning access-right violations.

No periodic updates recorded in this cycle

Sources and claims (3)
- [IAPP](https://iapp.org/news/a/portugals-data-protection-law-went-into-effect) — In 2019 the CNPD applied a fine of €20,000 for noncompliance with a data subject's right of access, alongside two €2,000 fines for GDPR Article 13 violations.
- [IAPP](https://iapp.org/news/a/portugals-data-protection-law-went-into-effect) — Under the GDPR Implementation Law, the right to be forgotten can only be exercised at the end of the applicable retention period.
- [IAPP](https://iapp.org/news/a/portugals-data-protection-law-went-into-effect) — The rights to information and access under GDPR Articles 13-15 cannot be exercised where the controller or processor is subject to a secrecy duty opposable to the data subject.

### Portugal: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Strong enforcement record on DPIA/security failures evidences an operative, active accountability regime; ROPA and joint-controller specifics not independently confirmed.

Primary framework GDPR Arts 24-39; Law No. 58/2019

Supervisory authority [Comissão Nacional de Proteção de Dados (CNPD)](https://www.cnpd.pt/)

Traffic-light rationale — Green Strong enforcement record on DPIA/security failures evidences an operative, active accountability regime; ROPA and joint-controller specifics not independently confirmed.

Periodic update · new data 2026-09-21

#### Controller/Processor Duties

The CNPD's prior-consultation requirement for data protection impact assessments carries meaningful practical timeline exposure for controllers operating in Portugal. Where a DPIA concludes that residual risk to data subjects cannot be adequately mitigated, controllers are understood to be required to consult the CNPD before commencing the processing activity in question. This consultation process can extend to eight weeks, with a possible further six-week extension in complex cases, meaning organisations planning high-risk processing activities should factor a potential fourteen-week regulatory dependency into their project and product-launch timelines.

This obligation sits within Portugal's standing accountability framework under the GDPR and Law 58/2019, and while it does not represent a change to the underlying legal requirement for prior consultation, the specific timeline figures reported this cycle underscore the practical operational burden the requirement imposes, particularly for organisations undertaking novel or higher-risk processing activities such as large-scale profiling, biometric processing, or systematic monitoring, where an unmitigated-residual-risk DPIA outcome is more likely to arise.

#### Outlook

Organisations conducting DPIAs in Portugal for high-risk processing activities should build realistic timeline buffers around the CNPD prior-consultation process into project planning, given the confirmed potential for consultation periods extending to fourteen weeks in complex cases.

Periodic update · new data 2026-08-25

#### Controller/Processor Duties

Portuguese controllers face a materially extended data protection impact assessment (DPIA) prior-consultation procedure relative to the GDPR default. Where a DPIA concludes that residual risk cannot be adequately mitigated, the controller must consult CNPD before commencing the processing activity, and this prior-consultation process can extend to eight weeks, with a possible further six-week extension in complex cases. This is a national procedural variance layered on top of the GDPR's general prior-consultation mechanism, and it creates a distinct compliance-timeline risk for any Portuguese controller planning a high-risk processing launch.

#### Outlook

Controllers scoping high-risk processing activity in Portugal should plan for a prior-consultation window of up to fourteen weeks in complex cases; independent confirmation of CNPD's current practice against this stated timeline would be the clearest signal of whether the procedure is being applied as described.

D4 · Controller & Processor — Full Module Record 7 sub-modules · 43 words · 8 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Portugal: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Transfer mechanisms are operative and enforced (SCC/TIA scrutiny confirmed), but PT has no independent adequacy-granting/receiving competence, and no PT-specific data-localisation mandate was found.

Primary framework GDPR Arts 44-49 (Chapter V)

Supervisory authority [Comissão Nacional de Proteção de Dados (CNPD)](https://www.cnpd.pt/)

Traffic-light rationale — Amber Transfer mechanisms are operative and enforced (SCC/TIA scrutiny confirmed), but PT has no independent adequacy-granting/receiving competence, and no PT-specific data-localisation mandate was found.

Periodic update · new data 2026-09-21

#### Cross-Border & Adequacy

Organisations transferring personal data internationally in connection with Portugal remain exposed to an active legal-basis risk if they have not migrated away from the 2010-form Standard Contractual Clauses. These clauses were repealed for new contracts from 27 September 2021 and for all contracts, including those already in place, from 27 December 2022. Any 2010-form SCC still in use for a Portugal-connected international data transfer today is confirmed to be invalid and must be migrated to the current SCC framework without delay.

This is not a new development in the sense of a fresh legislative change this cycle, but its confirmed, active-enforcement-relevant status means it remains a live and material compliance risk: organisations that have not completed the migration exercise are transferring personal data on an invalid contractual basis, which exposes them to enforcement risk from the CNPD independent of any other compliance gap. Given the CNPD's demonstrated willingness to impose and defend substantial fines, evidenced by the Constitutional-Court-confirmed EUR 1.25 million penalty against the Municipality of Lisbon this cycle, organisations should treat legacy-SCC migration as a genuine enforcement-priority item rather than a historical footnote.

#### Outlook

Organisations with any Portugal-connected international transfer arrangement should audit their SCC inventory now, if this has not already been completed, to confirm no 2010-form clauses remain in active use.

Periodic update · new data 2026-08-25

#### Cross-Border & Adequacy

CNPD treats Article 49 GDPR derogations as last-resort transfer mechanisms, requiring an adequacy decision or Standard Contractual Clauses accompanied by a Transfer Impact Assessment as the primary route for international transfers. Separately, the old-form (2010) Standard Contractual Clauses were repealed for new contracts from 27 September 2021 and for all contracts from 27 December 2022; any 2010-form SCC still relied upon in 2026 is invalid. This transition is directly relevant to enforcement activity elsewhere this cycle, where an inadequate transfer mechanism formed part of the basis for a fine against a Portuguese public body.

#### Outlook

The item to watch is whether any Portuguese controller is found still relying on an invalid 2010-form SCC, which would be a direct enforcement trigger under CNPD's stated approach to Article 49 and SCC adequacy.

D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 63 words · 4 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Portugal: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Health and employment overlays are well evidenced; financial, credit, education and insurance sectoral overlays could not be confirmed and are flagged as gaps.

Primary framework GDPR; Law No. 58/2019; Decree-Law 125/2025 (NIS2); Law No. 59/2025

Supervisory authority [Comissão Nacional de Proteção de Dados (CNPD)](https://www.cnpd.pt/)

Traffic-light rationale — Amber Health and employment overlays are well evidenced; financial, credit, education and insurance sectoral overlays could not be confirmed and are flagged as gaps.

D6 · Sectoral Watch — Full Module Record 7 sub-modules · 50 words · 3 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Portugal: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾

Only a general EU-level enforcement-coordination signal was confirmed; no PT-specific adtech instrument evidenced across any sub-module.

Primary framework ePrivacy Directive 2002/58/EC; GDPR

Supervisory authority [Comissão Nacional de Proteção de Dados (CNPD)](https://www.cnpd.pt/)

Traffic-light rationale — Red Only a general EU-level enforcement-coordination signal was confirmed; no PT-specific adtech instrument evidenced across any sub-module.

Periodic update · new data 2026-09-21

#### AdTech & Commercial Privacy

The European Data Protection Board is understood to have launched its 2026 Coordinated Enforcement Framework, an exercise assessing compliance with GDPR transparency and information obligations, involving 25 data protection authorities including the CNPD. This represents a coordinated EU-wide enforcement sweep targeting how organisations disclose their data-processing practices to individuals, a topic with direct relevance to commercial adtech and tracking practices where transparency notices and consent mechanisms are frequently scrutinised.

For organisations operating in Portugal with adtech or commercial-privacy exposure, this CEF sweep signals a heightened near-term likelihood of CNPD scrutiny specifically directed at transparency and information-obligation compliance, distinct from the CNPD's general enforcement activity. The coordinated, multi-authority nature of the exercise, spanning 25 data protection authorities, also suggests findings and enforcement patterns emerging in one jurisdiction could inform CNPD's own approach in Portugal.

#### Outlook

Organisations with adtech or commercial-tracking operations touching Portugal should review transparency notices and information-obligation compliance ahead of potential CNPD scrutiny arising from the 2026 Coordinated Enforcement Framework sweep.

Periodic update · new data 2026-08-25

#### AdTech & Commercial Privacy

The single most common CNPD finding in cookie-consent audits conducted between 2024 and 2026 is an asymmetric banner design, treated by CNPD as a failure to obtain valid consent. This finding is sourced this cycle only from commercial compliance-vendor commentary rather than primary CNPD guidance, and should be treated as an assessed rather than confirmed practice pattern pending corroboration.

#### Outlook

Primary-source CNPD guidance or published audit findings on asymmetric-banner consent failures would be the clearest confirmation of this practice pattern; absent that, commercial-sector operators in Portugal should treat symmetric consent-banner design as the lower-risk default.

D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 51 words · 3 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Portugal: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Institutional AI/biometric governance activity confirmed (working groups, national AI agenda) but no binding PT-specific ADM/biometric/genetic statute identified.

Primary framework GDPR Art 22; EU AI Act (interface)

Supervisory authority [Comissão Nacional de Proteção de Dados (CNPD)](https://www.cnpd.pt/)

Traffic-light rationale — Amber Institutional AI/biometric governance activity confirmed (working groups, national AI agenda) but no binding PT-specific ADM/biometric/genetic statute identified.

Periodic update · new data 2026-10-11

#### Algorithmic, Biometric & Surveillance Governance

ANACOM, newly confirmed as Portugal's AI Act competent authority, ran a public consultation from 16 June to 16 July 2026 on draft recommendations implementing Article 5 of the AI Act, the provision addressing prohibited AI practices. The consultation sought input on how the prohibited-practices regime should be given practical effect in Portugal, but the final version of these recommendations remains pending, meaning the detailed, operative scope of Portugal's prohibited-AI-practices guidance has not yet been settled.

This sits alongside the broader authority clarification under Regulator & Framework, where ANACOM's AI Act role was confirmed; the Article 5 consultation is the first substantive exercise of that role to surface in the record this period. Until a final version issues, affected parties have visibility into the direction of the recommendations through the consultation draft but not into their final, binding form.

#### Outlook

The item to watch is whether ANACOM finalises its Article 5 recommendations following the 16 July 2026 consultation close, with a plausible window in the second half of 2026 given the consultation's timing. Finalisation would convert the current draft-stage guidance into an operative statement of how Portugal treats prohibited AI practices under the Act.

Periodic update · new data 2026-09-21

#### Algorithmic, Biometric & Surveillance Governance

Portugal is understood to have designated ANACOM in September 2025 as the national market-surveillance authority and single point of contact for EU AI Act enforcement. Full application of obligations for most high-risk AI systems is understood to begin 2 August 2026, a deadline now approaching within the current reporting horizon. This institutional designation positions ANACOM as the primary enforcement body for AI Act compliance in Portugal, working alongside the CNPD where algorithmic governance and data-protection obligations overlap, for example in relation to automated decision-making systems that process personal data and fall within the AI Act's high-risk categorisation.

This is a probable-confidence development reflecting institutional build-out ahead of a binding EU-level deadline rather than a completed enforcement framework; the practical coordination mechanism between ANACOM and the CNPD for jointly-relevant cases has not been independently detailed this cycle.

#### Outlook

The approach of the 2 August 2026 high-risk-obligations deadline makes ANACOM's operational readiness, and the clarity of its coordination arrangement with the CNPD on overlapping algorithmic-governance and data-protection matters, the key development to watch in the immediate term.

Periodic update · new data 2026-08-25

#### Algorithmic, Biometric & Surveillance Governance

Portugal designated ANACOM in September 2025 as the national market-surveillance authority and single point of contact for EU AI Act enforcement, with ANACOM coordinating with CNPD on matters at the intersection of AI governance and data protection. Full obligations for most high-risk AI systems become applicable in Portugal from 2 August 2026. This designation creates a near-term implementation deadline sitting directly at the boundary between AI governance and data-protection compliance, since many high-risk AI systems process personal data as a core function.

#### Outlook

The 2 August 2026 deadline is the nearest firm date on this module's horizon; the item to watch is how the ANACOM-CNPD coordination mechanism operates in practice once full high-risk-system obligations become applicable.

D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 49 words · 6 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Portugal: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Core age-of-consent rule is in force and confirmed; the more expansive children's-online-safety bill remains pending, and education-settings/dependent-adults sub-modules are unevidenced.

Primary framework GDPR Art 8; Law No. 58/2019; Bill 398/XVII/1 (pending)

Supervisory authority [Comissão Nacional de Proteção de Dados (CNPD)](https://www.cnpd.pt/)

Traffic-light rationale — Amber Core age-of-consent rule is in force and confirmed; the more expansive children's-online-safety bill remains pending, and education-settings/dependent-adults sub-modules are unevidenced.

Periodic update · new data 2026-09-21

#### Children & Vulnerable Groups

Bill 398 XVII/1 is understood to aim at protecting children online in Portugal, setting age limits and requiring parental consent for certain online activities or services. The CNPD has been reported to emphasise GDPR compliance considerations in its public commentary on the bill, suggesting the data protection authority is engaged with the legislative process even though the bill's substantive provisions originate outside the GDPR framework itself.

This claim carries only uncertain confidence: the bill's precise legislative stage as of this cycle's cutoff has not been independently confirmed beyond aggregator-level reporting, and the specific age thresholds and parental-consent mechanisms it would introduce have not been independently verified. Organisations offering online services to children in Portugal should treat this as an early-stage legislative signal to monitor rather than a settled compliance requirement at this time.

#### Outlook

Confirmation of Bill 398 XVII/1's current legislative stage, and independent verification of its specific age-limit and parental-consent provisions, are the key items to resolve before this development can be treated as a confirmed compliance requirement.

Periodic update · new data 2026-08-25

#### Children & Vulnerable Groups

Draft Bill 398 XVII/1 aims to protect children online in Portugal by setting age limits and requiring parental consent for certain online activities, with CNPD publicly emphasising GDPR-compliance alignment in its commentary on the proposal. The bill's current legislative status and full citation were not confirmed this cycle, and the finding is assessed rather than confirmed pending further sourcing.

#### Outlook

Confirmation of Draft Bill 398 XVII/1's legislative progress, including whether it has advanced beyond committee stage, is the item most likely to change this module's rating next cycle.

D9 · Children's Privacy — Full Module Record 5 sub-modules · 65 words · 3 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Portugal: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Sustained, escalating enforcement record (multiple seven-figure fines, judicial confirmation) demonstrates an active and empowered regulator.

Primary framework GDPR Arts 58, 77-84; Law No. 58/2019

Supervisory authority [Comissão Nacional de Proteção de Dados (CNPD)](https://www.cnpd.pt/)

Traffic-light rationale — Green Sustained, escalating enforcement record (multiple seven-figure fines, judicial confirmation) demonstrates an active and empowered regulator.

Periodic update · new data 2026-09-28

#### Enforcement & Redress

Portugal's data-protection enforcement landscape in 2025 exhibits a striking imbalance between the volume of matters brought before the CNPD and the volume of sanctions it ultimately imposes. The CNPD opened 3,201 cases and conducted 2,037 investigations over the year, yet issued only two fines totalling EUR 47,000 across the entire twelve-month period. This is a caseload of a scale that would typically be expected to yield a materially larger sanctioning record, and the disproportion is significant enough to be characterised as the CNPD's defining enforcement signal for the year rather than a marginal statistical curiosity.

The CNPD's fining framework itself is well established: under Law 58/2019, the national act implementing the GDPR domestically, the regulator applies criteria that account for the economic situation and turnover of the offending entity, the continuous nature of any infringement, and the entity's size or number of employees, all layered atop the GDPR's own statutory fine ceilings. This framework was tested and upheld this cycle when the Portuguese Constitutional Court confirmed the CNPD's EUR 1.25 million fine against the Municipality of Lisbon for GDPR violations connected to data transfers, providing judicial validation of the CNPD's approach to quantifying penalties in at least one significant case.

Against that backdrop, the CNPD's historic December 2022 fine of EUR 4.3 million against Portugal's national statistics institute (INE), imposed over five GDPR infringements tied to the 2021 Census including an unlawful transfer of personal data to US-based servers without adequate safeguards, remains unresolved: INE's court challenge to the fine had not been decided as of mid-2026. The case stands as the CNPD's largest publicly known sanction, and its multi-year suspension in litigation illustrates how even Portugal's most significant enforcement actions can take years to become final, which bears on how confidently any single fine figure should be read as settled.

A legislative proposal reported as pending parliamentary approval as of mid-2026 would establish a new contraordenational regime intended to accelerate CNPD sanctioning proceedings. This proposal has not been independently corroborated against a primary CNPD or parliamentary source this cycle, so its substance, timeline, and likelihood of passage remain open. If enacted, it would directly address the caseload-to-sanction gap that characterises the CNPD's current enforcement record, and its progress is the single most consequential variable for Portugal's enforcement trajectory going forward.

#### Outlook

Whether Portugal's enforcement posture converges toward more sanction-active EU peer regulators depends substantially on the fate of the pending contraordenational reform and on the eventual resolution of the INE litigation. Absent movement on either front, the CNPD's low 2025 sanction count against its large caseload is likely to persist as a watch item. Future cycles should seek direct CNPD primary-source confirmation of the reform's status, which was not obtained this cycle, and should track any court ruling in the INE case as a signal of how durable the CNPD's largest fines prove to be.

Periodic update · new data 2026-09-21

#### Enforcement & Redress

The Portuguese Constitutional Court is understood to have confirmed the CNPD's EUR 1.25 million fine against the Municipality of Lisbon for GDPR violations related to data transfers. This is a significant enforcement outcome both for its financial magnitude and for its confirmation at the highest level of judicial review, reinforcing the durability of CNPD's enforcement decisions against subsequent legal challenge. The precise current status and outcome date of this confirmation was not independently pinned down beyond aggregator-level reporting this cycle, but the underlying fine and its judicial confirmation are reported with probable confidence.

Separately, judicial actions, particularly collective ones led by associations such as Ius Omnibus, are reported to be gaining relevance in the Portuguese data-protection redress landscape, suggesting a growing role for collective/class-style redress mechanisms alongside CNPD's own administrative enforcement powers. This dual-track development, administrative fines confirmed on judicial review plus a rising collective-litigation channel, indicates an increasingly multi-layered enforcement and redress environment in Portugal.

#### Outlook

Independent confirmation of the exact status and date of the Constitutional Court's ruling on the Lisbon Municipality fine, and continued monitoring of collective-action activity led by organisations such as Ius Omnibus, are the key items to track for the next cycle.

Periodic update · new data 2026-08-25

#### Enforcement & Redress

Portugal's data-protection enforcement environment escalated materially this cycle. The Portuguese Constitutional Court confirmed CNPD's EUR 1.25 million fine against the Municipality of Lisbon for GDPR violations related to data transfers, and CNPD separately fined the national statistics institute INE EUR 4.3 million, partly on the basis of an inadequate transfer mechanism to the United States. CNPD has authority to impose administrative fines, order the suspension of processing, and refer serious cases to the Portuguese courts. Judicial collective redress actions, particularly those led by associations such as Ius Omnibus, are gaining relevance in Portugal's digital-sector enforcement landscape, and the EDPB launched its 2026 Coordinated Enforcement Framework assessing GDPR transparency and information-obligation compliance across 25 data protection authorities including CNPD. Both the Lisbon Municipality and INE fine amounts rest on Tier-3 secondary summaries this cycle rather than primary CNPD text.

#### Outlook

Primary-source CNPD confirmation of the Lisbon Municipality and INE fine details would materially raise confidence in this cycle's two headline enforcement findings; the EDPB's 2026 Coordinated Enforcement Framework outcome, once published, is the next scheduled item likely to generate further Portugal-specific enforcement material.

D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 99 words · 15 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

## GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map GDPR article to category mapping Article Category Sub-module

Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases

Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds

Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories

Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability

Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency

Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements

Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements

Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures

Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification

Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification

Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received

Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs

Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs

Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions

Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties

Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties

Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties