Latest news and stories about data protection in Portugal for expats and residents.
A teachers' movement known as MetaPROF has filed a formal complaint with the National Data Protection Commission (Comissão Nacional de Proteção de Dados or CNPD). The group alleges irregularities in the digital grading and distribution process for national exams, citing potential violations of the General Data Protection Regulation (Regulamento Geral sobre a Proteção de Dados or RGPD).
The Lisbon City Council has expressed deep concern after the neo-Nazi group Movimento Armilar Lusitano (MAL) was found to be targeting political officeholders. The council condemned the group following revelations that a Public Security Police (Polícia de Segurança Pública or PSP) officer, currently seconded to the Municipal Police, accessed the personal data of elected officials.
The PSP (Polícia de Segurança Pública) is Portugal's national civilian police force, founded in 1867. Responsible for defending Republican democracy and safeguarding internal security and citizens' rights, the PSP polices major cities—Lisbon, Porto, Faro—and large urban areas, covering only 4% of Portugal's territory but roughly half the population. Led by a National Director under the Ministry of Internal Affairs, its approximately 21,500 officers handle preventive policing, crime investigation, public order, airport security, diplomatic protection, private security regulation, firearms licensing, and border control (since 2023).
PSP vs. GNR: The PSP is civilian with police-focused training and urban jurisdiction, while the GNR (Guarda Nacional Republicana) is military (gendarmerie) with military training, covering 96% of Portugal's rural and suburban territory. Both share core public safety missions but differ fundamentally in nature, training, and geographic responsibility.
The Entity for Political Accounts and Financing (Entidade das Contas e Financiamentos Políticos or ECFP) has decided to restrict public access to the identities of party and campaign donors. This move, supported by an opinion from the Commission for Access to Administrative Documents (Comissão de Acesso aos Documentos Administrativos or CADA), has drawn sharp criticism from opposition figures like Alexandra Leitão, who argue that transparency must take precedence over data protection. Meanwhile, PSD parliamentary leader Hugo Soares has also faced backlash for suggesting that declarations of interest should no longer be public.
The Entity for Political Accounts and Financing (Entidade das Contas e Financiamentos Políticos or ECFP) is the regulatory body responsible for overseeing the financial activities of political parties and election campaigns in Portugal. It ensures compliance with transparency laws and monitors the sources of funding for political entities.
The National Data Protection Commission is urging Parliament to expedite legislative amendments to address severe staffing shortages that are currently preventing the enforcement of fines for personal data breaches.
Technology companies must know that regulators have the powers and teams to intervene, otherwise legislation risks being ineffective. The warning was issued by Des Hogan, commissioner of Ireland's Data Protection Commission (DPC), during a debate on regulation.
A series of cyberattacks hit dozens of European supermarkets in the last week, including seven Intermarché stores in Portugal. The incidents expose security flaws in equipment that does not always receive updates and reignite the debate among experts regarding the scale of the cyber threat and the role of artificial intelligence.
Seven Intermarché stores were affected in Portugal, in a wave of attacks that hit supermarkets in eight European countries. What happened, how was it possible, and what are the risks?
Seven stores were affected.
Regierungen und Website-Betreiber bemühen sich mit Hochdruck, Sicherheitslücken in einer beliebten Internet-Programmiersprache zu schließen.
A brief overview of the risks and implications of the PHP2SHELL vulnerability for systems in Portugal.
European Union (EU) measures to detect and respond to significant cybersecurity incidents are only “partially effective” due to data reporting failures and implementation delays, concludes the European Court of Auditors (ECA).
The channel was developed within the scope of bilateral cooperation between the Data Protection Authorities of Portugal and Spain.
The Spanish Data Protection Agency has received the first notification of an attack executed via an AI agent. The agent modified data and accessed invoices.
The lawsuit was filed in 2024 by 12,000 users. The company states that the “settlement does not include any finding or admission of guilt,” although it acknowledges the “distress and loss of trust.”
Uber drivers in the European Union and the United Kingdom have initiated legal action against the company for violating data protection agreements. They also allege that the remuneration system applied reduces their earnings.
Legal professionals claim that the Public Security Police (PSP) is requesting access to personal information that exceeds the scope of standard identification documents.
Inspections of personal data processed by the health, justice, and internal security sectors will be strengthened starting next year, according to the National Data Protection Commission's (CNPD) activity plan for 2027–2029. The reinforcement of inspection and supervisory activity will be risk-based and will focus primarily on...
The group 'Citizens for Cybersecurity' is calling for enhanced data protection measures regarding the 'Volta' system.
Citizens for Cybersecurity has requested clarifications from the National Data Protection Commission regarding the processing of personal data in the deposit and refund system for packaging.
The Data Protection Commission intends to be able to apply fines directly instead of having to resort to administrative courts, which delays proceedings and leads to statute of limitations expirations.
The debate surrounding the so-called Chat Control regulation is repeating, complicating, and dragging on as governments and states abdicate their responsibilities. In short, the issue concerns combating crime committed through technological and communication means, such as social media platforms, and the decision to grant tech multinationals intrusive powers over citizens' communications under the guise of that fight. The discussion is wrongly framed as an irreconcilable conflict between communication privacy and the effectiveness of fighting crime, particularly heinous acts like child sexual abuse. It is presented as a choice between mass surveillance or impunity. However, those who reject both positions cannot accept such a reductionist debate, especially when the underlying context—the near-absolute control by tech giants over the communication space—is ignored. These companies impose their own interests over the public good, developing technical capabilities for profit despite negative social and political repercussions. They control public consciousness through opaque algorithms, shielded by claims of intellectual property or free competition. By capitulating to these powers and refusing to implement public and democratic oversight, governments are failing to find effective, balanced solutions to combat crime while protecting fundamental rights. The potential for indiscriminate scanning of communications and the lack of safeguards for private data are among the most harmful consequences of this political surrender.
The number of cyberattacks reported in Portugal increased by 29% during the month of June.
The country is facing a higher level of cyber threats and digital security challenges.
The president of the National Data Protection Commission spoke about flaws that could be addressed in the new Court of Auditors law and highlighted the 'duty to act' in the face of a 'legislative vacuum'.
The president of the National Data Protection Commission (CNPD), Paula Meira Lourenço, argued this Thursday in parliament that the proposed new law for the Court of Auditors must address a “legal loophole” in the processing of personal data. During a hearing at the Committee on State Reform and Local Government, as part of the specialist review process...
GPA announces the integration of the team from MICC – Mission is Critical, consultants with whom they already held a partnership. Specialising in cybersecurity, MICC also provides services such as data protection officer functions, GDPR compliance, security incident management, and technical audits. With this integration, GPA now...
The discussion regarding access to metadata by the Republic's intelligence services has been dragging on for over a decade. To reach a solution, it is necessary to revise the Constitution and find a new balance between the right to security and the guarantee of privacy in communications.
