PORTUGAL LAW AND PRACTICE Contributed by: Joana Torres Fernandes, José Manuel Pereira da Costa, Danielle Avidago, Javier Mateo, António Pratas Nunes, Joana Loureiro Veríssimo, Madalena Mourão and David Serras Pereira, LVP Advogados
basis, that individuals receive clear information, and that appropriate technical and organisational meas - ures are in place. Key Compliance Obligations For companies operating in Portugal, the main com - pliance obligations usually include: • preparing privacy notices and internal policies; • mapping processing activities and maintaining records of processing, where required; • ensuring that contracts with processors include GDPR-compliant clauses; • assessing whether a data protection officer must be appointed; • implementing security measures appropriate to the risk; • managing data subject rights requests; • assessing and documenting international data transfers; • notifying personal data breaches to the supervisory authority where required; and • carrying out data protection impact assessments for high-risk processing. Sector-specific rules may also be relevant, depending on the business activity. These include rules on elec - tronic communications and direct marketing, cyberse - curity, consumer protection, financial services, health data, employment, video surveillance and the use of digital platforms. Practical Approach In Portugal, as in the rest of the EU, data protection compliance is not only a documentation exercise. Companies are expected to implement procedures that work in practice, particularly where they process sensitive data, monitor employees or customers, use CCTV, rely on digital marketing, transfer data outside the European Economic Area or deploy automated decision-making tools. 8.2 Geographical Scope The GDPR applies directly in Portugal and has broad territorial scope. It applies to organisations established in Portugal that process personal data in the context of their activities, even if the actual processing takes place outside Portugal or outside the European Union.
It may also apply to organisations that are not estab - lished in Portugal or elsewhere in the EU, where they offer goods or services to individuals located in the EU or monitor their behaviour within the EU. This means that a foreign company with no Portuguese subsidi - ary may still be subject to Portuguese and EU data protection rules if, for example, it targets Portuguese customers, operates a Portuguese-facing website or app, runs behavioural advertising campaigns aimed at users in Portugal, or tracks users located in Portugal. International Transfers Transfers of personal data from Portugal to coun - tries outside the European Economic Area (EEA) are subject to the GDPR transfer rules. Such transfers may take place where there is an adequacy decision, appropriate safeguards such as standard contrac - tual clauses, binding corporate rules, or another valid transfer mechanism under the GDPR. In practice, companies should also assess the legal and practical risks of the destination country, particu - larly where personal data is transferred to service pro - viders, cloud platforms, group companies or technol - Non-EU organisations subject to the GDPR may need to appoint an EU representative, unless an exemp - tion applies. Where a company operates in more than one EU Member State, the GDPR’s one-stop-shop mechanism may also be relevant, with a lead super - visory authority being determined by reference to the organisation’s main establishment in the EU. For companies entering the Portuguese market, it is therefore important to assess early whether the busi - ness model triggers GDPR applicability, whether a Portuguese or EU establishment is being created, and which supervisory authority is likely to be competent. 8.3 Role and Authority of the Data Protection Agency The CNPD The Portuguese data protection authority is the Comissão Nacional de Proteção de Dados , commonly referred to as the CNPD. Law No 58/2019 confirms that the CNPD is the national supervisory authority ogy vendors located outside the EEA. Representative and Lead Authority
899 CHAMBERS.COM
Powered by FlippingBook