PORTUGAL Law and Practice Contributed by: Luís Portela de Carvalho, Pedro Cortés and Cláudia de Azevedo Neves, Lektou
7. Data Protection Considerations 7.1 Relevant Laws and Regulations for Data Protection The main Portuguese and EU instruments in this area are: • the GDPR, which is directly applicable and sets the core rules on lawful processing, data subject rights, security, accountability and international transfers; • Law No 58/2019, which supplements the GDPR in Portugal, including by designating CNPD as the supervisory authority and setting national rules such as the age of consent for information society services at 13; • Law No 41/2004, which deals with privacy in elec - tronic communications, including cookies, traffic and location data and unsolicited marketing; • Decree-Law No 125/2025, which transposes NIS2 and imposes cybersecurity risk-management and incident-notification duties on essential and important entities. The regime entered into force on 3 April 2026, and the implementing Regulation No 756/2026, published on 22 June 2026, should be checked for operational details, including notifica - tion forms and platform requirements; and • Law No 73/2025, which adapts Portuguese law to DORA for the financial sector. DORA has been directly applicable since 17 January 2025. The Banco de Portugal, CMVM and ASF are the com - petent authorities within their respective superviso - ry perimeters, and financial entities must maintain registers of ICT third-party agreements and report severe ICT incidents under the DORA framework. Together, these regimes create overlapping obliga - tions on data protection, information security, cyber - security governance, supply-chain risk and incident reporting. 7.2 Data Transfer Restrictions Personal Data Transfers The GDPR restricts transfers of personal data from Portugal to third countries or international organi - sations unless the conditions in Chapter V are met. Transfers are typically allowed where there is an ade - quacy decision for the destination country, or where the controller or processor has provided appropriate
awareness has grown in sectors such as pharmaceu - ticals, life sciences, telecoms and high-tech manu - facturing. The Unified Patent Court and the European patent with unitary effect have also increased the strategic importance of patent issues for Portuguese businesses operating across Europe. In software and IT contracts, however, parties still tend to focus more on copyright, trade secrets and con - tractual restrictions than on patents. Patent indemni - ties are nonetheless often included where the supplier provides hardware, embedded technology or stand - ardised software that may be used in several jurisdic - tions. Portugal is not generally seen as a major forum for patent assertion entity activity, but cross-border patent risk is increasingly taken into account in larger technology transactions. 6.5 IP and AI/Computer-Created Works Human Authorship Requirement Portuguese copyright law has no special rule for AI- generated works. The CDADC is based on the idea that a protected work is an intellectual creation and that the author is the human creator of that work. For that reason, the prevailing view is that output gener - ated autonomously by AI, without meaningful human creative input, is unlikely to be protected by copyright. AI as a Tool The analysis is different where AI is used as an instru - ment in a broader human creative process. If a per - son makes creative choices in selecting, prompting, arranging, editing or refining the output, the final result may still be protected, provided it reflects that person’s own intellectual creation. This approach is consistent with the Court of Justice of the European Union’s emphasis on originality as the author’s own intellectual creation. Contractual Solutions Because the statutory position is still uncertain at the margins, parties increasingly address AI-assisted outputs in their contracts. They typically specify who may use the output, whether rights are assigned or licensed, and whether any warranty is given as to orig - inality, non-infringement or lawful use of training data.
62 CHAMBERS.COM
Powered by FlippingBook