A New Law Lets Judicial Authorities Anywhere in the EU Demand Data Directly From Providers in Portugal, With Fines Reaching 2% of Global Turnover

A law published in Portugal's official gazette on Thursday rewires how criminal investigators across the European Union get hold of digital evidence. Under Lei n.º 55/2026, of 20 August, a judicial authority in any participating member state can send an order straight to the company holding the data, through a designated establishment or legal representative, instead of routing the request through Portuguese courts under the older mutual legal assistance machinery. Providers that ignore those orders face fines running to 2% of worldwide turnover and, in the worst case, a ban on operating in Portugal.

What the law does

The law transposes Directive (EU) 2023/1544 and builds the penalty regime for Regulation (EU) 2023/1543, the pair of instruments Brussels adopted on 12 July 2023 and known collectively as the e-evidence package. The regulation created two new cross-border instruments: the European Production Order, which compels a provider to hand over electronic evidence, and the European Preservation Order, which freezes data so it cannot be deleted while a production order is prepared. Each travels with its own certificate, the COEP and the COEC in the Portuguese text.

Portugal's law also amends two significant statutes: it is the seventh change to Lei n.º 144/99, the law on international judicial cooperation in criminal matters, and the third to Lei n.º 109/2009, the cybercrime law, which gains a new section devoted to cooperation under the EU regulation.

The practical shift is one of address. Take a Portuguese criminal case where the relevant messages, subscriber records or traffic logs sit with a company established elsewhere in the EU. Until now the prosecutor's route ran state to state. Now the order goes to that provider's designated establishment or appointed legal representative, and the provider is obliged to answer within the deadlines set by the regulation.

Who has to appoint someone, and by when

The obligation falls on service providers rather than on users. The law reaches three categories: electronic communications services as defined in Portugal's Electronic Communications Law; internet domain name and IP numbering services, including registries, registrars and the privacy and proxy services attached to them; and other information society services that let users communicate with one another or that store or process data on users' behalf, where storage is a defining component of the service. Financial services are carved out.

What each provider must do depends on where it sits:

• Established in Portugal and offering services in the EU: it must designate, in writing, at least one estabelecimento designado (designated establishment) to receive and execute orders from other member states.
• Offering services in Portugal but not established anywhere in the EU: it must appoint at least one legal representative for the same purpose.
• Established in a member state that does not participate in these instruments: it must also appoint a legal representative.
• Established only in Portugal and serving only the domestic market: the law does not apply.

Whoever is designated has to be given, in the law's words, the powers and resources needed to comply. A provider cannot hide behind a lack of internal procedures: the statute makes the company and its designated establishment or representative jointly and severally liable, and expressly bars "we had no process for that" as a defence. Contact details must be filed with the central authority, and any change communicated within 48 hours.

The clock is generous but finite. Providers already offering services in the EU on 18 February 2026 have six months from the law's entry into force to designate and notify. Anyone starting later gets six months from the day they begin. The law carries no special commencement clause, so the default rule in Portuguese law applies and it takes effect on the fifth day after publication.

ANACOM becomes the registry and the enforcer

The central authority for all of this is ANACOM (Autoridade Nacional de Comunicações, the national communications regulator). It collects, organises and processes the information on designated establishments and legal representatives, cooperates with counterparts in other member states, supervises compliance, opens and decides the administrative offence proceedings, and reports annually to the European Commission on providers found in breach and the sanctions applied. The Procuradoria-Geral da República (Prosecutor General's Office), the judicial authorities and ANACOM are placed under a mutual duty to cooperate.

It is a notable accumulation. The same regulator was designated late as Portugal's authority for the EU AI Act, holds a mandate to force operators to block caller-ID spoofing and identify prepaid SIMs, and spent this month consulting on compensation for botched broadband switches. ANACOM also keeps 40% of the fines it levies under this law, with 60% going to the state.

The penalties

The sanctions chapter is the sharpest part of the text. Failing to designate an establishment or appoint a representative, or failing to notify a change, is a very serious offence, punished under the framework for the communications sector. Failing to preserve or hand over data within the regulation's deadlines is punished with fines from €250 to €20,000 for individuals and up to 2% of total worldwide turnover for companies. Failing to put technical and operational security measures around the order and the data is a serious offence, at €100 to €7,500 for individuals and up to 1% of worldwide turnover for companies.

Where turnover cannot be established, the law substitutes flat bands: €500,000 to €1 million for the production and preservation failures, and €1 million to €5 million for the security breach. Negligence is punishable, with the limits halved.

Beyond the fines sit two teeth that matter more. A provider can be barred from operating in Portugal for up to two years as an accessory sanction, and defying that ban is itself a crime of qualified disobedience. And paying a fine does not extinguish the duty: ANACOM can order the omitted step done and attach a daily penalty of €2,000 to €100,000 for a company, up to €3 million over a maximum of 30 days.

What this means for people living in Portugal

• Your data becomes reachable faster: Subscriber, traffic and content data held about you by a provider can now be demanded by a judicial authority in another member state through a direct order. The safeguards live in the EU regulation, which conditions the heavier categories of data on the seriousness of the offence and on judicial issuing or validation, not in a fresh Portuguese court review of each request.
• If you run a small online service, read Article 6: A Portuguese company offering a hosting, messaging, storage or domain-adjacent service anywhere else in the EU has a new formal obligation, a six-month window, and a very serious offence waiting at the end of it. The purely domestic carve-out is narrow.
• Data protection is not switched off: The law keeps a dedicated chapter on personal data, and the general data protection framework continues to apply to everything done under it.
• Expect this to show up in ordinary cases: Brussels has justified the package on the ground that a large majority of criminal investigations now involve digital data, frequently held outside the investigating state. That covers fraud and online scams as readily as it covers organised crime, at a time when recorded cybercrime in Portugal keeps climbing.

The law was approved in Parliament on 17 July, promulgated by President António José Seguro on 12 August and countersigned by Prime Minister Luís Montenegro the same day. The next visible milestone will be ANACOM's register: within six months, the list of who answers for the world's service providers in Portugal should exist, be filed with the European Commission, and be published on the European Judicial Network's website. It arrives alongside a broader push to digitise the Portuguese state, including the bill the Cabinet approved on the same day to stop public bodies asking citizens for documents the state already holds.