Portugal's Notaries Are Set to Start Issuing Apostilles, and the Data Watchdog Named Five Conditions Before the Platform Can Open

For twenty-two years, Portuguese law has said that a notary may legalise a document by attaching an apostille. For twenty-two years, no notary has been able to do it, because the ordinance that was supposed to explain how was never written. That ordinance now exists in draft, it has been through the data protection regulator, and it came back with five things to fix.

The Comissão Nacional de Proteção de Dados (National Data Protection Commission, or CNPD) published Parecer 61/2026, its opinion on a Projeto de Portaria que regulamenta a legalização de documentos pelos Notários através da aposição de apostilas (draft ordinance regulating the legalisation of documents by notaries through the affixing of apostilles). The draft was sent to the regulator by the office of the Secretária de Estado da Justiça (Secretary of State for Justice), and the opinion was approved at the Commission's meeting of 8 September 2026 and signed by its president, Paula Meira Lourenço.

What an apostille is, and why this matters to anyone with a foreign life

An apostille is the certificate that lets a public document issued in one country be accepted in another without going through a consulate. The regulator's own summary is precise: it is the formality by which a competent authority of the Portuguese State recognises the authenticity of the signature, the capacity in which the signatory acted and, where applicable, the authenticity of the seal or stamp on the public act. It comes from the Hague Convention of 5 October 1961 abolishing the requirement of legalisation for foreign public documents, which Portugal approved for ratification by Decreto-Lei n.º 48450.

If you have ever had to send a Portuguese birth certificate, a marriage certificate, a criminal record certificate or a power of attorney abroad, or bring a foreign one here, you have met the apostille. Our guide to apostille and consular legalisation sets out how the service works today.

Today it works through the prosecution service. Article 2 of Decreto-Lei n.º 86/2009, de 3 de abril, quoted in full by the regulator, gives the issuing and the verification of apostilles under Articles 3 and 7 of the Convention to the Procurador-Geral da República (Prosecutor General), who may delegate to district prosecutors general, to deputy prosecutors general sitting in appeal courts where there is no district prosecution office, and to deputy prosecutors general attached to the Representatives of the Republic for the autonomous regions or heading prosecution offices based there.

A power written in 2004 and never switched on

Decreto-Lei n.º 26/2004, de 4 de fevereiro, which approved the Estatuto do Notariado (Notarial Statute), already lists the legalisation of documents by apostille among a notary's competences. The catch sits in the same provision: Article 4(4)(i) says it happens on terms to be fixed by an ordinance of the government member responsible for justice. That ordinance is the one now in draft.

The draft would let notaries, and the staff duly authorised to perform notarial acts under Article 8 of the Statute, issue apostilles on public acts and also verify an apostille already issued, under the second paragraph of Article 7 of the Convention. Acts originating from the Ministério Público (Public Prosecution Service) and from the courts are carved out.

That carve-out is the regulator's first complaint. Reading Article 3 of the draft, the CNPD says it is not clear whether the exclusion covers only the issuing of apostilles on prosecution and court acts, or whether it also covers the verification of apostilles already issued on those acts. It asks for the article to be redrafted for legal certainty, noting that provisions of that kind translate into personal data processing that needs regulating.

The platform, and the fact that nothing works outside it

Article 1(2) of the draft also regulates how an electronic apostille platform is to run. The platform is provided and managed by the Ordem dos Notários (Order of Notaries) at notarios.pt, and the draft sets the general rules for paying for the apostille service and for the fees charged to manage the platform.

The regulator flags a detail that anyone planning to use the service should know: legalisation by apostille performed by a notary or authorised staff is valid only if it is done through that electronic platform. There is no paper fallback route through a notary.

The platform is designed to issue, register and verify apostilles in both electronic and paper form, and to host a centralised register plus a database of specimen signatures, stamps and seals. That specimen database drew a warning of its own. The CNPD sees a risk of purpose creep and says it must be strictly confined to validating apostilles, with any integration or reuse for other notarial acts outside the Convention barred.

What the platform would hold about you

Under Article 11(2) of the draft, the Ordem dos Notários is the controller, and must guarantee data subjects their rights to information, access and rectification. The data involved, as the regulator lists it: identification data of the applicant, data on the signatory of the public act (name, signature, the capacity in which they acted), the data contained in the apostilled documents themselves, and the professional identification, credentials and access logs of notaries and authorised staff.

The documents are the problem. An apostilled public act can carry special categories of personal data under Article 9 of the General Data Protection Regulation, or data on criminal convictions and offences under Article 10, even though the platform has no independent purpose in collecting them. The CNPD wants the ordinance to require minimisation techniques before attachments are uploaded, where that data is irrelevant to later authenticity checks.

It also doubts a promise made in the impact assessment that accompanies the draft. That assessment rates the guarantee of data subject rights as high risk, and proposes as mitigation that people be able to access their own data easily, directly and securely. The regulator points out that since the system will neither index the content of documents nor allow searches, it is questionable whether that is even feasible. On your own data rights more generally, see our guide to data rights in Portugal.

Forever is not a retention period

The sharpest exchange in the opinion is about how long the platform keeps things. The draft fixes no retention period at all for the electronic apostille file, for the apostilled document, for the rest of the electronic register or for the specimen database. The only period it sets is two years, for access logs.

The impact assessment explains the omission on page 15 by saying that no period is expressly fixed because the Hague Convention makes it compulsory that an apostille can be consulted forever. The regulator does not accept the leap. Article 7 of the Convention does oblige the issuing authority, at the request of any interested party, to verify that the particulars on the apostille match those in its register or file. But reading that as unlimited retention runs against the storage limitation principle in Article 5(1)(e) of the GDPR. Indefinite retention, the CNPD says, must apply exclusively to the strict metadata of the apostille, and not to the attached documents, whose retention needs a reasoned maximum period.

The QR code, the scrapers and the crawlers

Article 6 of the draft sets up public verification through a QR code and an alphanumeric code. The CNPD has serious reservations. Public reading of that code must not expose the whole apostilled document or the personal data of the applicant or presenter, and must be limited strictly to confirming the essential metadata of the apostille certificate.

The security asks that follow are unusually specific for a data protection opinion. The impact assessment lists encryption at rest and in transit as "to be confirmed"; the regulator wants TLS in transit and AES-256 at rest for files held in the PDF/A repository and for the specimen databases. Access logs should be digitally signed and kept in a write once, read many repository so that not even a systems administrator profile can alter them, inadvertently or otherwise. The requirement of strong authentication by qualified digital certificate is praised, with a request to add role based access control on a least privilege basis.

Two more asks look forward rather than back. Because any system exposed to the open internet runs a high risk of data scraping and sequential enumeration by automated attacks, the CNPD suggests an adaptive CAPTCHA challenge on public apostille verification. And it wants guarantees that apostille metadata are not indexed by search engines, and that crawling agents harvesting data to enrich artificial intelligence platforms are blocked outright.

Where it stands

The opinion is not a veto. The CNPD calls the draft and its impact assessment a globally positive framework for implementing an electronic apostille platform, showing concern for data protection and information security. Its five formal recommendations are to clarify Article 3 on verification of apostilles already issued on prosecution and court acts; to define retention periods for attached documents and the other elements of the register; to adopt effective technical guarantees on encryption at rest and in transit; to reference the contract or other normative act binding processors under Article 28(3) of the GDPR, including a ban on unauthorised sub-processing and periodic audits; and to reinforce minimisation and protection against scraping and automated indexing around the QR code.

The draft names no processors, though the impact assessment identifies several companies already acting as such, which is why the regulator wants the contractual chain written into the ordinance itself.

What happens next is the ordinary path for an ordinance: the Ministry of Justice takes the opinion, decides what to change, and the text is signed and published in the Diário da República. It has not appeared there yet. When it does, the practical change for residents is straightforward. Instead of one route to an apostille through the prosecution service, there will be two, and the second one runs through the several hundred notarial offices already spread across the country. For a sense of what those offices already do, see our guide to notaries in Portugal.