The Once-Only Rule Goes to Parliament: Public Bodies Would Have to Fetch Your Documents Themselves, and Your Consent Would No Longer Be Collected

Anyone who has collected a certificate from one Portuguese public body in order to hand it to another knows the shape of the problem. A bill that entered Parliament on Monday is aimed squarely at it. Proposta de Lei n.º 107/XVII/2.ª, approved in the Council of Ministers on 20 August and filed on 21 September, asks the Assembleia da República for permission to write a general legal regime for documentary and data interoperability across the public administration.

It is worth being precise about what the bill is. It does not create the regime. It is an autorização legislativa (legislative authorisation), valid for 180 days, under which the Government would then approve the rules by decree-law. The draft decree-law is annexed to the bill, so the substance is already public.

The principle, and the machinery behind it

Article 1 of the annexed draft states the princípio "só uma vez", the once-only principle: citizens present their data and documents to the public administration once, and the administration must not ask for what it already holds. The machinery is the Plataforma de Interoperabilidade da Administração Pública (Public Administration Interoperability Platform), known as the iAP and run by the Agência para a Reforma Tecnológica do Estado (Agency for the Technological Reform of the State), or ARTE. Using it becomes compulsory whenever a public body needs a document produced by another covered body.

The list of covered bodies is broad: direct and indirect state administration, independent administrative entities, municipalities, municipalised services, the state and local business sectors, and the autonomous regions with adaptations. The external services of the foreign ministry, which is to say consulates, are included, a detail that matters to anyone filing paperwork from abroad.

Two further provisions are quietly useful. Article 6 requires every covered body to register its services in the Catálogo Único de Serviços Públicos, listing which documents each service needs and who holds them, and then says that an incomplete or outdated catalogue entry cannot on its own justify demanding the document from you. Article 8 tells consuming bodies to ask, wherever technically possible, only for confirmation of a legally relevant attribute, status or condition, rather than for a whole document.

The consent step disappears

The change that will attract most argument is the removal of consent. Article 23 of the draft revokes article 28.º-A of Decreto-Lei n.º 135/99 and Resolução do Conselho de Ministros n.º 42/2015. The Government's reasoning, set out in the explanatory memorandum, is that the consent requirement written in 2014 stopped being an appropriate basis once the General Data Protection Regulation applied, because in this kind of relationship the data subject is not genuinely free to refuse. The lawful basis becomes the legal obligation to use the platform instead.

In its place the draft offers traceability. ARTE becomes a processor, must keep records of platform operations for three years, and has one year from entry into force to build an application letting people see who accessed their data and when. The Centro Nacional de Cibersegurança (National Cybersecurity Centre) may order security assessments and audits and issue binding determinations, and the platform must be audited annually. Special categories of data, tax secrecy, and the civil registry, civil identification and criminal record regimes keep their own access limits.

The Comissão Nacional de Proteção de Dados (National Data Protection Commission) reviewed this draft in Parecer 33/2026, approved on 19 May. Its central criticism was that the text leans on open or vaguely worded norms with direct data-protection consequences, which it called manifestly contrary to the principle of legality, and it recommended the Government use precisely the route now taken: an authorisation bill under article 165(1)(b) of the Constitution. It then listed twenty-one specific changes. Some have landed, including the access-consultation function. Two have not: the annexed draft still carries no express prohibition on copying whole databases through the platform, and no provision on channels for people who cannot use digital services.

Once the authorisation passes, the regime takes effect sixty days after publication, with the catalogue, digital-delivery and minimisation rules following at the start of the third month.