Portugal news, in English, every morning. Free.

Subscribe

The Portugal Brief
Subscribe
Guides

Your Data Protection Rights in Portugal

Researched and written with AI tools from official sources. How we make our guides

How to see, correct, or delete the personal data held about you in Portugal, the one-month reply rule, camera limits, and how to complain to the CNPD.

The Portugal Brief 10 min read

Your Data Protection Rights in Portugal

Last verified: October 2026.

Who this is for

  • You live in Portugal and want to know what a company or public body holds about you, or have it corrected or deleted.
  • A landlord, neighbour, or employer has a camera pointed at you, or is using your data in a way you object to.
  • You run a business here and want to know what people can ask of you.

Not for you if: you have a consumer complaint about a product or service, not about your data. Read How to File a Consumer Complaint in Portugal instead.

The EU General Data Protection Regulation (GDPR, called RGPD in Portugal) gives you rights over your personal data. You can ask to see it, correct it, delete it, limit its use, move it, or object to its use. You use these rights directly with the organisation holding your data. It is free. The organisation must reply within one month, or up to two more months if it tells you why. If it ignores you or refuses without good reason, you can complain to the national data protection authority, the CNPD (Comissão Nacional de Proteção de Dados).

The laws that apply

Three layers of law apply.

  • The GDPR (RGPD). The EU regulation applies directly in Portugal. It is the source of your rights.
  • The national data protection law. It adds Portuguese rules on cameras, employment, children, retention of data, and penalties.
  • The criminal data law. It covers data used by police and courts to prevent, investigate, and prosecute crime. Your rights still exist here, but with more limits. Access to data in a criminal case, a court decision, or the criminal record follows criminal procedure law instead.

The regulator. The CNPD is an independent public body that works alongside the Assembleia da República (the parliament). It supervises compliance with the GDPR and the Portuguese data protection laws. Since April 2026 it is also one of the national authorities for the EU Digital Services Act.

Your six rights

The CNPD stresses that each right has its own purpose, so you should use each one separately.

1. Access. You can find out whether an organisation processes your data. If it does, you can get a copy, plus:

  • why it uses the data;
  • what kinds of data it holds;
  • where the data came from, if not from you;
  • who processes it on the organisation's behalf;
  • who it shares the data with;
  • how long it keeps the data, or how it decides;
  • whether it makes automated decisions or profiles about you, the logic behind them, and the effects on you;
  • what protects your data if it is sent outside the European Economic Area.

You also have the right to be told about your other rights and about your right to complain to the CNPD.

2. Correction (rectification). You can have wrong or incomplete data corrected. This is often the quickest way to fix a wrong address or tax status that is causing problems elsewhere.

3. Deletion (erasure). Also called the right to be forgotten. It is not absolute. Where a law sets a period for keeping data, you can only ask for deletion once that period ends.

4. Restriction. You can ask an organisation to stop using your data, without deleting it, while a dispute about its accuracy or lawfulness is settled.

5. Portability. You can get data you provided in a structured, machine-readable format, or have it sent to another organisation.

6. Objection. You can object to the use of your data. If you object to direct marketing, the organisation must stop using your data for marketing.

How to use your rights

  1. Find the right channel. You exercise your rights with the organisation holding your data (the "controller"), not with the CNPD. Use the channel named in its privacy policy, if there is one.
  2. Identify yourself. You must be able to prove who you are. You do not have to give more personal data than the organisation already holds about you. For public bodies, signing in with your Chave Móvel Digital proves your identity.
  3. Name the right you are using. For access, the CNPD suggests a simple sentence such as: "Under the GDPR, I request access to my personal data."
  4. Keep proof. Keep dated proof that you sent the request, and all the replies. The CNPD says this is essential if you later need to complain.

What the organisation must do

  • Reply within one month of receiving your request.
  • If it needs more time, it can extend by two more months. It must tell you within the first month and explain why.
  • Reply clearly and simply. If you asked by email or online, it should reply electronically where possible.
  • Not charge you. Using your rights is free.

The organisation can refuse, or charge a reasonable fee for its costs, only if a request is clearly unfounded or excessive, for example because it is repeated again and again.

Special situations

Children. A child aged 13 or over can consent alone to online services offered directly to them. Under 13, a parent or legal guardian must consent, preferably with secure authentication. Parents usually exercise a child's data rights, though children may do so themselves depending on their age and maturity.

People who have died. Some data of people who have died stays protected: sensitive data, and data about private life, image, or communications. The rights of access, correction, and deletion are then exercised by the person the deceased named, or otherwise by the heirs. You can also leave instructions that no one may exercise these rights after your death.

Several organisations responsible. If more than one organisation is jointly responsible for your data, you can use your rights with any of them, whatever they agreed between themselves.

How long data is kept. The period is the one set by law or regulation. If none is set, it is whatever is needed for the purpose. When the purpose ends, the organisation must destroy the data or make it anonymous. Social security contribution records for pensions can be kept without time limit, to help rebuild your contribution history.

Secrecy duties. If an organisation says a legal duty of secrecy stops you seeing your data, you can ask the CNPD for its opinion on whether that duty really applies to you.

Cameras: what may not be filmed

The national law sets clear limits on security cameras used to protect people and property. Cameras may not cover:

  • public streets, neighbouring properties, or any place not under the owner's exclusive control, except what is strictly needed to cover the entrances to the building;
  • the keypad area of cash machines and payment terminals;
  • private areas for customers, such as toilets, waiting areas, and changing rooms;
  • areas reserved for workers, such as eating areas, changing rooms, gyms, toilets, and rest areas.

In schools, cameras may only cover the outer perimeter and entrances, plus rooms with valuable equipment such as laboratories or computer rooms.

Sound. Where cameras are allowed, recording sound is banned, except while the premises are closed or with the CNPD's prior permission.

If a neighbour's or landlord's camera films your home. A camera pointed across your terrace, your door, or your windows goes beyond what the law allows. Photograph the camera and what it can see. Ask the owner, or the condominium administrator, in writing who is responsible for it. If that fails, use the CNPD's video surveillance complaint form. For building matters, see How a Condominium (Condomínio) Works in Portugal.

Your data at work

The national law sets special rules for employers.

  • Camera footage and remote monitoring data can only be used in criminal proceedings. They can also be used to decide disciplinary liability, but only as far as they are used in those criminal proceedings.
  • Biometric data (such as fingerprints or face scans) is only lawful for recording attendance and controlling access to the employer's premises. Only a template of the biometric data may be used, and it must not be possible to reverse it back into the original data.
  • Your consent is not needed for processing that is necessary to carry out your employment contract.
  • Payroll and accounting firms that process staff data for an employer are covered by the same rules, under a service contract with the same confidentiality.

For your wider rights at work, see Employment Contracts, Pay, and Worker Rights in Portugal.

How the CNPD applies the national law

In September 2019, the CNPD decided that some parts of the national law conflict with the GDPR. It said it would not apply them in the cases it handles, so that EU law takes priority. Where it sets one aside, the GDPR rule applies directly instead.

The rules it sets aside include:

  • parts of the rules on where the law applies;
  • the rule that a legal secrecy duty blocks your rights of information and access;
  • the rule allowing public bodies to use data for purposes other than the original one;
  • the rule that a worker's consent is not needed where processing gives them a legal or financial advantage;
  • parts of the rules on fine levels, including a required warning before fining a first careless breach;
  • rules on renewing consent and on older data protection regimes.

What this means in practice. For fines, the CNPD works with the GDPR's own maximums. For the most serious breaches, that is up to €20 million or 4% of worldwide yearly turnover, whichever is higher. For others, it is up to €10 million or 2%.

A caveat. The CNPD's decision binds the CNPD. It does not repeal the law and it does not bind the courts. A court can take its own view. Treat it as a guide to how the regulator will act.

Complaining to the CNPD

Go to the organisation first. The CNPD says you can turn to it when:

  • you get no reply within the legal deadline;
  • your request is ignored or refused without good reason;
  • you think your rights were not properly respected.

Three complaint forms. Choose the one that fits, so your case moves faster:

  1. Unsolicited marketing (spam).
  2. Video surveillance and biometric data.
  3. Everything else: the general form.

On the general form, describe the facts briefly and let the CNPD do the legal analysis. Say whether you have documents or evidence, but you do not need to attach everything. The CNPD will ask if it needs them.

Questions are different from complaints. If you only want to know whether a practice is lawful, use the CNPD's information request form (pedido de informação), not a complaint form.

Contact details. CNPD, Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa. Email: [email protected]. Requests and complaints must be made in writing through the online forms. The CNPD does not offer telephone help to the public, and in-person meetings are exceptional and by appointment only.

Getting compensation

The CNPD investigates, orders, and fines. It does not award you money.

  • Compensation. If unlawful processing or any other breach of data protection law causes you harm, you have the right to compensation from the organisation responsible. It escapes liability only if it proves the harm is not its fault. Claims against the State and public bodies follow the State liability rules.
  • Suing in Portugal. You can sue the organisation, including for damages. Portuguese courts can hear the case if the organisation has a base in Portugal, or if you normally live here. So, as a resident, you can usually sue in Portugal even if the company is based elsewhere.
  • Challenging the CNPD. Cases against the CNPD's decisions or failures to act go to the administrative courts.
  • Being represented. You can ask a non-profit organisation working in data protection to act for you, including to complain and to claim compensation.
  • Public bodies. You can also use the ordinary administrative complaint routes against public bodies.

For smaller private disputes, the julgados de paz (peace courts) are a low-cost civil route. If you cannot afford a lawyer, see Applying for Legal Aid in Portugal.

What this means for you

  • If you rent: check where cameras point. One covering a shared entrance is usually allowed. One covering your terrace, your door, or the street beyond the entrance usually is not.
  • If you are employed: your employer cannot use camera footage for a disciplinary case outside criminal proceedings, and cannot use your biometrics for anything beyond attendance and building access.
  • If you run a business: you are a controller. Reply within the month, do not charge for access, publish a clear privacy notice with a working rights channel, and keep a record of your processing.
  • If you get pensions or benefits: an access request shows what a public body holds about you and where it came from. This helps when an automated data match leads to a decision you disagree with.
  • If you are new to Portugal: start with one access request to the organisation you think holds the messiest file on you. It is free, it must be answered within a month, and the reply shows who else has your data.

You do not need a lawyer to start. A dated email asking for access, kept with proof of sending, starts the one-month clock.

This guide is general information about Portuguese and EU data protection law, not legal advice. For a specific dispute, especially one about damages, speak to a lawyer.

Sources

This guide is written from official sources and, where relevant, organisations' own websites.

Last verified October 2026. Rules and fees change; check the official source before acting.

Read next