Portugal · Compliance
GDPR compliance in Portugal
Achieve GDPR compliance in Portugal with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Enschede office team
- Effivity software included
- Academy training included
Who asks for GDPR in Portugal
Clients include
GDPR compliance in Portugal at a glance
Lei n.º 58/2019, de 8 de agosto, and the CNPD is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Portugal ask for evidence that you meet it.
Every organisation that handles personal data in Portugal answers to the Comissão Nacional de Proteção de Dados, the authority Lei n.º 58/2019 names for the GDPR and for the Act. The CNPD publishes the list of processing that calls for an impact assessment and encourages codes of conduct, while IPAC is the body the Act empowers to accredit GDPR certification bodies. Controllers need records, notices and rights handling that stand up to supervision, and the shared-services and BPO centres Portugal Global describes act as processors for group companies and clients abroad. Certification is optional and does not remove responsibility. Sterling's Enschede office builds the records of processing, assessments, contracts and breach routines, with Effivity and Sterling Academy included, and it never certifies or supervises. Ask the CNPD or your counsel about particular processing.
Who needs GDPR in Portugal, and what happens without it
These are the organisations in Portugal that most often need to show GDPR.
- Controllers in Portugal processing customer and employee dataLei n.º 58/2019 makes the CNPD the supervisory authority for the GDPR and the Act, so Portuguese controllers answer to it directly.
- Processors and shared-services centres handling data for group companies abroadPortugal Global names finance, HR, customer service and IT among the work shared-services centres do, and each such activity brings processor duties.
- Businesses running high-risk processing such as monitoring or large-scale profilingThe Act has the CNPD publish a list of processing that needs a data protection impact assessment, which sets the starting point.
- Organisations considering a GDPR certification, seal or markLei n.º 58/2019 names IPAC as the accrediting authority for certification bodies and adds the CNPD's requirements.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the GDPR readiness checkGDPR requirements in Portugal
Strip away the vocabulary and the GDPR requires an organisation to comply in six areas covering how it uses personal data.
In Portugal these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: GDPR explained →
How to achieve GDPR compliance in Portugal
One team from the Enschede office carries the work from scoping to sign-off. Clients in Portugal are served from Sterling's Enschede office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against GDPR and the Portuguese requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does GDPR compliance take in Portugal?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Portugal these are the factors that set the timeline.
- How much processing the organisation does and how many systems hold personal data
- Existing records of processing and data protection impact assessments
- Supplier and international transfer arrangements to document
- Whether a certification or a code of conduct is being pursued
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does GDPR compliance cost in Portugal?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Portugal these factors move both.
- Number of processing activities and business units in scope
- Remediation of contracts, notices and retention rules
- Tooling for rights requests and breach handling
- Optional fees if an accredited certification is pursued
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
GDPR consultants and assessors in Portugal
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers GDPR and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Portugal are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive GDPR in Portugal (4)
| Instrument | How it treats the standard |
|---|---|
| Lei n.º 58/2019, de 8 de agosto, and the CNPD | The instrument itself It makes the CNPD the national supervisory authority for the GDPR and the Act and sets who accredits data protection certification bodies. |
| Regulation (EU) 2016/679 (GDPR), applicable from 25 May 2018 | The regulation itself It encourages data protection certification mechanisms, seals and marks as a way to demonstrate compliance; they do not remove the controller's responsibility. |
| Lei n.º 58/2019 on accreditation of GDPR certification bodies and codes of conduct | The instrument itself IPAC accredits bodies that certify data protection processing, taking account of CNPD requirements, and the CNPD encourages codes of conduct for specific activities and for the state's own processing. |
| IPAC (Instituto Português de Acreditação, I.P.) as Portugal's national accreditation body | Recognition IPAC's general regulation describes it as the national accreditation body under Regulation (EC) No 765/2008, covering testing and calibration laboratories, clinical laboratories, inspection, certification, validation and verification bodies. |
Accreditation, audit language and remote audits in Portugal
Compliance, not certification: the GDPR is a regulation supervised by the CNPD. A GDPR certification, seal or mark is voluntary and issued by a body accredited by IPAC under Lei n.º 58/2019; it does not reduce the controller's or processor's responsibility. Sterling prepares the records, assessments and controls; it does not certify. Edition and transition details: GDPR hub →
Audit language
Portuguese is the official language and English is widely used in international business. Agree the audit language and the language of controlled documents with the certification body at application, and follow any language requirement in a contract or a regulator's procedure.
Remote and on-site
Records of processing, impact assessments and contract reviews can be done remotely; interviews and site checks are added where processing happens on premises.
GDPR in Portugal: questions clients ask
Which authority supervises data protection in Portugal?
Supervision sits with the CNPD. Lei n.º 58/2019 designates it national supervisory authority for the GDPR and the Act, independent and with public-law powers, so it handles supervision and sanctions. Questions about a specific processing activity should go to it or to your counsel.
Which processing needs an impact assessment in Portugal?
The GDPR sets the test, and under Lei n.º 58/2019 the CNPD publishes a list of processing that is subject to an impact assessment and sets criteria to help organisations decide. Start from that list, then add your own judgement for new technologies and large-scale monitoring, and keep the written assessment on file.
Who can certify GDPR processing in Portugal?
Only a certification body accredited by IPAC. The Act names IPAC as the accrediting authority, requires it to take the CNPD's added requirements into account, and says seals and marks come from bodies accredited that way. The scheme is voluntary, so choosing it is a commercial decision rather than a legal duty.
Does a data protection certificate remove GDPR responsibility?
No. The GDPR describes certification as voluntary and available through a transparent process, and says it does not reduce the responsibility of the controller or processor or the powers of the supervisory authority. A certificate helps you show diligence, but the CNPD still judges the processing itself, so keep your own evidence current.
More on GDPR for Portuguese organisations
Other standards Portuguese businesses ask Sterling for
Organisations in Portugal often combine GDPR with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Enschede office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Lei n.º 58/2019, de 8 de agosto, and the CNPD — data.dre.pt; cnpd.pt (accessed 11 Oct 2026)
- Regulation (EU) 2016/679 (GDPR), applicable from 25 May 2018 — eur-lex.europa.eu (accessed 11 Oct 2026)
- Lei n.º 58/2019 on accreditation of GDPR certification bodies and codes of conduct — data.dre.pt; cnpd.pt (accessed 11 Oct 2026)
- IPAC (Instituto Português de Acreditação, I.P.) as Portugal's national accreditation body — ipac.pt (accessed 11 Oct 2026)
- IPAC (Instituto Português de Acreditação, I.P.) — ipac.pt; european-accreditation.org; ipq.pt (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Enschede team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
netherlands@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice