🇵🇹Law No. 58/2019 Ensuring Execution of the GDPR

← Back to laws in Portugal

Law No. 58/2019 Ensuring Execution of the GDPR

Portugal applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

Law 58/2019 implements the GDPR in Portugal, defines CNPD and DPO arrangements and adds national rules for children, deceased persons, surveillance, health, public bodies and enforcement.

National additions and variations

• Article 16 sets 13 as the Article 8 age; below 13, legal representatives must consent, preferably using secure authentication.
• Article 17 protects specified data of deceased persons and permits designated persons or heirs to exercise access, rectification and erasure rights unless the deceased directed otherwise.
• Articles 9-13 add DPO rules: no professional certification is required, audit, incident-awareness and data-subject liaison duties apply, and public-entity appointment rules are specified.
• Article 19 regulates video-surveillance placement and sound capture; Articles 27-33 add employment, health and genetic-data, archive, research and official-publication rules.
• Health and genetic-data systems require access controls, traceability and notification to the data subject of accesses; public-interest archiving and research require minimisation, anonymisation or pseudonymisation safeguards.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.