Abreu Advogados

Abreu Advogados is one of Portugal’s largest independent law firms, with a dedicated team for privacy, data protection and information security, acting for clients in Portugal and across the Portuguese-speaking world. The team advises throughout the full lifecycle of personal data: compliance and data governance programmes, records of processing and retention policies, data protection impact assessments, international transfers and transfer impact assessments, controller and processor arrangements and data-related contracts, workplace privacy and employee monitoring, marketing and adtech, and the privacy dimension of new products and business models. It represents clients before the Portuguese Data Protection Authority (CNPD – Comissão Nacional de Proteção de Dados) in investigations and administrative offence proceedings, and before the Portuguese courts in appeals and data subject claims. It also supports clients in incident and breach response, from the first hour through notification and follow-up, and takes outsourced and supporting DPO roles. The adjacent regulatory areas sit with the same team: cybersecurity, including NIS2 and sector-specific regimes; artificial intelligence, including the AI Act and its interaction with the Portuguese regulatory framework; digital services and platforms; e-commerce; electronic communications; and electronic identification. Clients therefore get one team for a set of obligations that, in Portugal, is spread across several regulators. Our experience covers banking and financial services, health and pharmaceuticals, energy, telecommunications and internet services, retail and consumer goods, technology and data centres, and the public sector, for clients ranging from global technology, media and consumer groups to national companies and public bodies. The practice is ranked by The Legal 500 for Data Privacy and Data Protection, and the firm is also ranked for TMT in Chambers Europe. We regularly act as Portuguese local counsel: on a discrete question of national law, a questionnaire or survey, a CNPD filing or notification deadline, or the Portuguese component of a multi-jurisdictional project, with the reporting discipline and fee predictability that this role requires. Through Abreu International Legal Solutions, we work with local partners in Angola, Cape Verde, Mozambique and Timor-Leste, and have advised on data protection matters in those jurisdictions, allowing an instruction given in Lisbon to extend to markets where data protection frameworks may be more recent and local guidance less developed. Abreu Advogados has more than 250 lawyers and over 30 years of full-service practice. It was the first Portuguese law firm to obtain B Corp certification, in 2015; it was ranked by the Financial Times Innovative Lawyers Europe 2025 among the five most innovative law firms in Europe and as the most innovative law firm in Portugal; and it runs its own knowledge and innovation hub, the Instituto de Conhecimento Abreu.

Representatives

Ricardo Henriques

partner

Contact

Publications

• The Mischief of Mismanagement: Tale of a Breach of the GDPRIn early 2022, the Portuguese National Data Protection Supervisory Authority (“CNPD”) accused Lisbon’s Municipality of retaining demonstrators’ and protestors’ personal information for longer than necessary and sharing it with national and foreign public entities without proper legal basis, in breach of the principle of data minimization, without having previously conducted a data protection impact assessment and in breach of their obligations to inform data subjects about data processing operations. This Article provides an overview of the Administrative Court Decision that, almost two and a half years later, confirms the impressions of the CNPD and fines the Municipality in over one million euros for its mischief in the management of personal data.17 September 2024
• Finding the balance between fighting crime and privacy: an Update to the use of Metadata in Criminal ProsecutionOn October 13, 2023, the Portuguese Parliament approved an updated version of Law No. 32/2008, which had been declared unconstitutional in April 2022. The community is now waiting for a new preventive judgement of constitutionality on the use of communications metadata in criminal investigation. This Article offers an overview of key modifications and attempts to provide some insight into the content of the impending decision7 December 2023
• Smile, you're being recorded!Following the American and European trend, Portugal is now one of the countries that has determined the use of Bodycams by security forces in some situations. With the entry into force of this regime, it remains to be seen whether the personal data and privacy of citizens will be effectively protected.25 May 2023
• Analysis of the recent activity of the Portuguese Supervisory Authority - What to expect?It has been perceived that the sanctioning activity of the Portuguese Supervisory Authority has been fundamentally focused on public entities, which may suggest that for private companies the verification of compliance with GDPR has been less demanding. An example is the recent CNPD's Resolution that applied a fine of EUR 170,000 as well as two reprimands, for the practice of four administrative offences related to the processing of personal data of refugees from Ukraine displaced in Portugal. This sanction originated from a news article published by a Portuguese newspaper which, among other aspects, portrayed the execution of copies of documents belonging to refugees, in the presence of Russian citizens, in a Portuguese City Hall.21 December 2022
• Finding a balance between fighting crime and privacy – the use of metadataLast April, the Portuguese Constitutional Court declared unconstitutional the provisions of articles 4, 6, and 9 of Law 32/2008 of July 17, which transposed into Portuguese law Directive 2006/24/EC of March 15, on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks (also known as the "Metadata Law"), thereby raising the metadata subject to the top of the most discussed topics of the moment.29 July 2022
• New draft law on the "right to be forgotten" for those who have overcome serious illnessLast October, the Portuguese parliament approved in a final vote a draft law that establishes the "right to be forgotten", preventing people who have overcome serious illnesses from being discriminated against when accessing credit or insurance. This draft law is an important step not only in the field of data protection but also in the protection of human rights and the battle against discrimination.22 November 2021
• Portuguese Data Protection Authority activity report 2019/2020As part of the fulfilment of the duties assigned to it by the General Data Protection Regulation (hereinafter “GDPR”), the National Commission for Data Protection (hereinafter “CNPD”) has published its most recent activity report, which concerns the work carried out in the years 2019 and 2020. We have summarized the main highlights characterizing the work of the CNPD in the last two years.19 May 2021
• Scientific Research across Europe. Does the GDPR ensure an aligned approach?The GDPR aims to establish a uniform legal framework applicable to the processing of personal data across Europe, while allowing Member States to legislate differently with regard to specific matters. One of those matters is the processing of personal data for scientific research purposes. Does EU Member States law, specific Portuguese law, prevent an aligned approach with regard to the processing of personal data for scientific research?7 December 2020
• 2 years of GDPR, 1 year of Portuguese implementation lawThe 25th of May marked the second anniversary of the application of the General Data Protection Regulation (GDPR) in the European Union.2 July 2020
• Portuguese Law implementing GDPR finally approvedOn the 14th of June 2019 (one year later than expected) Portugal has finally approved Draft Law no. 120/XIII/3.ª (GOV), implementing the (EU) Regulation 2016/679 (General Data Protection Regulation or GDPR) in Portugal.26 June 2019
• Portuguese GDPR implementation legislationEven though the GDPR is directly applicable in the Member States, it has left open the possibility for Member States to enact national legislation implementing different solutions for certain aspects, the so called opening clauses.15 March 2018