1. Introduction

Portugal's telecommunications, media and technology ("TMT") market has undergone significant changes over the last years, with a strong development of its communications' infrastructure and several EU driven regulatory developments that changed the regulatory landscape. Fibre to the premises covered 95.5% of households in 2025, against an EU average of 74.1%. 5G carries more traffic than the earlier mobile generations, and several new transcontinental submarine cables now land on Portugal's coast. Hyperscale data centre projects, led by the campus at Sines, are adding capacity.

This growth brings operators, investors and infrastructure providers are subject to a large set of rules derived from EU directives and regulations. Law 16/2022 of 16 August governs electronic communications, and Decree-Law 125/2025 transposes the NIS2 Directive on cybersecurity. EU legislation on artificial intelligence, data and crypto-assets applies alongside them, and the Commission published the Digital Networks Act ("DNA") proposal in January 2026. Several of these statutes are new, and some are still changing.

This briefing explains those rules and the market in which they apply. It is written for operators, investors, cloud and data centre providers and their advisers. It covers electronic communications, network infrastructure, digital services, cybersecurity and user protection, and it treats media only as part of the market overview.

The briefing states the law and the market as at September 2026. Market data comes mainly from 2025 and from ANACOM, the electronic communications and space regulator, and from public announcements by operators and investors.

Section 2 describes the market. Sections 3 to 7 cover each area of regulation in turn, and section 8 sets out the key takeaways. Appendix A lists the regulatory authorities and Appendix B the dates referred to in the briefing.

2. Market Overview

Portugal enters the final quarter of 2026 with the connectivity profile of a mature European market and the investment pipeline of an emerging digital infrastructure hub. The indicators below illustrate this profile: fixed broadband, 5G and data centre investment.

FIXED BROADBAND ACCESS	FIXED ACCESSES	5G IN ACTIVE USE	MICROSOFT
90.5% of households, 2Q 2026	4.9M +2.2% YoY, 2Q 2026	45.8% of accesses, 2Q 2026	€8.6B AI investment in Sines[1]

The fibre deployment started with public co-funding and was extended by private operators that identified the commercial case for early investment. The 5G crossover reflects, in part, changes in mobile consumption as gigabit fixed access becomes the primary home connection. The Microsoft commitment in Sines is significant: Portugal has moved from a marginal position on the hyperscaler map to a viable alternative to the traditional FLAP-D markets for certain workloads.

2.1. Sector indicators

2.1.1. Fixed broadband and the migration to gigabit

By the end of the second quarter of 2026, 90.5% of Portuguese households had access to fixed broadband, 0.6% more than a year earlier. The number of fixed accesses reached 4.9 million, an increase of 2.2% year on year. Fibre to the home or building ("FTTH/B") continued to drive growth and now accounts for 73.9% of fixed accesses, after adding 234,000 accesses (+7.0%) over the previous twelve months. The remaining accesses split between cable, xDSL[2] and a residual share of fixed wireless and satellite connections.

The shift to ultra-fast broadband is advanced. In the second quarter of 2026, 94.2% of fixed accesses were ultra-fast, with download speeds of 100 Mbps or more. Gigabit accesses, with speeds of 1 Gbps or above, now represent 47.4% of the total and, for the first time, outnumber accesses between 100 Mbps and 1 Gbps (46.9%). The gigabit segment grew 66.6% year on year, reflecting both supply and demand: operators bundle higher tiers as standard, and end users increasingly take them up to support cloud workloads, video conferencing and home office connectivity.

2.1.2. Mobile networks and the move to 5G

On the mobile side, 5G has drawn level with 4G. By the end of 4Q 2025, 5G and 4G each accounted for 42.3% of mobile accesses in effective use. Legacy 2G and 3G technologies fell to 15.4% combined. By the end of 2Q 2026, the 5G share had risen to 45.8%.

The legacy technology footprint is shrinking by design. MEO switched off 3G in January 2024. NOS and Vodafone are following. The consumer transition is largely complete. The industrial transition is not: M2M deployments, point-of-sale terminals, fleet telematics and metering systems still running on 2G or 3G need to migrate, and operators have been making that clear for years. Progress in industrial estates has lagged well behind the consumer market.

On 5G, the rollout accelerated through 2024 and 2025 and continued at a slower pace in 2026. Base stations across the four operators reached 16,142 sites by the end of 2Q 2026, up 11.7% year on year. On paper, national coverage is in place. Indoor coverage in dense urban areas, however, remains uneven and continues to be a focus of investment, particularly for enterprise use in offices and large retail buildings.

2.1.3. Pricing and data consumption

Telecom prices in Portugal rose sharply in 2023 and 2024, driven by contractual clauses that allow the three largest operators to adjust tariffs annually in line with the previous year’s consumer price index ("CPI"). The trend reversed in 2025 and the decline deepened in 2026. In August 2026, telecom prices were 4.3% lower than a year earlier, the largest drop in the EU, where prices rose 2.6% on average. Two factors explain the reversal: the unwinding of the 2022–2023 inflation spike that fed through into CPI-indexed contracts, and the competitive pressure from DIGI’s entry.

DIGI, which launched consumer offers in November 2024 following its acquisition of NOWO, has positioned itself as the low-cost alternative. In August 2026, DIGI offered the lowest monthly price for nine of eleven offer types tracked by ANACOM, including standalone mobile service at €4. ANACOM’s price reports show that this competitive entry has begun to reshape the pricing floor, even though the incumbent operators’ prices have not converged fully.

Data consumption continues to climb. In 2025, each fixed broadband access generated an average of 311 GB per month, up 3.4% year on year, and the monthly average reached about 350 GB per access by 2Q 2026. Mobile data usage reached 16.2 GB per user per month in 2025, up 31.5%. Traffic on 5G networks represented 23.4% of total mobile data, with 5G users consuming an average of 8.3 GB per month. Voice traffic, by contrast, continues to decline across both fixed and mobile networks, and SMS volumes fell 25.2% in 2025, driven by the ongoing shift to over-the-top messaging services[3].

2.2. Key players and market structure

2.2.1. Telecommunications operators

The Portuguese telecoms market has three major operators and one fast-growing challenger. All offer a full spectrum of fixed and mobile services.

• MEO, the legacy incumbent under Altice Portugal, owns the country's principal fixed network and leads fixed broadband. It completed the 3G switch-off in January 2024 and is part-way through a multi-year upgrade programme, including a Radio Access Network ("RAN") deal with Nokia.
• NOS came out of the 2013 merger of cable operator ZON with mobile operator Optimus. It has advanced furthest on standalone 5G, marketed as 5G+, and shares radio access infrastructure with Vodafone in parts of the country.
• Vodafone Portugal is the Vodafone Group’s local operation. By end-2025 it had the largest 5G footprint in the country: 5,449 base stations, ahead of NOS, DIGI and MEO. The ranking measures conversion rather than reach. MEO operates 5,598 mobile sites, second only to Vodafone, but only 44.0% of them carried 5G at the end of 2025, against 94.4% for NOS and 92.0% for Vodafone.
• DIGI completed its acquisition of NOWO in October 2024 and launched consumer offers in November 2024. ANACOM approved the transfer of NOWO’s 3.6 GHz frequencies to DIGI in January 2025. Through an aggressive pricing strategy, the Romanian-based challenger has grown rapidly.

Below the four main operators sits a layer of small-scale operators, both fixed and mobile, including MVNOs[4] and sub-brands.

The main example is WOO, a NOS-owned brand built entirely around a smartphone app. It runs on NOS infrastructure and is aimed at price-sensitive, digital-native customers.

The incumbents also run youth brands: Moche under MEO, Yorn under Vodafone and WTF under NOS, which Optimus launched in 2013 and NOS kept after the merger.

Outside the incumbents’ own brands, LigaT entered in June 2023 with its own fibre in Mafra, Ericeira and Montijo, competing on price without depending on wholesale access. Lycamobile operates as an MVNO, mainly serving Portugal’s diaspora communities.

A further layer serves business customers only. ONI, created in 1998 out of the liberalisation of the Portuguese market and owned by the Spanish group Gigas since 2020, sells converged connectivity, cloud and cybersecurity to companies, and Portugal accounts for more than half of its parent’s revenues. Ar (previously known as Ar Telecom), part of the Spanish group Aire Networks since 2021, left the residential market and now competes for corporate and public sector accounts. ANACOM lists ONI and Ar, alongside Dialoga, BLU, Colt and Vanage, among the providers that operate exclusively in the non-residential segment, a segment that MEO, NOS and Vodafone nonetheless continue to lead.

As of Q4 2025, MEO, NOS and Vodafone together held 94.7% of active mobile lines, excluding M2M, according to ANACOM. DIGI/NOWO added another 3.3%, Lycamobile 2.0%. The three incumbents continue to control wholesale terms, though the market structure differs from the three-plus-one characterisation used in earlier periods.

2.2.2. Television and media

The Portuguese television market has three national broadcasters: public service operator RTP and two private free-to-air channels, SIC (Impresa Group) and TVI (Media Capital). Pay TV penetration is high: around 4.7 million subscribers, covering roughly 89% of households.

Ownership shifted in November 2025. MFE-MediaForEurope, the Berlusconi family group, took a 32.9% stake in Impresa, SIC’s parent company, which also owns Expresso, one of Portugal’s main newspapers. The transaction was worth approximately €17.2 million and does not give MFE control. The transaction increases links between Portuguese, Spanish and Italian media and indicates that Iberian and southern European broadcasters are seeking a stronger competitive position relative to streaming platforms.

The pressures elsewhere are uneven. Global Media Group, owner of Diário de Notícias, Jornal de Notícias and TSF, has reported recurring financial difficulties. Medialivre (Correio da Manhã, CMTV) and Media Capital (TVI, CNN Portugal) have reported positive results in recent periods. The RTP public service contract was renewed in March 2025 and runs to 2031.

The audiovisual sector is supervised by the Entidade Reguladora para a Comunicação Social ("ERC"), whose remit includes media pluralism, content classification and the protection of minors. The domestic regulatory framework for television rests on the Television and On-Demand Audiovisual Services Act (Law 27/2007 of 30 July, as amended), which transposes the Audiovisual Media Services Directive (Directive (EU) 2018/1808). It governs broadcasting licensing, advertising limits, European content quotas and the obligations of on-demand services.

Radio is regulated under Law 54/2010. Both statutes are enforced by ERC, which is also the designated national authority for the purposes of the European Media Freedom Act (Regulation (EU) 2024/1083), applicable from August 2025.

2.2.3. Data centre and cloud

The Sines hyperscale campus, operated by Start Campus, is changing the Portuguese cloud and data centre market.

SIN01, the first building of the campus, became operational in early 2025 with a capacity of 26 MW. The full campus is planned to deliver 1.2 GW of IT capacity across six buildings (SIN01 to SIN06). Each successive building can support up to 240 MW. SIN02 is expected to enter service in 2026.

PLANNED IT CAPACITY (MW)
SIN01 26 MW Operational	SIN02 240 MW Expected 2026	SIN03 – SIN06 934 MW Phases 3–6

Figure. Sines hyperscale campus, planned IT capacity by phase. Source: Start Campus.

In November 2025, Microsoft announced an investment commitment of approximately €8.6 billion (USD 10 billion) in AI-oriented data centre capacity in Sines, in partnership with Start Campus and AI infrastructure provider Nscale. The Microsoft, Nscale and Start Campus partnership is reported to deploy up to 12,600 next-generation Nvidia GB300 GPUs in Sines[5].

The announcement was among the largest single inward investments in Portuguese digital infrastructure to date and positions Sines as an alternative to the traditional FLAP-D markets (Frankfurt, London, Amsterdam, Paris and Dublin) for selected workloads.

Other operators with a footprint in Portugal include Equinix in Lisbon, AtlasEdge, Edged Energy, Altice Data Centre and NOS Data Centre. NOS reinforced its enterprise positioning in March 2025 with the acquisition of Claranet Portugal, expanding its cloud and managed services portfolio.

2.2.4. Competition and merger control

Merger control in the TMT sector is exercised by the Autoridade da Concorrência ("AdC"), which reviews concentrations under the Portuguese Competition Act (Law 19/2012 of 8 May). Any transaction meeting the applicable turnover thresholds must be notified to the AdC, which may clear, conditionally approve or oppose the concentration. ANACOM and ERC typically issue opinions but have no veto.

The DIGI–NOWO transaction illustrates this framework. The AdC blocked Vodafone Portugal’s proposed acquisition of NOWO in July 2024, finding that the removal of the fourth mobile operator would create significant barriers to competition and exert upward pressure on consumer prices. In contrast, the AdC adopted a non-opposition decision in October 2024 for DIGI’s €150 million acquisition of NOWO, on the basis that the combination would strengthen a new entrant rather than eliminate an independent competitor. ANACOM and ERC both issued favourable opinions. The deal completed in November 2024.

2.3. Investment trends in Portugal

Three trends are likely to shape capital deployment in the Portuguese TMT sector during 2026 and beyond.

First, AI-driven data centre investment. The Microsoft and Nscale commitment in Sines is one example, but other hyperscale and AI-oriented projects are moving towards the Iberian Peninsula. The attraction is specific: renewable energy at scale, direct seawater cooling at coastal sites, and landing stations for transatlantic submarine cables within reach. Several mid-sized operators have publicly indicated plans to open or expand Portuguese facilities in 2026 and 2027.

Second, submarine cable investment and the Atlantic Hub initiative. Around seventeen international cable systems already land on the Portuguese coast, across Carcavelos, Sesimbra, Seixal and Sines. That number is expected to reach twenty by end-2026, as Google’s Nuvem cable and the pan-Mediterranean Medusa cable enter service. The Atlantic Hub initiative connects this cable infrastructure to the Sines hyperscale campus, bringing together connectivity, energy and compute capacity in a combination that is rare in Europe.

Third, consolidation in adjacent industries. The MFE stake in Impresa, the NOS acquisition of Claranet Portugal and DIGI’s entry into Portuguese mobile are different transactions with different rationales. Each nonetheless reflects consolidation driven by scale. M&A teams reviewing Portuguese TMT in 2026 should expect activity on two tracks: telecoms operators acquiring managed services capabilities, and cross-border media consolidation.

3. Electronic Communications

3.1. Regulatory framework

The regulatory framework governing electronic communications networks and services in Portugal is set out in Law 16/2022 of 16 August (the Portuguese Electronic Communications Law – "ECL"). This statute transposed Directive (EU) 2018/1972, which established the European Electronic Communications Code.

The ECL sets out the rules applicable to the provision of electronic communications networks and services. It requires operators to comply with a general authorisation regime and with obligations aimed at ensuring competition, the efficient use of resources and the protection of end users.

The statute applies to any entity offering electronic communications networks or services in Portugal. This includes both providers established in Portugal and entities established abroad whenever their services extend to the Portuguese territory, whether directly or as part of a cross-border or global solution.

Under Article 3(1)(ss) of the ECL, electronic communications services are services normally provided for remuneration that consist in the conveyance of signals over electronic communications networks. The definition covers internet access services ("IAS"), interpersonal communications services and services consisting wholly or mainly in the conveyance of signals, including transmission services used for M2M communications and broadcasting. The definition therefore captures both traditional telecommunications services and certain over-the-top services.

3.1.1. Sectoral regulators and adjacent regimes

ANACOM (Autoridade Nacional de Comunicações, I.P.) is the national regulatory authority for electronic communications. ANACOM exercises licensing, supervisory and sanctioning powers under the ECL and acts as the primary point of reference for operators and providers active in the sector.

Centro Nacional de Cibersegurança, I.P. ("CNCS") is the national cybersecurity authority. CNCS exercises supervisory functions under the NIS2 transposition (Decree-Law 125/2025), addressed in Section 6 of this briefing.

Comissão Nacional de Proteção de Dados ("CNPD") supervises personal data processing in Portugal. The General Data Protection Regulation (Regulation (EU) 2016/679) is the primary data protection instrument and is enforced by CNPD in cooperation with the relevant Portuguese implementing legislation (Law 58/2019).

Several EU-level regimes apply directly and add complementary obligations. The Digital Services Act (Regulation (EU) 2022/2065) regulates intermediary services. The Digital Markets Act (Regulation (EU) 2022/1925) addresses gatekeeper platforms. The Data Act (Regulation (EU) 2023/2854) introduces a horizontal framework for data sharing, switching between data processing services and access to data generated by connected products. The AI Act (Regulation (EU) 2024/1689) is being progressively implemented, with phased application from 2025 to 2028.

3.2. Market access and general authorisation

The General Authorisation regime established in Article 16(1) of the ECL applies to all natural and legal persons offering electronic communications networks or services. This is true whether the network or service is made available to the public or provided on a self-provision basis.

Article 16(3) of the ECL sets out two exceptions:

• providers of number-independent interpersonal communications services, sometimes referred to as over-the-top ("OTT") services; and
• providers offering access to a public electronic communications network through a local radio network, where this does not form part of an economic activity or a public service dependent on signal transmission.

Under Article 17(1) of the ECL, any entity intending to offer public electronic communications networks or services in Portugal must notify ANACOM in advance. Entities whose services are not publicly accessible, or that fall within the exceptions, are exempt.

3.2.1. Content of the prior notification

The prior notification must include the following information:

• a declaration of the intention to commence activity in Portugal;
• the entity’s identification details, including, where applicable, its permanent representation in Portugal and the relevant website;
• contact details for communications and notifications, including a mandatory email address;
• the expected start date of the activity; and
• a brief description of the network or service to be offered in Portugal.

Where the offer concerns a service, the description must specify the type of service, the relevant market segment, the supporting network and any use of spectrum or numbering resources, with identification of the specific resources where applicable. Where the offer concerns a network, the description must address the network type and purpose, its ownership structure and any use of spectrum or numbering resources.

3.2.2. Registration and confirmation

Under Article 19(2) of the ECL, ANACOM must register the entity within five working days and issue a confirmation of registration. The confirmation includes information on rights of access, interconnection and installation of facilities.

Registration is free of charge. Entities operating under the General Authorisation regime are, however, covered by an annual fee, calculated on the basis of relevant income reported for the previous financial year. The fee is paid to ANACOM and is independent from any spectrum- or numbering-related charges.

3.3. ANACOM and sector supervision

ANACOM exercises supervisory powers including inspections, requests for information and the imposition of remedial measures. Sanctioning powers include administrative fines, with the maximum amounts set by the ECL and adjusted as a function of the seriousness of the breach and the size of the operator.

Operators and service providers are covered by a set of recurring reporting obligations. The main obligations are summarised below. The exact perimeter and frequency depend on the type of activity, the size of the operator and any specific obligations imposed by ANACOM as a result of market analysis or sectoral inquiries.

3.3.1. Annual identification and activity questionnaire

ANACOM requires operators to complete an annual identification and activity questionnaire. The form is divided into Part I, which covers identification details and a description of the operator’s activities, and Part II, which covers investments, accesses and services provided. The Part II indicators feed into ANACOM’s public statistical reports and inform the regulator’s view of market structure and competition.

3.3.2. Annual financial questionnaire

Operators must provide audited financial information relating to the previous financial year. ANACOM circulates a questionnaire that captures several financial indicators, including annual accounts and the management report for the relevant year. Where the operator is part of a wider group, the relevant figures relate to the Portuguese activity rather than the consolidated group.

3.3.3. Annual fee declaration

The annual fee payable by electronic communications networks and services providers is calculated on the basis of the relevant income reported for the previous financial year. Providers therefore declare the income that determines the fee through a dedicated form. The relevant income concept follows the regulatory definition and is not always identical to the accounting concept of revenue.

3.3.4. Other reporting obligations

In addition, operators face a range of ad hoc and periodic reporting duties. ANACOM requires network operators to submit data on geographic coverage, spectrum utilisation and base-station deployment on a quarterly, semi-annual or annual basis.

Operators designated with significant market power ("SMP") are subject to additional obligations, including cost-accounting, accounting separation and the submission of regulated wholesale pricing data. Consumer-facing providers must also report complaint volumes, resolution rates and switching statistics.

3.4. Roaming, universal service and other sector obligations

Roaming. Portuguese operators must comply with the EU Roam-Like-At-Home regime under Regulation (EU) 2022/612, which prohibits surcharges on voice, SMS and data used by subscribers travelling within the EEA. The regulation, extended to June 2032, sets declining wholesale caps (€1.30 per GB in 2025, falling to €1.00 in 2027) and requires operators to offer RLAH by default. Operators may apply a fair-use policy and must report roaming traffic data to ANACOM, which in turn feeds BEREC’s pan-European monitoring.

Universal service and adequate broadband. The ECL defines universal service as including adequate broadband internet access and voice communications at a fixed location, together with specific measures for end-users with disabilities. The Government determines the minimum bandwidth for universal service purposes, taking into account BEREC’s best-practice reports and actual usage patterns. In parallel, the social tariff for broadband access, introduced by Decree-Law 66/2021, ensures that lower-income households can access fixed or mobile broadband at reduced cost.

High-speed coverage and the Gigabit Strategy. Portugal’s National Strategy for Connectivity in Very High Capacity Networks (2023–2030) targets full household coverage by Gigabit-capable networks by 2030, backed by approximately €345 million in combined public and private funding. Operators holding 5G spectrum licences are subject to specific coverage obligations, for example, extending 5G to low-density parishes within defined deadlines. By end-2025, ANACOM reported 15,495 5G base stations deployed across all 308 Portuguese municipalities.

Quality of service and net neutrality. ANACOM monitors latency, packet loss and actual download and upload speeds and publishes comparative reports. Operators must comply with the EU open-internet rules under Regulation (EU) 2015/2120, which prohibit blocking, throttling or discriminatory treatment of traffic, subject to the limited exceptions. ANACOM may issue sanctions where an operator’s traffic management practices are found to breach these obligations.

Incident reporting obligations under the cybersecurity regime are addressed in Section 6 of this briefing.

3.5. The DNA proposal

In January 2026, the European Commission published a proposal for a Digital Networks Act, aimed at simplifying and updating the EU framework for electronic communications.

The proposal builds on the European Electronic Communications Code and introduces a stronger emphasis on cross-border consistency, on the deployment of advanced networks and on the adaptation of the regulatory regime to convergence with cloud and edge computing. The legislative process is ongoing and adoption is not expected before 2027.

The principal changes proposed by the DNA can be grouped under the following headings.

Single Passport authorisation. The DNA introduces a pan-EU general authorisation regime under which a provider may notify in a single Member State and operate networks or services throughout the Union without additional national notifications. Member States would not be permitted to impose requirements beyond the harmonised list of conditions. This represents a significant departure from the current regime, under which each country administers its own general authorisation.

Spectrum reform. Radio spectrum rights of use would, as a general rule, be granted for an unlimited duration, subject to periodic review by the national regulatory authority and a minimum term of forty years where a time limit is justified. The DNA also introduces a "use it or share it" principle, requiring holders to take steps to share rights of use where technically feasible, and establishes an EU-level authorisation regime for satellite systems.

Copper switch-off and fibre transition. The proposal mandates a structured transition from copper to fibre networks, with a final copper switch-off deadline of 31 December 2035. In areas meeting two cumulative criteria (at least 95% fibre coverage of premises and availability of affordable retail connectivity), earlier switch-off may be required. Member States must present national transition-to-fibre plans to the Commission by 31 October 2029.

SMP regime and access regulation. The significant market power framework is retained but simplified. Unused mechanisms such as co-investment-related deregulation and functional separation are removed. A new EU-level harmonised access product is introduced, which national regulatory authorities must consider before imposing specific national remedies. The Commission would gain veto power over remedies imposed by national regulatory authorities, extending its current powers beyond market definition and SMP designation.

Net neutrality and digital ecosystem cooperation. The existing open-internet framework is largely preserved. The DNA introduces mandatory biennial reporting by internet access service providers on net neutrality safeguards. It also establishes a voluntary conciliation procedure, mediated by national regulatory authorities with a BEREC opinion, for disputes between electronic communications providers and undertakings in adjacent sectors such as cloud and content.

Resilience and security. The DNA designates electronic communications networks as essential infrastructure and requires BEREC to adopt a Union Preparedness Plan for Digital Infrastructures. Supply-chain security requirements are integrated into the general authorisation regime, aligning with NIS2 and the revised Cybersecurity Act.

Governance. EU-level governance is restructured through the establishment of the Office for Digital Networks, which replaces the BEREC Office, and the creation of the Radio Spectrum Policy Body with an expanded strategic mandate for cross-border coordination.

For operators and corporate users active in Portugal, the DNA signals material regulatory change over the medium term. Areas of particular relevance include the replacement of ANACOM’s national authorisation procedures with the Single Passport, the impact of the copper switch-off timetable on wholesale access arrangements, the potential reduction of national-level reporting obligations through EU harmonisation, and the framework for backbone investment in cross-border infrastructure.

4. Network Infrastructure

4.1. Network licensing and spectrum allocation

The use of radio spectrum requires a specific right of use, granted by ANACOM under the ECL and complemented by the National Frequency Allocation Plan. Spectrum rights can be allocated through procedures that take the form of an auction, a beauty contest or a direct grant, depending on the band and the level of demand for it.

The 5G spectrum allocation completed in 2021 covered the 700 MHz, 900 MHz, 1800 MHz, 2.1 GHz, 2.6 GHz and 3.6 GHz bands. The auction was among the most contested in Portuguese telecommunications history and resulted in a footprint of frequencies broadly distributed between MEO, NOS and Vodafone, with NOWO obtaining a slot in the 3.6 GHz band. Subsequent secondary market transactions have refined the resulting holdings, including the transfer of NOWO’s rights in the 3.6 GHz band to DIGI in early 2025.

The terms of spectrum rights of use include conditions on coverage, on the deployment timeline and, where applicable, on the offer of national roaming. The breach of these conditions may give rise to administrative measures and, in extreme cases, to the revocation of the right of use.

Numbering resources are managed under the National Numbering Plan. They are allocated by ANACOM at the request of authorised providers and are covered by efficient use obligations and by fees that depend on the type and volume of resources granted. Number portability between operators is ensured under the relevant ANACOM regulation.

4.1.1. Numbering resources and sub-allocation

ANACOM manages the National Numbering Plan (Plano Nacional de Numeração, "PNN"), which is structured in accordance with ITU-T Recommendation E.164 and organises all telephone numbers into nine-digit ranges.

Rights of use of numbering resources are allocated by ANACOM upon request from authorised providers, following open, objective, transparent and non-discriminatory procedures; for ranges of exceptional economic value – such as 800 (freephone), 808 (shared-cost) and 707 (universal access) – allocation is preceded by a public consultation.

Until the end of 2021, numbering resources could only be obtained through primary allocation directly from ANACOM. The sub-allocation of numbers (i.e. the transfer of numbers by a rights holder to a third-party company) was not permitted. This meant that any company wishing to offer electronic communications services had to obtain numbers directly from ANACOM and comply with the full set of conditions applicable to primary rights holders, which could represent a disproportionate burden for smaller operators, MVNOs or niche-market entrants.

This changed with ANACOM Regulation 1028/2021, published on 29 December 2021, which for the first time introduced a sub-allocation regime into Portuguese law. Under this regime, a company holding rights of use of numbering resources ("rights holder") may sub-allocate numbers from eligible ranges to a third-party company ("beneficiary"), which may then use those numbers in its own retail electronic communications offers and assign them to end users.

The eligible ranges cover:

• fixed telephone service (2);
• mobile telephone service (91, 92, 93, 96);
• nomadic VoIP (30);
• universal access (707, 708);
• single-rate (760, 761, 762);
• freephone (800); and
• shared-cost services (808, 809).

The sub-allocation is subject to the following conditions: (i) only numbers from the listed ranges may be sub-allocated; (ii) the rights holder must notify ANACOM before launching the wholesale sub-allocation offer; (iii) the beneficiary must communicate to ANACOM the start of its retail electronic communications service; (iv) the rights holder retains ownership of the numbering rights and remains liable for the applicable fees; and (v) number portability rules apply in full, ensuring that end users of sub-allocated numbers enjoy the same switching rights as users of numbers obtained through primary allocation.

This change has materially lowered entry costs and administrative complexity, enabling new players, including MVNOs, secondary service providers and IoT platforms, to reach the market more quickly.

4.2. The communications infrastructure law

Facilities that provide network infrastructure supporting electronic communications services fall within the scope of Decree-Law 123/2009 of 21 May ("Communications Infrastructure Law"). This statute regulates the construction, access and installation of electronic communications infrastructures, including ducts, poles and other associated elements.

The Communications Infrastructure Law focuses on the physical layer of telecommunications infrastructure. Its application depends on the involvement of electronic communications operators in the use of such infrastructure. Operators deploying their own networks to interconnect with electronic communications services may benefit from specific rights. These include rights of way over public domain and, where strictly necessary, the possibility of expropriation for the installation of network infrastructure.

Operators are also covered by obligations, notably the duty to grant access to their infrastructure, such as ducts and related facilities, to other electronic communications operators. This access obligation is a central element of the regulatory framework: it allows competing operators to deploy fibre without duplicating civil works and is one of the reasons Portuguese fibre coverage extended quickly across the country.

Regarding municipal fees, the use of public and private municipal domain for the installation of electronic communications infrastructure gives rise to the Taxa Municipal de Direitos de Passagem ("TMDP"). The TMDP is calculated as a percentage, capped at 0.25%, of the total monthly billing issued by operators to end-customers in each municipality. Municipalities may opt not to levy the TMDP in order to promote network development, but where they do so they may not charge any other taxes, levies or fees for the same use of municipal domain. The State and the Autonomous Regions do not charge operators for the use of their respective public and private domains. Since the 2021 State Budget Law, operators are prohibited from passing the TMDP on to consumers.

At EU level, the Gigabit Infrastructure Act (Regulation (EU) 2024/1309 of 29 April 2024 – "GIA") replaced the Broadband Cost Reduction Directive (Directive 2014/61/EU) and became fully applicable on 12 November 2025. As a regulation, it applies directly without national transposition. The GIA strengthens infrastructure sharing obligations, extends access requirements to physical infrastructure owned or controlled by public sector bodies, introduces a four-month permit-granting deadline for very high-capacity network deployment and requires Member States to establish single information points for infrastructure transparency and permit applications. These provisions complement the domestic access regime under Decree-Law 123/2009 and are expected to accelerate fibre and 5G rollout, particularly in rural and underserved areas.

4.3. Fixed and mobile networks

The fixed network in Portugal is predominantly fibre-based. As shown in Section 2, FTTH accounted for 71.4% of fixed accesses by the end of the third quarter of 2025, with the remaining accesses split between cable, xDSL and a residual share of fixed wireless and satellite connections.

On mobile networks, the four operators have national 5G coverage, with the deployment patterns described in Section 2. Indoor coverage in dense urban areas continues to be a focus of investment. The Multi-Operator Radio Access Network ("MORAN") arrangement between NOS and Vodafone, which involves the sharing of radio access network infrastructure in defined areas, affects both coverage planning and competitive analysis.

Network sharing arrangements raise specific regulatory considerations. The MORAN arrangement has been in operation for several years and offers a useful precedent for any future sharing initiatives.

4.4. Submarine cables

4.4.1. Landing stations and the Portuguese position in the Atlantic

Submarine cables carry approximately 99% of the world’s international data traffic. Demand for new systems is no longer driven primarily by telecommunications carriers; it comes from the investment programmes of hyperscale cloud and AI operators, for whom cable capacity is a limiting factor.

Portugal has held a position in global communications infrastructure for an extended period. In the fifteenth century, Portuguese ships established maritime routes connecting Europe to other continents. In the nineteenth century, all district capitals were connected by telegraph through more than 1,600 km of lines, and Portugal joined the first global submarine cable network fifteen days after its initial launch. The country’s position at the western edge of the European mainland, its renewable energy base, and its historical connections to Latin America and Africa have made it one of the busiest submarine cable hubs in the Atlantic.

There are presently around twenty submarine cable systems landing on the Portuguese coast, distributed across four main landing zones: Carcavelos, Sesimbra, Seixal and Sines[6].

Among the systems that came on stream in the last few years, EllaLink, in service since 2021, was the first high-capacity direct fibre optic route between Europe and South America, linking Sines to Fortaleza in Brazil. Equiano, deployed by Google, became operational in 2022. The 2Africa cable, sponsored by a consortium that includes Vodafone and Meta and reportedly the largest subsea cable system in the world, landed in Carcavelos in March 2024.

The pan-Mediterranean Medusa cable, which will link Sines and Carcavelos to several North African and Southern European countries, is being deployed throughout 2026, having first landed in Marseille in October 2025. Google’s Nuvem cable, which will provide a new direct transatlantic route between Portugal and the United States, is expected to be ready for service in the second half of 2026.

Sines is developing rapidly as a landing site for transatlantic and regional submarine cable systems. The initiative known as the "Atlantic Hub", a partnership between aicep Global Parques, EllaLink and Start Campus and supported by the Portuguese Government, aims to establish the Sines Tech area as a resilient and accessible landing site for new transcontinental systems, in coordination with the local hyperscale data centre campus.

The geographical position of Portugal, south of the traditional FLAP-D markets (Frankfurt, London, Amsterdam, Paris and Dublin), and the increasing capacity constraints faced by those hubs, combined with the availability of renewable energy and direct seawater cooling, have positioned Sines as a significant site within the Iberian connectivity market.

Along with overseas cables, Portugal is replacing its domestic long-range subsea cables through a new ring (the Continente-Açores-Madeira, or CAM ring), to provide services between mainland Portugal and the Madeira and Azores autonomous regions.

The original ring, in operation since 1999, having reached the end of its design life, is being replaced by a 3,812 km submarine cable with an estimated capacity of at least 150 Tbps, scheduled for completion by the end of 2026, to be operated by IP Telecom, S.A., the telecom arm of the railway network concessionaire.

Along with capacity, the system will integrate a SMART module (Science Monitoring And Reliable Telecommunications) for seismic detection, climate and environmental monitoring.

An additional Interisland Ring Azores (Anel intra-ilhas Açores)[7] is under study to replace the inter-island system serving the nine Azorean islands; once deployed, it is expected to operate jointly with the CAM system as part of a broader Atlantic platform aligned with the EU Atlantic Gateway concept.

4.4.2. Licensing

Deploying a submarine cable system through the national maritime space requires a private use title (Título de Utilização Privativa do Espaço Marítimo, "TUPEM") under a framework set by Law 17/2014 of 10 April and developed by Decree-Law 38/2015 of 12 March, which governs the application procedure and the conditions of attribution.

The competent authority for the maritime space adjacent to the mainland, including the extended continental shelf, is the Direção-Geral de Recursos Naturais, Segurança e Serviços Marítimos ("DGRM"). In the maritime zones adjacent to the Azores and Madeira, between the baselines and the outer limit of the territorial sea, the relevant regional services issue the title.

Before filing, the proposed cable route must be checked against the Plano de Situação do Ordenamento do Espaço Marítimo Nacional ("PSOEM"), the maritime spatial planning instrument that allocates uses across the national maritime space.

For submarine cables, the TUPEM is normally granted under the concession regime, for a maximum of 50 years. Applications are filed electronically and follow a structured procedure:

• preliminary review by DGRM;
• consultation of other competent authorities;
• public consultation for at least 15 days, during which third parties may file competing applications or objections; and
• final decision by DGRM.

Award of the title generally requires a prior security deposit, calculated as the investment value multiplied by the applicable risk coefficient. The holder must also carry mandatory civil liability insurance for damage caused to third parties.

Where a submarine cable lands on Portuguese territory and is used to provide electronic communications services, additional obligations arise as operating the cable for electronic communications purposes requires registration with ANACOM.

Environmental impact assessment is not automatically required for submarine cables. In practice, applicants are frequently asked to seek a prior opinion from Agência Portuguesa do Ambiente ("APA") on whether the project requires said assessment.

Security review of new cable landings has increased. Designation of certain systems as strategic digital infrastructure triggers additional scrutiny of ownership structure, operational continuity and supply chain security. The national supervisory authority is the Centro Nacional de Cibersegurança.

Route confidentiality is a further consideration. Precise routing data for submarine cables is publicly accessible in some contexts, and this is treated as a security risk. Both national authorities and EU institutions are moving toward restricting access to that information.

4.5. Data centres and data storage

Portugal does not currently have a dedicated data centre licensing regime. The construction and operation of data centres remain subject to the general framework applicable to urban planning, construction, environmental licensing, infrastructure and industrial activity. Depending on the services provided, additional sector-specific regimes may apply.

Decree-Law 84/2024 establishes a specific legal framework governing the energy performance of data centres, partially transposing Directive (EU) 2023/1791 on energy efficiency and implementing Delegated Regulation (EU) 2024/1364. The regime applies to data centres with an installed IT power demand of at least 500 kW and imposes detailed reporting and transparency obligations concerning energy consumption, renewable energy usage, water consumption, waste heat reuse and operational efficiency metrics.

In March 2026, the Government approved the National Data Centre Plan (Plano Nacional de Centros de Dados, "PNCD"), together with a 2026–2027 Action Plan. The PNCD is structured around four pillars: regulation and governance, energy and infrastructure, demand and market, and territory and ecosystem. The plan aims to streamline permitting procedures, identify pre-approved development areas and centralise investor support through AICEP acting as a single point of contact. It also envisages maximum administrative decision periods and aligns with the National Digital Strategy, sovereign cloud objectives and the National Artificial Intelligence Agenda.

Energy availability and grid access are the principal constraints on new hyperscale capacity. The Sines campus benefits from a high voltage connection point, proximity to the cluster of submarine cable landings and direct seawater cooling. These are structural advantages that other sites in Portugal do not offer at the same scale.

Data centre operators that handle personal data, even on a purely infrastructural basis, are covered by the data protection regime. They may also fall within the cybersecurity perimeter introduced by the NIS2 transposition, where they qualify as essential or important entities under Decree-Law 125/2025. Data centre service providers and cloud computing service providers are listed as essential or important entities, depending on size, under the new framework.

Investment in data centres and other strategic TMT infrastructure may also engage the Portuguese foreign direct investment ("FDI") screening regime. Under Decree-Law 138/2014 of 15 September, the Council of Ministers may oppose acquisitions by non-EU or non-EEA investors that result in direct or indirect control over strategic assets in the energy, transport or communications sectors, where such transactions pose a real and sufficiently serious threat to defence, national security or the security of supply of essential services. To date, no transaction has been formally blocked under this regime.

5. Digital Services and Emerging Technologies

5.1. Cloud and data services

Cloud services are provided in Portugal both by the global hyperscalers and by domestic operators that have built or acquired cloud and managed services capabilities. The acquisition of Claranet Portugal by NOS in March 2025 illustrates the continued effort by domestic operators to move up the value chain into managed services and cloud.

From a regulatory perspective, cloud providers are not, as such, covered by the general authorisation regime under the ECL, unless their offer also includes the conveyance of signals through electronic communications networks. They are, however, often qualified as digital infrastructure providers for the purposes of NIS2, as data centre service providers, cloud computing service providers, content delivery network providers or managed service providers. The qualification as essential or important entity follows from the size and the activity of the relevant entity.

5.1.1. The Data Act and switching

The Data Act (Regulation (EU) 2023/2854) introduced a horizontal framework for data sharing, with mandatory access rights for users of connected products and obligations on data holders to enable switching between data processing services. Cloud providers active in the Portuguese market need to align their contractual frameworks with these requirements, in particular as regards switching, interoperability and unfair contractual terms.

The switching obligations are significant. Cloud providers are required to remove commercial, technical, contractual and organisational obstacles that prevent customers from switching to another provider or to an in-house solution. Specific timelines apply for the completion of switching processes, and the rules on egress fees become more restrictive over time. The full set of obligations applies from January 2027.

5.1.2. Data Governance and the European Data Strategy

Regulation (EU) 2022/868 ("Data Governance Act") has been applicable since September 2023 and establishes a framework for data intermediation services, data altruism and the re-use of protected public sector data.

In Portugal, the Conselho Nacional de Estatística supports national coordination, and CNPD retains its supervisory role where personal data is involved. Entities offering data intermediation services are subject to a notification regime and to obligations on neutrality, organisational separation and transparency.

Portugal was among 18 Member States subject to infringement proceedings opened by the European Commission in May 2024 for failing to designate the competent authorities required under the Data Governance Act or to demonstrate that those authorities were empowered to carry out the tasks required by the regulation. The Commission escalated the proceedings by issuing a reasoned opinion to Portugal in December 2024.

5.2. Artificial intelligence

Regulation (EU) 2024/1689 ("AI Act") establishes a horizontal regime applicable to providers, deployers, importers and distributors of artificial intelligence systems. The AI Act follows a risk-based approach. Prohibited practices have applied since February 2025. Obligations on general-purpose AI models entered into force in August 2025. The remaining substantive obligations on high-risk systems apply from 2 December 2027 for stand-alone systems and from 2 August 2028 for systems embedded in regulated products, following the Digital Omnibus on AI (Regulation (EU) 2026/1744).

5.2.1. National implementation

In Portugal, the designation of national competent authorities for AI Act enforcement is being completed during 2026. ANACOM, CNPD and sectoral regulators are expected to play complementary roles, depending on the area of deployment.

A market surveillance authority will be designated to oversee compliance with the requirements applicable to high-risk AI systems placed on the Portuguese market. The single point of contact and the notifying authority for conformity assessment bodies are also in the process of being designated.

Portugal participates in the European AI Office, which provides governance support at EU level for the implementation of obligations on general-purpose AI models. The AI Office’s work, including its codes of practice and guidelines, will be relevant for entities active in the Portuguese market.

5.2.2. Indirect impact on infrastructure providers

Even where infrastructure operators are not directly regulated as AI system providers or deployers, the AI Act has indirect effects. Cloud and data centre operators that host high-risk AI systems may face heightened contractual demands relating to availability, auditability, traceability and security. The interaction between AI compliance, cybersecurity governance and data protection requirements is likely to influence contractual structures and operational standards across the sector.

Boards of infrastructure entities should review their standard contractual templates with the AI Act in mind. Specific items to consider include: the allocation of responsibility for compliance with high-risk system obligations, the treatment of incidents potentially affecting AI system integrity, the handling of audit rights and the contractual support for traceability and explainability obligations.

5.3. Cryptocurrencies, blockchain and tokenisation

The market for crypto-assets in Portugal has undergone significant regulatory change since the EU adopted a comprehensive framework for digital assets. The pre-existing regulatory baseline centred on anti-money laundering obligations applicable to virtual asset service providers, introduced by Law 58/2020 of 31 August, which transposed the Fifth Anti-Money Laundering Directive. Banco de Portugal has supervised registered VASPs for AML/CFT purposes under Notice 3/2021, and this registration framework served as the baseline for entities operating in the Portuguese market prior to the application of the MiCA Regulation.

Regulation (EU) 2023/1114 ("MiCA") is the primary EU-wide framework for crypto-assets, with stablecoin provisions (covering asset-referenced tokens and e-money tokens) applicable since June 2024 and the full crypto-asset service provider licensing regime applicable since December 2024.

The Portuguese implementing legislation is Law 69/2025 of 22 December 2025. It establishes a dual-supervisory model: Banco de Portugal acts as the prudential supervisor (including oversight of stablecoin issuers), while CMVM supervises market conduct, the issuance of crypto-assets other than stablecoins, and market abuse. This "twin peaks" approach represents a departure from Portugal’s traditional sectoral model of financial supervision. VASPs that were registered with Banco de Portugal and actively operating before 30 December 2024 may continue to provide services under a transitional regime until 1 July 2026 or until they obtain or are refused MiCA authorisation, whichever occurs first.

Tokenisation and distributed ledger technology are addressed separately under the DLT Pilot Regime (Regulation (EU) 2022/858), which allows market infrastructure operators to admit DLT-based financial instruments to trading under a controlled framework. MiCA, the Digital Operational Resilience Act ("DORA") and the broader European data and AI regulatory framework together create multiple, overlapping compliance obligations for fintech operators, trading platforms and infrastructure providers in the Portuguese market.

6. Cybersecurity and Critical Infrastructure

6.1. The NIS2 and Decree-Law 125/2025

Directive (EU) 2022/2555 ("NIS2") was transposed into Portuguese law by Decree-Law 125/2025 of 4 December. The new regime replaces the prior framework and significantly expands the population of entities covered by cybersecurity obligations. The CNCS is the national competent authority and the single point of contact for the purposes of the regime.

The regime applies to public and private entities that meet the criteria of essential or important entities. The criteria combine sector membership and size. The sector list covers, among others, energy, transport, banking, financial market infrastructures, healthcare, drinking water, wastewater, digital infrastructure, ICT service management, public administration and space.

6.2. Essential and important entities

Essential entities are typically large entities active in highly critical sectors. Important entities are medium-sized entities in critical sectors and large entities in other sectors covered by the regime.

Both categories are covered by the same set of substantive obligations. The supervisory regime is, however, more intrusive for essential entities, with proactive supervision, including planned audits, available to the competent authority.

6.2.1. Size-based qualification

The size criteria draw on the EU recommendation on small and medium-sized enterprises. An entity is treated as a large entity if it employs more than 250 persons or has annual turnover exceeding €50 million and an annual balance sheet total exceeding €43 million. Medium-sized entities employ between 50 and 250 persons or meet the analogous turnover and balance sheet thresholds at the medium tier.

Where an entity is part of a group, the size assessment must take into account the group structure, in particular the relationship between the relevant entity and other group entities under the partner and linked enterprises concepts. This assessment can be more involved than it first appears, especially for groups with complex shareholding structures or with cross-border footprints.

6.2.2. Sectors regardless of size

The regime also captures certain entities regardless of size. These include providers of public electronic communications networks and services, qualified trust service providers, top level domain name registries, domain name system service providers, and certain providers of services that are critical to public security or public order.

The regime also addresses the position of small operators where their disruption would have a significant impact on a Member State.

6.3. Risk management measures

Essential and important entities must adopt appropriate technical, operational and organisational measures to manage the risks posed to the security of their network and information systems. The measures must be proportionate to the risk. NIS2 sets out a non-exhaustive list of areas that the measures must cover.

The areas of risk management include the following:

• policies on risk analysis and information system security;
• incident handling procedures;
• business continuity planning, including backup management and disaster recovery, and crisis management;
• supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;
• security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure;
• policies and procedures to assess the effectiveness of cybersecurity risk management measures;
• basic cyber hygiene practices and cybersecurity training;
• policies and procedures regarding the use of cryptography and, where appropriate, encryption;
• human resources security, access control policies and asset management; and
• the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.

Boards of essential and important entities are required to approve and oversee the implementation of cybersecurity risk management measures. Members of the management body must follow training and ensure that staff receive appropriate training. The regime imposes personal accountability on board members.

6.4. Incident reporting and supervision

The regime imposes a layered incident reporting duty for significant incidents. Essential and important entities owe a series of notifications to CNCS:

• an early warning is due within 24 hours of the entity becoming aware of a significant incident, indicating in particular whether the incident is suspected to be caused by unlawful or malicious acts and whether it could have a cross-border impact;
• an incident notification with a more detailed assessment is due within 72 hours, including, where applicable, an updated assessment of the early warning and an indication of the type of threat or root cause that has likely triggered the incident;
• an intermediate report on relevant status updates is due upon request of the competent authority; and
• a final report is due within one month of the incident notification, providing a detailed description of the incident, its severity and impact, the type of threat or root cause likely to have triggered the incident, the applied and ongoing mitigation measures, and the cross-border impact, where applicable.

Where the incident is ongoing at the point at which the final report is due, a progress report is filed instead and a final report follows the resolution of the incident. The framework is intentionally tight, especially the 24-hour early warning, and entities should have an established internal escalation path that can deliver compliance with the timeline under operational pressure.

6.4.1. Sanctions

CNCS may carry out audits, request information and issue binding instructions. The regime also empowers the supervisory authority to apply administrative sanctions for non-compliance, with maximum fines that depend on the entity’s status as essential or important and on the seriousness of the breach.

For essential entities, the maximum fines reach the higher of €10 million or 2% of total worldwide annual turnover. For important entities, the maximum fines reach the higher of €7 million or 1.4% of total worldwide annual turnover. Beyond fines, the supervisory authority has at its disposal a range of corrective measures, including the suspension of certifications or authorisations and, in extreme cases, restrictions on the exercise of management functions for breach of obligations specific to the management body.

7. User Protection

7.1. Personal data protection and privacy

Personal data processing in Portugal is governed by the General Data Protection Regulation (Regulation (EU) 2016/679 – "GDPR"). The Portuguese implementing law is Law 58/2019 of 8 August. CNPD is the supervisory authority for personal data processing.

CNPD’s enforcement priorities have shifted in recent years to take in cookies, lawful basis for marketing communications, the handling of access and deletion requests, and the use of personal data in artificial intelligence training. CNPD has a track record of close engagement with both private and public sector entities and routinely issues guidelines that operators in the sector treat as effectively binding.

7.1.1. e-Privacy and electronic communications

In the electronic communications sector, the protection of personal data is complemented by Law 41/2004 of 18 August ("Portuguese e-Privacy Law"). The Portuguese e-Privacy Law establishes specific rules for traffic data, location data, unsolicited communications and the use of cookies and similar technologies. The European Commission withdrew the proposed e-Privacy Regulation in 2025, with the withdrawal published in the Official Journal on 6 October 2025. Directive 2002/58/EC and the Portuguese framework transposing it therefore remain in force.

Operators of electronic communications services are covered by specific obligations in case of personal data breaches affecting subscribers, including a notification duty to the supervisory authority and, where applicable, to the affected subscribers. These obligations apply in addition to the general personal data breach notification regime under the GDPR.

7.1.2. Practical compliance points

For operators active in the Portuguese market, several recurring practical themes have emerged from CNPD enforcement decisions. Cookie banners must offer an equally prominent reject option alongside the accept option. Lawful basis for marketing communications must be selected with care, with consent the default for direct marketing to non-customers and the soft opt-in available for own customers within tightly drawn limits. Data subject rights handling timelines should map cleanly onto the GDPR deadlines, with internal escalation paths to support atypical cases.

7.2. Consumer protection in electronic communications

The ECL devotes a specific chapter to end-user rights. The chapter introduces or reinforces rules on contractual transparency, contract duration and termination, the right to switch operator and number portability, and the supply of universal service.

7.2.1. Contract terms and switching

Maximum contract duration for consumer electronic communications services is set by law. Subscribers benefit from a clear right to terminate at the end of the loyalty period, with regulated information requirements that mean operators must alert customers before the loyalty period ends and inform them of the alternative offers available. Switching procedures, including number portability, follow harmonised timelines designed to minimise inconvenience for the customer.

ANACOM is the competent authority for the supervision and enforcement of these rules in the electronic communications sector. Direção-Geral do Consumidor, Autoridade de Segurança Alimentar e Económica ("ASAE") and consumer protection associations also have a role in consumer protection matters. Decisions of these authorities, particularly ANACOM, are relevant to contract drafting.

7.2.2. Recent enforcement priorities

Recent enforcement priorities have focused on contractual loyalty periods, automatic price adjustments, the clarity of switching procedures and the transparency of bundle offers.

ANACOM has been particularly active on automatic price adjustments. The regulator’s position is that price increases linked to inflation indices must be announced clearly in advance and that customers must have an effective right to terminate the contract without penalty if they disagree with the price change.

Operators serving consumers in Portugal should keep contractual templates under regular review and align them with the latest ANACOM guidance and decisions. Customer journey design also matters. Several recent enforcement decisions have focused not on the underlying contract clauses but on whether the customer experience was sufficiently clear and balanced, particularly at the end of the loyalty period.

8. Key takeaways

Networks. Fibre reaches more than 90% of Portuguese households and 5G traffic has overtaken the legacy mobile generations still in use.

Market structure. MEO, NOS and Vodafone remain the three largest operators, but DIGI’s entry and cross-border media consolidation are changing competition and deal activity.

Data centres. Sines is set to host a hyperscale campus among the largest in Southern Europe. The PNCD, approved in March 2026, and Decree-Law 84/2024 on energy performance define the planning and compliance environment for new projects.

Cybersecurity. Decree-Law 125/2025 transposes NIS2 and is in force. Essential and important entities face their first supervisory cycle in 2026, including the 24-hour incident early warning.

Artificial intelligence and data. The AI Act’s remaining high-risk obligations apply from August 2026 and already drive contractual demands on data-centre and cloud providers. The Data Act governs cloud switching and MiCA governs crypto-asset services.

Privacy. The Commission withdrew the e-Privacy Regulation in 2025; Law 41/2004 and the GDPR remain the framework. CNPD priorities include cookies, marketing consent and the use of personal data in AI training.

What comes next. The DNA proposal of January 2026 would recast authorisation, spectrum, copper switch-off and sector governance. Consumer enforcement concentrates on loyalty periods and automatic price adjustments.

Appendix A: Regulatory map

The table lists the authorities referred to in this briefing and the matters each of them supervises.

Authority	Remit	Section
ANACOM Autoridade Nacional de Comunicações	National regulatory authority for electronic communications. Grants spectrum and numbering rights, registers providers under the general authorisation regime, supervises the end-user rules of the sector and enforces the ECL. Expected to share AI Act competences with CNPD and sectoral regulators.	3.1.1, 4.1, 7.2
CNCS Centro Nacional de Cibersegurança	National cybersecurity authority and single point of contact under Decree-Law 125/2025 (NIS2). Supervises the security of strategic digital infrastructure, including submarine cable landings.	4.4.2, 6
CNPD Comissão Nacional de Proteção de Dados	Supervises personal data processing under the GDPR and Law 58/2019. Keeps its supervisory role for personal data under the Data Governance Act. Expected to share AI Act competences.	5.1.2, 5.2.1, 7.1
AdC Autoridade da Concorrência	Reviews concentrations under the Competition Act (Law 19/2012). ANACOM and ERC issue opinions without a veto.	2.2.4
ERC Entidade Reguladora para a Comunicação Social	Supervises television, on-demand audiovisual services and radio, including media pluralism, content classification and the protection of minors. National authority for the European Media Freedom Act.	2.2.2
DGRM Direção-Geral de Recursos Naturais, Segurança e Serviços Marítimos	Grants the private use title (TUPEM) for submarine cables in the maritime space adjacent to the mainland. Regional services act for the Azores and Madeira.	4.4.2
APA Agência Portuguesa do Ambiente	Gives a prior opinion on whether a submarine cable project requires an environmental impact assessment.	4.4.2
Council of Ministers	May oppose acquisitions by non-EU or non-EEA investors that give control over strategic assets, under the foreign direct investment screening regime (Decree-Law 138/2014).	4.5
Banco de Portugal and CMVM Comissão do Mercado de Valores Mobiliários	Supervise crypto-asset service providers under MiCA and Law 69/2025. Banco de Portugal acts as prudential supervisor. CMVM supervises market conduct, the issuance of crypto-assets other than stablecoins and market abuse.	5.3
Direção-Geral do Consumidor and ASAE Autoridade de Segurança Alimentar e Económica	Consumer protection authorities that act alongside ANACOM in the electronic communications sector.	7.2.1
Conselho Nacional de Estatística	Supports national coordination under the Data Governance Act.	5.1.2

Appendix B: Key dates

The table lists the dates referred to in this briefing in chronological order. Dates marked as proposed depend on adoption of the DNA proposal.

Date	Development	Section
12 November 2025	The Gigabit Infrastructure Act becomes fully applicable.	4.2
4 December 2025	Decree-Law 125/2025 transposes the NIS2 Directive into Portuguese law.	6.1
22 December 2025	Law 69/2025 implements MiCA and sets the supervisory roles of Banco de Portugal and CMVM.	5.3
January 2026	The European Commission publishes the DNA proposal.	3.5
March 2026	The Government approves the National Data Centre Plan and its 2026–2027 Action Plan.	4.5
1 July 2026	The MiCA transitional regime ends for crypto-asset service providers registered with Banco de Portugal before 30 December 2024, unless authorisation was granted or refused earlier.	5.3
27 July 2026	The Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force and postpones the high-risk obligations of the AI Act.	5.2
2026	Start Campus expects SIN02 to enter service in Sines.	2.2.3
Second half of 2026	Google's Nuvem cable is expected to be ready for service.	4.4.1
End-2026	The CAM ring replacement is scheduled for completion.	4.4.1
January 2027	The full set of Data Act switching obligations applies to cloud providers.	5.1.1
2027	The wholesale roaming cap falls to €1.00 per GB.	3.4
Not before 2027	Earliest expected adoption of the DNA.	3.5
2 December 2027	High-risk obligations of the AI Act apply to stand-alone systems.	5.2
2 August 2028	High-risk obligations of the AI Act apply to systems embedded in regulated products.	5.2
31 October 2029	Proposed: Member States present national transition-to-fibre plans to the Commission.	3.5
2030	Target date for gigabit-capable network coverage of all households.	3.4
31 December 2035	Proposed: final copper switch-off deadline.	3.5