The Portuguese Government approved a set of measures, including a general framework for preventing corruption. This happened under the National Anti-Corruption Strategy 2020-2024, approved by the Council of Ministers Resolution No. 37/2021, of 6 April 2021.  

Decree-Law No. 109-E/2021, of 9 December 2021, approved the Portuguese Framework for the Prevention of Corruption (the Portuguese Anti-Corruption Framework) and created an independent administrative entity, the National Anti-Corruption Mechanism (MENAC). MENAC replaced the Council for the Prevention of Corruption to promote transparency and integrity in public action and ensure the effectiveness of policies to prevent corruption and related offences. 

The Portuguese Anti-Corruption Framework requires public and private entities with 50 or more employees to adopt a regulatory compliance programme, which must include: (i) a risk prevention or management plan, (ii) a code of ethics and conduct, (iii) training programmes, (iv) reporting channels and (v) the designation of a compliance officer ("Responsável pelo Cumprimento Normativo").

This regulation also determines the implementation of internal control systems that ensure the effectiveness of the instruments of the regulatory compliance programme and the transparency and impartiality of procedures and decisions. It also provides sanctions, particularly administrative sanctions, for the non-adoption or deficient or incomplete adoption of regulatory compliance programmes.

Having the adaptation of the entities covered by this framework in mind, it was established that it would come into force and gradually take effect as follows:

  • The Portuguese Anti-Corruption Framework comes into force on 7 June 2022; and
  • The sanctioning regime will take effect from 7 June 2023, except for companies with 50 to 249 employees, where it will take effect from 7 June 2024.



No unequivocal definition of corruption exists. However, there is consensus that corruptive conduct involves the abuse of public power or service duties to benefit the third party against payment of a sum of money or any other benefit.

Articles 372 to 374-B of the Portuguese Criminal Code provide for crimes of undue receiving of advantage and corruption crimes.

Corruption crimes have essentially two outlines: active and passive corruption, depending on whether the perpetrator is, respectively, offering/promising or requesting/accepting an undue material or non-material advantage. Another critical difference is whether the action requested or performed is contrary to the service duties of the corrupted officer.

Corruption crimes in international trade and private practices (set out in Law No. 20/2008 of 21 April 2008, as well as those included in the Criminal Liability Regime for Anti-Sporting Behaviour, approved by Law No. 50/2007 of 31 August 2007) are also included in the concept of corruption, even when there is no abuse of public power or function.

It is essential to mention that in society, the concept of corruption has a broader meaning. It includes other crimes perpetrated in the performance of public duties, such as embezzlement, economic participation in business, extortion, abuse of power, prevarication, influence peddling or money laundering.

Corruption and related offences comprise the following criminal offences: corruption, receiving and offering an undue advantage, embezzlement, economic involvement in business, extortion, abuse of power, prevarication, influence peddling, laundering or fraud in obtaining or diverting a subsidy, grant or credit.


Regulatory Compliance Programme

The Portuguese Anti-Corruption Framework imposes the adoption of a regulatory compliance programme by:

  • Legal entities, including branches, headquartered in Portugal with 50 or more employees;
  • State, autonomous regions, local authorities and corporate public sector companies with 50 or more employees; and
  • Independent administrative entities with regulatory functions and the Bank of Portugal.

Entities, either public or private entities, that do not meet the above requirements are not exempted from implementing instruments for the prevention of risks of corruption and related infractions. These must be adjusted to their size and nature.

The regulatory compliance programme must include the following minimum mandatory instruments:

  • Risk prevention or management plans;
  • Code of Ethics and Conduct;
  • Training programmes and awareness actions;
  • Reporting channels; and
  • Appointment of a Compliance Officer (“Responsável pelo Cumprimento Normativo”), whose role is to ensure and monitor the implementation of the regulatory compliance programme.

This regime also determines the implementation of internal control systems and prior assessment procedures that ensure the effectiveness of the instruments of the regulatory compliance programme.

The board of directors is responsible for adopting and implementing the regulatory compliance programme.

Entities must implement the regulatory compliance programme until 7 June 2022.


Minimum Mandatory Instruments 

  • Code of Coduct: Document establishing a set of ethical and deontological principles, values, and rules that the organisation’s employees must comply with;
  • Risk Prevention Plan: Instrument of internal risk control and management, i.e., control and management of the possibility of occurrence of some events with a negative impact on the organisation's objectives;
  • Reporting Channel: An internal reporting channel for corruption must be managed with independence, impartiality and absence of conflicts of interest, and ensure secrecy, confidentiality and data protection;
  • Trainning Programme: To ensure all employees clearly understand and embrace policies and procedures that affect their duties and responsibilities; and
  • Compliance Officer: Responsible for ensuring and controlling the application of the regulatory compliance programme, namely by implementing, controlling and reviewing the risk prevention plan.


Prevention Plan for Corruption Risks and Related Offences

The Prevention Plan for Corruption Risks and Related Offences (Risks Prevention Plan) is an essential instrument of control and management of internal risk, i.e. of control and management of the possibility of occurrence of any event with a negative impact on the organisation’s goals.

A Risks Prevention Plan should cover the whole organisation and its activity, including administration, management, operational or support areas.

Corporate groups can adopt and enforce a single Risks Prevention Plan covering the entire organisation and activity of the group, including management, operational or support areas of the corporate group entities.

A Risks Prevention Plan must include:

  • Identification, analysis and ranking of risks and situations that may expose the entity to acts of corruption and related offences, including the ones associated with the performance of duties by the members of the management and administrative bodies, considering the reality of the sector and the geographical areas in which the entity operates;
  • Preventive and corrective measures to reduce the probability of occurrence and impact of the risks and situations identified.

It must also contain:

  • The entity's areas of activity with risk of engaging in acts of corruption and related offences;
  • The likelihood of occurrence and foreseeable impact of each situation, in a way that would make it possible grading of risks;
  • Preventive and corrective measures to reduce the likelihood of occurrence and impact of the risks and situations identified. In cases of high or maximum risk, the most comprehensive prevention measures, being enforcement the priority; and
  • Appointment of a person responsible for the implementation, control and review of the Risks Prevention Plan, which may be the Compliance Officer.


Enforcement Control of the Risks Prevention Plan

To ensure that new or existing risks are adequately addressed, the execution of the Risks Prevention Plan should be subject to a review of internal controls, particularly:

  • Preparation, in October, of an interim evaluation report on situations of high or maximum risk identified;
  • Preparation, in April of the following year, of an annual evaluation report that quantifies the degree of execution of the preventive and corrective measures and the expectation of their full implementation.

Entities must ensure that the Risks Prevention Plan and relevant reports are disclosed to employees through the Intranet and official Internet website, if applicable, within ten days from implementation, review or amendments.

Public entities have an additional reporting obligation. They must report the Risks Prevention Plan and relevant reports to the Government members responsible for their management, supervision or control; the inspection services of the appropriate governmental area; and to MENAC within ten days from implementation, review or amendments.

the Risks Prevention Plan must be reviewed every three years or whenever changes occur, for instance, changes in the entity’s articles of association or corporate structure.


Code of Conduct

The Code of Conduct includes a set of ethical and deontological principles, values and rules that govern an organisation's activity and by which the members of its management bodies and employees should abide in their internal relationships as well as with customers, suppliers and stakeholders.

The Code of Conduct does not have an inside limitation. It may also be addressed to third parties, i.e., entities outside the organisation but which are contracted by or act on behalf of the organisation, in cases where the organisation may be responsible for their actions or omissions, under the "principal/ commissioner" liability regime.

The Portuguese Anti-Corruption Framework expressly requires the Code of Conduct to include the disciplinary sanctions for failure to comply with the Code’s rules under the law and have criminal sanctions for acts of corruption and related offences. On the other hand, it is necessary to adopt a specific procedure if a violation occurs. In other words, a report must be drawn up identifying the rules infringed, the sanction applied, and the measures implemented or to be implemented.

The Code of Conduct must be disclosed through the Intranet and official Internet website, if applicable, within ten days from its implementation, review or amendments.

Public entities have an additional reporting obligation. They must report the Code of Conduct to the Government members responsible for their management, supervision or control; the inspection services of the appropriate governmental area, if any; and to MENAC within ten days from implementation, review or amendments. The communications will be carried out through an electronic platform managed by MENAC.

The Code of Conduct must be updated every three years or whenever changes occur, for instance, changes in the entity’s articles of association or corporate structure.


Internal Reporting Channels

The Portuguese Anti-Corruption Framework itself states that the adoption of internal reporting channels for acts of corruption and related offences falls within the Whistleblowing Directive (EU) 2019/1937, which was transposed by Law No. 93/2021, of 20 December 2021, into Portuguese law.

This means that corruption and related offences are also included in the scope of the breaches set out in the Portuguese Whistleblowing Law, and the whistleblower may benefit from the relevant protection once specific (cumulative) conditions are met, namely:

  • The reporting person is acting in good faith;
  • The reporting person has a serious reason to believe that the information is accurate at the time of the report or public disclosure;
  • The information relates to a covered breach, i.e., a reportable breach; and
  • The complaint is made through appropriate report channels.

Each entity is free to choose how to implement the reporting channel. Regardless of the means chosen, the confidentiality of the reporting person or anonymity (if requested by the reporting person) must always be ensured. Complaints may be made anonymously.

The reporting channel must ensure the possibility of the complaint being made:

  • In writing: by post, via one or more physical complaint boxes, or an online platform, e.g., on the Intranet or Internet; or
  • Verbally: via a telephone line or other voice messaging system; or
  • Both.


Follow-up on internal complaints

The follow-up to an internal complaint is subject to mandatory deadlines, namely:

  • Seven days: the entity will notify the reporting person on the receipt of the complaint and inform in a clear and accessible manner the reporting person of the requirements, competent authorities and means and admissibility of an external complaint;
  • Three months from the reception of the complaint: the entity will inform the reporting person of the measures envisaged or adopted to follow up on the complaint and why. Following the complaint, the entity will take the appropriate internal actions to verify the allegations contained in the complaint and, where necessary, to bring to an end the breach reported, including by opening an in-house investigation or informing the competent authority to investigate the breach;
  • 15 days after the respective conclusion: the reporting person may request, at any time, for the entity to communicate the result of its analysis of the complaint.

Within the scope of the reporting channels, it is advisable to adopt a whistleblowing policy with specific procedures for information, response and handling of complaints.

Internal reporting channels can be operated:

  • Internally, for the purpose of receiving and following up complaints, by persons or services within the organisation; or
  • Externally, for the purpose of receiving complaints on behalf of the organisation, e.g. by external whistleblowing platform providers, external consultants, auditors.

Of these two options, the use of an external entity may prove to be the most appropriate option, as the Portuguese law requires that the independence, impartiality, confidentiality, data protection, secrecy and absence of conflicts of interest of whoever is in charge of managing the channel and following up on complaints is guaranteed.

If, however, the organisation chooses to manage and follow up on complaints itself, it is recommended that at least an assessment by an independent third party is made to verify that all safeguards, including response times and prompt follow-ups with the reporting person, are met, failing which fines may be imposed.


Training and Awareness Programme

Internal training shall ensure that administrative, management and other employees know and understand the policies and procedures to prevent corruption and related offences. In this case, the training hours count as statutory training time provided by the employer to the employee.

The Portuguese Anti-Corruption Framework does not foresee specific content for training or time sessions.

Each organisation is responsible for defining the content of its training programme and developing the necessary training actions for employees according to a risk-based approach.

Training must be transversal, although the content must be adapted to the respective recipients.

Training should take into account the different exposure of the board of directors, senior management and other employees to the risks of corruption and related infractions.

Along with internal training actions, the promotion of awareness-raising actions, both internally and externally, is another component necessary for implementing a PCN effectively.

Each organisation must inform its employees and the entities with which it relates – in its supply chain – of the policies and procedures in force that must be complied with and the consequences of non-compliance.


Compliance Officer (Responsável pelo Cumprimento Normativo)

The Portuguese Anti-Corruption Framework establishes that the Compliance Officer must be in a senior management position or equivalent. However, it does not determine what specific qualifications RCNs should have for performing their duties. However, we anticipate that they should be appointed based on their professional qualities and, in particular, their expertise in law and compliance practice.

The Compliance Officer is not a new “role". The Portuguese Anti-Money Laundering Law (Law 83/2017, of 18 August) expressly provides for the designation of a Compliance Officer in anti-money laundering and terrorist financing measures. Similarly, the Data Protection Officer (DPO) under the General Data Protection Regulation (GDPR).

Although the Portuguese Framework does not establish the specific duties of the Compliance Officer, unlike what the Portuguese Anti-Money Laundering does, regarding money-laundering prevention, and GDPR for the Data Protection Officer (DPO), the Portuguese Anti-Corruption Framework imposes that the exercise of the Compliance Officer duties is performed independently, permanently and with decision-making autonomy. RCN must also have the internal information and human and technical resources necessary for the proper performance of their duties.

The question may arise whether the Compliance Officer for anti-money laundering or DPO can also act as the Compliance Officer for the Portuguese Framework. The answer to this question is not universal since it can depend, among other things, on the size and structure of the organisation itself and the procedures in place. If the entities covered are in a group relationship, the Portuguese Anti-Corruption Framework expressly states that a single person responsible for regulatory compliance can be appointed.

Although not legally specified, the Compliance Officer duties can be allocated to a team, but there should be a specific interlocutor with employees and competent authorities.


Internal Control and Prior Assessment Procedures

The entities covered, public and private, must implement an internal control system, which should include, among other things, the organisation plan, policies, methods, procedures and good control practices that consider the main corruption risks identified in the Risks Prevention Plan.

The internal control system must be proportionate to the nature, size and complexity of the entity and its business and be based on adequate risk management, information and communication models. The internal control system must also be supported by procedures manuals.

The implementation of the internal control system should also be subject to regular monitoring through random audits, with the results and conditioning factors being reported upstream, and the adoption of the necessary corrective or improvement measures.

The internal control system must be fit for preventing or repairing situations of conflict of interest :

  • In public entities, members of the administrative bodies, managers and employees must sign a declaration of absence of conflict of interests (form to be defined) in procedures in which they intervene relating to: (i) public procurement; (ii) granting of subsidies, subventions or benefits; (iii) urban, environmental, commercial and industrial licensing; licenciamentos urbanísticos, ambientais, comerciais e industriais; (iv) sanctioning procedures. In a case of a potential or existing conflict of interest, they must also disclose the issue to their manager or, in their absence, to the Compliance Officer.
  • In private entities, prior risk assessment procedures should be established in relation to third parties acting on their behalf, as well as suppliers and customers. To identify situations of conflict of interest, these procedures must be suitable for the title of beneficial owners, image and reputation risks and commercial relations with third parties.



Very Serious misdemeanour

FINES FROM € 2.000 TO € 44.891,81 (LEGAL PERSONS) OR UP TO € 3.740,98 (NATURAL PERSONS)

  • Failure to adopt of implement a Risk Prevention Plan or if the adopted/ implemented Plan lacks any of the required elements; 
  • Failure to adopt a Code of Conduct or to adopt a Code that does not take into account the criminal norms regarding corruption and related offences or the risks of the Entity's exposure to these crimes; and
  • Failure to implement an Internal Control System.
Serious misdemeanour


  • Failure to draw up control reports over the Risk Prevention Plan;
  • Non-revision of the Risk Prevention Plan or the Code of Conduct;
  • Failure to publicise the Risk Prevention Plan or the Code of Conduct and monitoring reports to employees; 
  • Failure to communicat the Risk Prevention Plan or the Code of Conduct and/ or control reports;
  • Failure to report in case of breach of the Code of Conduct or incomplete reporting.


Liability for the perpetration of administrative offences lies upon:

  • Legal persons, when the acts are carried out by the members of their bodies, agents, representatives or employees in the performance of their duties or in their name and on their behalf. When the agent acts against the explicit orders or instructions of the legal persons or similar entities, their responsibility is excluded;
  • Owners of managerial bodies or managers, the person responsible for regulatory compliance and those responsible for the management or supervision of the areas of activity in which the administrative offence is committed when they engage in the acts or when, knowing or having knowledge of the acts, they do not adopt measures to put an end to them.

Directors or managers of legal persons or equivalent entities are alternatively liable:

  • For the payment of fines imposed prior to the beginning of the term of office when they are accountable for the insufficiency of assets for payment; or
  • For payment of fines imposed prior to the beginning of the term of office but where the final decision is only notified during the term of office and non-payment is attributable to them.

When several persons are liable to pay the fines, they are jointly liable.


If you wish to learn more, please download the PDF below. 


A whistleblower program, if well-designed, is an adequate tool to build a culture of good communication and corporate social responsibility, where reporting persons are considered to contribute to self-correction and excellence within the organisation significantly.

The most significant risks typically occur in a work-related environment, such as theft or fraud, bribery/corruption, environmental misconducts, health and safety concerns, privacy issues, employer’s policy breaches.

Employees are the ones to which it is easier to detect a breach. Still, they do not often report violations, mainly because they either believe that the breach cannot be effectively addressed or that there is a risk of retaliation.

As part of compliance programmes, reporting channels can be used as a risk management tool, giving organisations the chance to become aware of concerns/misconducts at earlier stages and prevent or mitigate financial and reputational risks.

Reporting channels allow building a confident and secure environment. Employees are encouraged to openly speak about their concerns with the management as their first preferred course of action. Confidentiality, response times, and follow-up must be ensured. Otherwise, a reporting channel will quickly fail its credibility and trust before its primary recipients – the employees.
This paper explains the main steps organisations need to take to comply with the Directive (EU) 2019/1937 (the ‘EU Whistleblowing Directive’ or the ‘Directive’) and Law 93/2021 of 20 December 2021, which implemented the Directive in Portugal.

The time to act is now for those who have not yet taken steps to ensure that a whistleblowing programme with effective report channels is in place. The Portuguese Whistleblowing Law requires ongoing internal reporting channels by 18 June 2022.

The EU Whistleblowing Directive

Currently, whistle-blower protection provided in the EU is fragmented across its Member States. This situation is due to different reasons, including cultural ones.

The purpose of the EU Whistleblowing Directive is to create a harmonised legal framework, which will introduce substantial changes in approach to whistleblowing in the many Member States, including Portugal, and with effects for employers with EU cross border operations.

The Directive affects all legal entities in the private and public sector with 50 or more employees and, regardless of the number of employees, entities within the scope of some EU acts, including Anti-Money Laundering (AML) rules. These organisations must provide means for employees to report misconducts that occurred in a work-related environment, including, but not limited to, the following: public procurement; prevention of money laundering; environment; personal privacy data.

The definition of “employees” has a broad range, comprising those with the employee’s status and freelance employees, contractors, subcontractors, suppliers, shareholders, management roles, former and prospective employees.

The deadlines to incorporate the minimum standards of the Directive into local laws are as follows:

  • Businesses and government organisations with or more than 250 employees, entities falling into the scope of EU some acts (such as AML rules), and municipalities serving 10,000 inhabitants must implement an internal reporting system by 17 December 2021; and
  • Businesses and government organisations with 50 to 249 employees must have their internal reporting system by 17 December 2023.

Organisations must have systems in place to monitor and follow up on reports. They must be prepared to understand the steps to protect whistle-blowers following their reports, safeguard their identity, and ensure that employees will not suffer any retaliation.

The Directive contains the minimum standards for accepting, processing, and reporting information received from whistle-blowers. The EU Member States may impose additional requirements on top of these, so it is recommended to keep track and review the local whistleblowing legislation.

Reporting channels

In Portugal, the Whistleblowing Directive was implemented by Law 93/2021, of 20 December 2021.

The Portuguese Whistleblowing Law imposes that local businesses and government organisations with or more than 50 employees, “obliged entities” falling into the scope of the Portuguese Anti-Money Laundering Law (Law 83/2017, of 18 August 2017), and municipalities serving 10,000 inhabitants implement an internal reporting system by 18 June 2022.

Employees must first use internal reporting channels before using external channels. The procedures for internal reporting channels shall include:

  • Setting-up of channels for receiving the reports which need to be designed, established, and to operate in a secure manner that guarantees that the confidentiality of the identity of the reporting person and any third party mentioned in the report is protested, and prevent access thereto by non-authorized staff members;
  • Acknowledgment of receipt of the report within seven days of that receipt;
  • An impartial person or department competent for following-up on the reports and which will maintain communication with the reporting person and, where necessary, ask for further information from and provide feedback to the reporting person;
  • Provision of feedback within a reasonable timeframe, not exceeding three months from the acknowledgement of receipt or, if no acknowledgement was sent to the reporting person, three months from the end of the seven days after the report was made; and
  • Provision of clear and easily accessible information regarding the procedures for reporting externally to competent authorities.

Employees must use external channels in case internal channels cannot reasonably be expected to function correctly. This may occur if employees have valid reasons to believe that:

  • They will suffer retaliation in connection with the reporting, including as a result of a breach of confidentiality, or
  • Competent authorities will be better placed to address the breach effectively.
Internal reporting channels

Main features

Employees can address complaints in writing and/or verbally. Complaints can be submitted anonymously.

Internal reporting channels can be operated in-house to receive and follow-up on complaints by persons or services selected for that purpose, or externally, to receive complaints only.

Independence, impartiality, confidentiality, data protection, secrecy, and absence of conflict of interest of the person(s) or entity chosen for this purpose must be safeguarded.

That person or entity will have to act diligently to follow up on the report.

Appropriate actions must be taken to verify the assertions made in the report and, where necessary, to cease the reported violation by opening an internal investigation or informing the competent authority to investigate the breach.

Deadlines for the follow-up of reports

  • Seven days: acknowledge receipt of the report to the reporting person should occur within seven days of that receipt. Within the same deadline, the reporting person must be informed, in a clear and easily accessible way, on relevant procedures and external reporting procedures to relevant competent authorities.
  • Three months: follow-up and feedback should take place within a reasonable timeframe, given the need to promptly address the issue that is the subject of the report and the need to avoid unnecessary public disclosures. This timeframe should not exceed three months but could be extended to six months, if necessary, due to the specific circumstances of the case, in particular the nature and complexity of the subject of the report, which may require a lengthy investigation.

The reporting person can, at any time, request the organisation to disclose the outcome of the review carried out following the report and within 15 days as of its conclusion by the organisation.

External reporting channels

Main features

Competent authorities will establish external reporting channels, independent and distinct from other communication channels, to receive and pursue reports. They will also publish information on the reporting procedures in a separate, easily identifiable, and accessible section on their websites.

When there is no competent authority to address the report or in cases where the target of the report is the competent authority itself, the report must be addressed to the Portuguese Anti-Corruption Authority and, if this authority is the target, to the Public Prosecutor's Office.

Reports will be dismissed when the competent authority, by a reasoned decision (to be notified to the reporting person), considers that:

  • The reported offense is of minor seriousness, insignificant or manifestly irrelevant;
  • The complaint is repeated and contains no new elements of fact or law that justify a different follow-up to the first complaint; or
  • The complaint is anonymous and there is no evidence of an infringement.

Deadlines for the follow-up of reports

  • Seven days: acknowledge receipt of the report to the reporting person should take place within seven days of that receipt unless the reporting person explicitly requested otherwise, or the competent authority reasonably believes that acknowledging receipt would jeopardise the protection of the reporting person's identity;
  • Three months: for the organization to notify the whistleblower of the measures envisaged or adopted to follow up the complaint with the relevant grounds.

The reporting person can, at any time, request the competent authority to disclose the outcome of the review carried out following the report and within 15 days as of its conclusion by the competent authority.

Competent authorities will review the procedures for receiving and handling reports every three years, considering their experience and that of other competent authorities.


In addition to implementing effective, confidential and secure reporting channels, it is crucial ensuring that reporting persons are protected effectively against retaliation.

Retaliation means any direct or indirect act or omission which occurs in a work-related context, is prompted by internal or external reporting or by public disclosure, and which causes or may cause unjustified detriment to the reporting person.

For instance, employees need specific legal protection to acquire the information they report through their work-related activities. Therefore, employees risk work-related retaliation for breaching the duty of confidentiality or loyalty. Employees may also find themselves in a position of economic vulnerability in the context of their work-related activities.

Protection should be provided against retaliatory measures taken not only directly vis-à-vis employees themselves but also those that can be taken indirectly, including vis-à-vis facilitators, colleagues or relatives of the reporting person who are also in a work-related connection with the reporting person's employer or customer or recipient of services.

Once employees make their report, they should be protected by:

  • Steps are being taken to prevent retaliation, harassment and threats against them by issuing fines to anyone looking to hinder the process in such a manner;
  • Suspension, lay-off, dismissal or equivalent measures;
  • The burden of proof being reversed so that the business or municipality has to provide evidence that it was not trying to retaliate against a whistleblower;
  • Being offered free advice and information on procedures;
  • Understanding that, by exposing wrongdoing, they did not contravene contracts, non-disclosure agreements or similar;
  • Being offered financial assistance;
  • Being offered psychological support.
The role of the management

Many organisations make their internal reporting system accessible to their employees but do not actively encourage its use. Only a few seek to instil a sense of obligation by sending the message that persons who perceive misconduct but do not raise the alarm are complicit in their apathy or indifference.

Whistleblowing programmes may fail if the high-level management cannot provide proper assurance that those who report issues will not be ignored, silenced, or punished for the bad news.

In turn, middle-level management must balance supporting the programme and preventing access due to much control. Too much management control over the process can hinder its use.

Doubts about management commitment can still arise if the reporting channel is exclusively handled in-house and without the involvement of an independent and impartial third party.

Ensuring the protection and safety of whistleblowers is necessary for the effectiveness of a whistleblowing programme.

A whistleblowing programme must guarantee confidentiality and allow discreet or anonymous reports. If an individual feels seriously threatened or in a situation where a company has only a few employees, guarantees of confidentiality may not be sufficient to encourage whistleblowing, in which case it would be necessary to offer anonymity.

Any reports must be stored confidentially and securely. Each organisation needs to take steps to protect whistleblowers' identities and comply with the General Data Protection Regulation (GDPR). Having a central tracking system to enter, monitor, and update case details will help ensure this while at the same time simplifying the investigation procedure.

Providing feedback to the reporting person as part of the investigation process will also show that the issue is assessed and taken seriously by the organisation.

The programme still needs to be informed to all employee levels. The announcement must have a clear and strong message and be repeated from time to time. This communication that the programme enjoys support at the highest-level management and that the use is an act of loyalty, not infidelity, is crucial and stresses the message that reporting is the right thing to do.

If you wish to know more, please download our PDF down below. 


Employment laws play a particularly important role in decision-making when it comes to setting up business or working in any country. Whether as an employer or employee, Portugal’s employment regime ensures you know where you stand.

The employer-employee relationship has long been a sticking point for potential investors into any country due the rigidity of the laws as well as the obligations, constraints and fine print that come with it. Ten years ago, Portugal addressed this point with a change in the legal regime that it has been revising and adapting to strike the right balance between securing employee rights and giving employers a level of necessary flexibility.

If you look at recent data from the World Economic Forum (WEF), the European Trade Union Institute and PORDATA (the statistical database of socioeconomic subjects) you will see Portugal has a less rigid system and is at the lower end of labour dispute figures and days lost to labour disputes when compared with other EU countries.

Your go-to for everything employment is the 2009 Labour Code, with everything you need in one place including the type of contracts, duration, working hours, holidays, absences and termination. It’s employer-friendly, as it allows certain types of flexible working schedules without increasing costs to the employer, as well as having an overall flexible regime designed by the Government to make the country’s employment legal framework fairer, more balanced and increasingly investor-friendly.

Looking to hiring employees?

The mandatory rules set forth in the Labour Code, as well those part of any collective bargaining agreements with Trade Unions, set out the legal framework that you must follow when hiring an employee in Portugal. Under certain circumstances, however, you and your employees may be allowed to agree different rules, if more favourable to the latter.

You need to be aware of employees’ obligations and entitlements, working hours and holidays.

These are figures to take note of. You have a maximum 40-hour work-week and a 8-hour work-day, along with a minimum rest of 11 consecutive hours between workings days and a mandatory weekly rest day.

Employees’ are entitled to 22 working days of paid annual leave. This limit may be increased by collective bargaining agreements.  

Employees are also entitled to public holidays – a total of 13 days in the year 2019.

Working out salaries.

You need to be aware that for 2019 the minimum national wage is set at €600 per month. In addition to this you must pay two extra month’s salary known as the ‘Christmas allowance’, payable up to 15 December each year, and “holidays allowance” payable preferably before the holidays.

And what are the employees’ rights in relation to absences?

Be aware that Portugal has a rigid regime when it comes to absences. The labour code establishes an exhaustive list of justified absences, which as a general rule do not affect any rights of the employee.

As for employment contracts, what do you need to be aware of?

Contracts can be for indefinite term (permanent) or for a fixed or unfixed term, and certain types must be made in writing, i.e. those with a ‘term’, part-time contracts, contract executed with a minor. To note, ‘term’ contracts can only be used to meet temporary work needs of the employer and for specific periods, and have a maximum duration of two years, renewable up to three times and the total duration of renewals may not exceed the contract’s initial duration.

The duration of the unfixed term contract may not exceed four years.

Does the law allow for probation periods?

Yes, and the length of the probation period depends on the type of contract.

Thus, for permanent contracts, the probation period is equal to 240 days for management positions, 180 days for employees performing functions of high responsibility or high complexity, first job seekers and long-term unemployed, and 90 days for the rest of the employees.

For fixed or unfixed contracts, the probation period is equal to 30 days for contracts over six months and 15 days for contracts of less than six months.

During this period both parties are free to cut the contract short, without justification or notice period.


What are the key rules in relation to terminations and dismissals?

Again, the Labour Code sets out all the circumstances covered as well as the processes to follow. And you must comply with the set criteria otherwise the termination will not be considered effective.

An employee, of course, has the right to quit, terminating the contract with or without a just cause, being that in this last case notice must be given, equal to 30 days for contracts up to two years, of length, or 60 days for contracts over two years. And contracts can of course be terminated without consequence by agreement between the parties.

Can employers terminate ‘permanent’ contracts?

Permanent contracts can only be terminated with just cause, i.e., when the employee breaches his/her duties or when it becomes impossible for them to continue to perform the hired functions. Termination of permanent employees is also possible in cases of redundancy (individual redundancy or collective dismissal), when the company needs to reduce its work force due to market, structural or technological reasons.

And what about ‘term’ contracts?

‘Term’ contracts expire at the end of their ‘term’. However, the employer must give a prior notice. For fixed-term contracts, the employer must give a 15 days’ notice before the term, while the employee must give an eight days’ notice. For unfixed-term contracts, the prior notice is equal to seven days for contracts up to six months, 30 days for contracts with a duration between six-month and two years and 60 days for contracts with a duration over two years.

What is key when it comes to dismissals?

Employers may terminate a permanent employment contract only for just cause. Generally, this would be on account of the employee’s gross misconduct that leads to a fundamental breach of contract, or for objective reasons such as redundancy.

However, it is not enough for the employer to have a fair reason for dismissal: a strict pre-dismissal procedure must be followed. Otherwise, the termination will be deemed as an unfair by the Labour Court.

What are the rules for collective dismissals or redundancy?

Collective dismissal refers to the termination of several contracts either simultaneously or separately over a period of three months. A company will be before a collective dismissal if the termination includes at least two employees, if the company is small, or five employees if it is a medium or large company.

On the other hand, individual redundancy exists whenever the number of employees to be terminated fall below the above-mentioned limits.

Both forms of termination must be based on market, structural or technological reasons and subject to a very strict proceeding.

Is there an obligation to provide severance pay?

Severance does come into play for Collective dismissal and individual redundancy.

The calculation rules regarding the amount of such severance pay have been changed following Troika’s austerity measures, which means that different regimes are applicable depending on the contract’s execution date.

How is this calculated?

For “new permanent contracts”, executed as of 1 October 2013, the compensation corresponds to 12 days of base salary and seniority allowance per each year of service

However, for “old contracts” the rules are as follows:

For contracts executed between 1 November 2011 and 30 September 2013, the compensation considers three periods:

  • period between 1 November 2011 and 30 September 2013, the compensation is equal to 20 days of base salary and seniority allowance per each year of service;
  • period between 1 October 2012 and the date on which the contact completes three years of duration, the compensation is equal to 18 days of base salary and seniority allowance per each year of service;
  • period subsequent to the first three years of duration of the contract and the date of the termination, the compensation corresponds to 12 days of base salary and seniority allowance per each year of service.

For contracts executed before 1 November 2011, the compensation considers three periods:

  • period until 31 October 2012, the compensation is equal to one month of base salary and seniority allowance per each year of service;
  • period between 1 November 2012 and 30 September 2013, the compensation is equal to 20 days of base salary and seniority allowance per each year of service; and
  • period of duration of the contract after 1 October 2013, the compensation corresponds to 12 days of base salary and seniority allowance per each year of service.

For fixed-term contracts:

  • Until 31 October 2012: contracts with a length up to six months, two days of base salary and seniority allowance per each month of service. For contracts over six months, three days of base salary and seniority allowance per each month of service;
  • As of 31 October 2012: 12 days of base salary and seniority allowance per each month of service.
  • After 1 October 2013: the New Rules apply: 18 days of base salary and seniority allowance per each year of service.


For a more detailed insight into this and other employment issues, do read our Guide Why Portugal 2019 and for further clarifications or a more tailor-made approach, please do get in touch.


Portugal has made several changes to its employment laws in the last few years and increased the flexibility of the legislation to attract foreign investment.

According to the ILO survey “Decent Work in Portugal 2008-18: From crisis to recovery”, Portugal stands as a solid example of successful and swift economic and labor market recovery, without compromising on workers’ rights”.

The labour reform approved in 2009 and the changes introduced after Portugal’s international bailout in 2011 have contributed to reduce the level of rigidity of employment rules. Nowadays Portugal is also better ranked in OECD´s Employment Protection Legislation Index.

Several aspects of the legislation have been revised since the adoption of the 2009 Labour Code, which adopted more employer-friendly legislation concerning the organisation of the workforce. For instance, working schedules may now be managed in a more flexible way without increasing the labour costs. The Labour Code also contains flexible rules that allow the employer to unilaterally change the place of employment and the employee’s functions.

According to the WEF Report, the changes in the labour regime has put Portugal 0.3 points behind the EU average, but ahead of larger European countries such as Spain and France.

After Portugal’s international bailout in 2011, Portugal simplified the termination procedures, reduced the severance pay, decreased the holiday leave period and suspended some public holidays.

Of course the elimination of some public holidays, rest days after overtime were not consensual, even though viewed as necessary by the Troika at the time.

After the general election of 2015, the suspension of the public holidays was removed in 2016 but no relevant changes to the labour legislation were made.

Portugal believes that the system now strikes the right balance between securing employees’ acquired rights and benefits and the level of flexibility required by employers.

According to Pordata, a national database of socioeconomic data, the average number of working days lost through industrial action by employee in 2016 was 11.8 days in 1,000, which is significantly lower than in several other European countries such as Spain where 21.2 days were lost in the same year.

Hiring employees

Hiring in Portugal is subject to the mandatory rules and statutory limits on several matters, such as remuneration, working hours, holiday rights or duration of contracts.

Employment contracts. In general, employment contracts do not need to be in writing. Only for some types of contracts the law requires a written document, including, but not limited to, fixed-term contracts, part-time contracts, contracts with foreign employees, and secondment contracts.

Regardless of the type of contract, the employer must inform in writing the employee on working conditions, including, workplace, job position, term and relevant grounds, employee’s pay, collective bargaining instrument (if any), employer’s accident insurance policy and employee’s compensation fund, and within 60 days from the effective date of the contract.

Salary. Employees are entitled to a minimum monthly salary set out by the Portuguese Government. In addition, employees are entitled to receive Christmas bonus and holiday bonus.

Working hours. The maximum regular working period is of forty hours per week, eight hours per day.

Employees are entitled to a minimum rest period of eleven consecutive hours between two successive daily work periods, as well as to one day of rest per week. An additional half or full day of rest (in all or in certain weeks of the year) may be also given other than the rest day required by law.

Holidays. Employees are entitled to twenty two working days of paid holiday per year, and to national public holidays.

Under collective bargaining agreements, employers may be obliged to grant two optional public holidays: Carnival/Shrove Tuesday and the local municipal holiday.

Health and safety. The employer must ensure employees health and safety conditions at work and hence comply with a set of general principles and duties aiming at the prevention of work accidents and professional illnesses.

Employers are obliged to ensure: (i) technical work accident preventive measures; (ii) employee training, information and consultation on workplace safety; (iii) internal or external health and safety services. The employer must also contract an insurance to cover work accidents risks for each employee.

Social Security. The Social Security contribution is a tax levied on the labour income, which is charged to employers and employees at the rates of 23.75% and 11% respectively.

Types of employment contracts

Fixed-term contracts. Contracts that are in force for a pre-established period set according to employer’s temporary needs, which must be specified in the contract, and expire at the end of the agreed term, unless they are renewed; fixed-term contracts cannot be renewed for more than three times and have a maximum duration of three years.

Term employment contracts must contain a detailed description of the relevant grounds and there must be a clear connection between the relevant grounds and the term. Otherwise, the employer may be subject to fines and the term contract could be legally converted into an open-ended employment contract.

Unfixed-term contracts. Contracts that are not subject to a pre-established period, but expire after the completion of the employer’s project or when the reason for which the employee was hired ceases to exist; unfixed-term contracts have a maximum duration of six years.

Open-ended contracts. In case the parties do not agree a term (fixed or unfixed), the employment contract is deemed to be entered into for a permanent period of time, which means that the contract can only cease upon termination by one of or both parties under the law, namely in case of just cause for dismissal.

Probation period. The probation period is the period during which either party may unilaterally terminate the contract without prior notice and without cause, during which no compensation required.

The maximum probationary period is:

For open-ended contracts:

  • 240 days for employees with management or senior positions;
  • 180 days for employees with job positions of technical complexity, high degree of responsibility or which require special qualifications, and for employees who perform duties of confidence; and
  • 90 days for other employees;

For fixed and unfixed-term contracts:

  • 30 days for contracts with a duration equal or higher than six months; and
  • 15 days for contracts with a duration of less than six months.

Employees are entitled to a minimum salary, which is set by the Portuguese Government and updated annually based on the cost of living, national productivity and the government’s prices and incomes policy.

Portugal's minimum salary is calculated based on a flat monthly rate. The national minimum salary in Portugal in 2018 is €580 per month (based on 14 payments a year). For certain jobs and professions, the minimum salary may be agreed by collective bargaining agreements, which could not however provide for an amount fewer than the minimum salary legally set out by the Government.

The salary must be paid on a regular and permanent basis and may be fixed, variable or mixed (comprising fixed and variable components).

In addition to the salary, employees are entitled to:

  • Christmas bonus: equal to one month salary payable until 15 December of each year; and
  • Holiday bonus: equal to one month salary payable before the holiday leave period.

Employers may not offset credits held over employees against any salary or make any discounts or deductions from employees’ salary during the period the employment contract is in force.

There are however exceptions (and up to certain limits), including:

  • Deductions in favor of the State, Social Security or other entities ordered by law, court decision or mediation settlement, provided that such decision or settlement has been notified to the employer;
  • Compensation determined by a court decision or a mediation settlement;
  • Monetary penalties resulting from a disciplinary procedure;
  • Repayment of capital and payment of interest on loans granted by the employer to the employee;
  • Prices of meals at the work place, use of telephones, supply of assets, petrol or materials, when requested by the employee, as well as other costs incurred by and with the employer’s consent on behalf of the employee; and
  • Subsidies or payments made in advance and on account of the employee’s salary.
Holiday rights

Employees are entitled to 22 working days of paid holiday per year. The holiday right is mandatory, which means that holiday entitlement may not be replaced by any compensation, financial or otherwise, even if upon employee’s approval. Employees may however waive the part of their holiday rights exceeding 20 working days.

In the same working year, the holiday leave period cannot exceed 30 working days, save as otherwise established by collective bargaining agreement or other instrument.

The holiday right becomes due on January 1 of the following year, except:

  • In the hiring year and after six months of work, the employee is entitled to two working days of holiday per each complete month of work up to the maximum of 20 working days. If the end of the year is reached before this period or before the employee takes his/her holiday, the employee may enjoy the holiday leave period until June 30 of the following year;
  • In case of employment contracts up to six months, the employee is entitled to two working days of holiday per each complete month of work;
  • In case of employment contracts up to 12 months or ending in the year subsequent to the hiring year, employee is entitled to a holiday leave period pro rata to the duration of the employment contract.

As a rule, the holiday leave period should be taken in the year it becomes due. In exceptional cases, employees may take the holiday leave period afterwards insofar this takes place until April 30 of the subsequent year and upon employer’s agreement.

The schedule of the holiday leave period should be agreed between the employer and the employee. In case this agreement fails, the employer must schedule the holiday leave period and give the employee the right to take the holiday between May 1 and October 31.

Regardless of agreement between the employee and the employer, employees are entitled to, at least, take 10 consecutive working days of holiday leave period.

Employer’s failure to comply with the holiday’s schedule constitutes a serious administrative offence and may entail which vary according to the employer’s turnover.

In addition, employees are entitled to take the day off in public holidays. Presently, the public holidays in Portugal are: January 1, Easter, Good Friday, April 25, May 1, Corpus Christi, June 10, August 15, October 5, November 1, December 1, 8 and 25.

Parental protection rights

Portuguese employment law establishes several statutory rights to puerperal, pregnant and nursing women, as well to parents.

Pregnant employees’ rights. In case employees’ work duties entail clinical risks to a pregnant employee or to her unborn child, the employer will either:

  • Provide the pregnant employee with alternative working conditions;
  • Replace the employee to a workplace compatible with her pregnant condition; or
  • Avoid pregnant employee’s exposure to risks for as long as necessary.

Pregnant employees are exempt from performing night shifts, working overtime or in hour banks or in concentrated working schedules. They are also entitled to a work leave to attend prenatal medical appointments and, after the birth, to breastfeed the baby.

Initial parental leave. Employees (mothers or fathers) are entitled to an initial parental paid leave of 120 or 150 consecutive days and corresponding to 100% or 80% of the salary, respectively.

If both parents share the initial parental leave, the leave period may be increased by 30 days. In this case, and after the mandatory six-week period to be taken by the mother after childbirth, both parents must take 30 consecutive days or two periods of 15 consecutive days.

Mother’s parental leave. All female employees must take a six-week period leave immediately after childbirth and may take 30 days before birth, in which case the employer must be informed within at least 10 days in advance (or as soon as possible, in case of a medical emergency) and receive a doctor's statement with the expected due date.

Father’s parental leave. An employee who becomes a father is entitled to take a paid leave of up to 20 working days, as follows:

  • 10 mandatory working days, five of which must be consecutive and taken immediately after childbirth and the remaining five days in the following 25 days; and
  • The remaining 10 working days are not mandatory and may be taken successively or alternately after the mandatory period above and along with the mother’s initial parental leave.

The termination of an employment contract of a puerperal, pregnant or nursing woman requires a prior legal opinion of the Commission for Employment Equality (Comissão para a Igualdade no Trabalho e no Emprego).

Failure to comply with parental protection rights is deemed a very serious offense which may lead to fines.

Restrictive covenants

As a general rule, restrictive covenants during employment or after its severance are void. However, it is possible to include non-compete and non-termination covenants in certain conditions.

Exclusivity and non-compete covenants. Exclusivity clauses (during employment) and non-compete agreements (after termination) are allowed if the following requirements are met:

  • The non-compete covenant is agreed in writing (for instance, under the employment contract);
  • The performance of a competing activity by the employee is likely to cause harm to the employer;
  • Compensation amount is agreed and payable to the employee; and
  • The non-competition covenant may not exceed two years after termination of the contract or, in some exceptional cases, up to three years if the activity performed entails a special relationship of trust or access to sensitive information.

Except for these cases, restrictive covenants agreed in employment contracts or those settled in collective bargaining agreements could be considered null and void insofar they limit employees’ freedom of work.

Non-termination covenant. In order to compensate the employer for high expenses incurred with the employee’s professional training, employees may also agree non-termination covenants, whereby the employee undertakes not to terminate the contract during a period of no more than three years.

The employee may in any case anticipate the end of this period by reimbursing the employer for the relevant expenses incurred.

To enforce restrictive covenants after termination of the employment contract, the agreement must state either the compensation amount payable to the employee or its calculation criteria. This compensation could be paid in instalments during the term of the agreement or all at once. The parties may also agree on contractual penalties applicable in case of breach of restrictive covenants.

Garden leave. In the context of pending disciplinary proceedings, garden leaves are permitted under law, particularly after the accusation note has been served to the employee. In turn, when resigning or when having been served a prior notice for dismissal (e.g. collective dismissal), employers could not impose the employee to cease performing his/her work role until the prior notice period is completed. In this scenario, the best option is the employer to instruct employees to use any unused holiday leave period.

Termination of employment contracts

Expiration of term employment contracts. Term employment contracts expire at the end of their initial or renewal term, provided that serves a termination notice to the employee as follows:

  • In fixed-term contracts, 15 days prior to the term of the contract; and
  • In unfixed-term contracts, seven, 30 or 60 days prior to the relevant date if the employment contract has lasted for less than six months, from six months to two years, or more than two years, respectively.

Collective dismissal. A collective dismissal is possible if the employer intends to dismiss a minimum of two employees (in companies with less than 50 employees) or five (in companies with 50 or more employees) within a three month period. Collective dismissal must have one of the following grounds:

  • Market structure reasons;
  • Organization-related and economic reasons; and/or
  • Technological reasons.

Mutual agreement. Employee and employer may freely agree in writing to terminate the employment contract. The termination agreement may be revoked by the employee within seven days from the effective date, except if the agreement is executed towards a public notary.

Redundancy. In case the number of employees involved does not allow a collective dismissal, termination on the ground of redundancy could be an alternative. Redundancy must be justified on the same grounds as collective dismissal and meet the following requirements:

  • The reasons for the termination do not relate to an intentional behaviour of the parties; and
  • The same tasks are not being executed by employees hired under a term employment contract.

Employee’s ineptitude. The employer may terminate the employment contract when the employee demonstrates ineptitude or inability to perform the assigned tasks, provided that such ineptitude occurs in the course of the performance of the functions.

Breach. The employer may terminate the employment contract under disciplinary grounds following by a disciplinary procedure carried out towards the employee.

In case of failure to comply with specific termination rules and formal procedures required by law, the termination could be deemed as unlawful and the employee entitled to (i) compensation for damages; (ii) the employee’s salary (including holiday and Christmas bonuses) from the dismissal date until the court’s final decision; and (iii) choose between reinstatement or compensation to be ruled by the court.

Severance compensation

Employees subject to collective dismissal, redundancy or employee’s ineptitude are entitled to severance compensation, which varies depending on the employee’s seniority period and execution date of the employment contract.

For open-ended contracts entered into before 1 November 2011, the severance compensation will be calculated as follows:

  • Until 31 October 2012: one monthly base salary and seniority per each year of employment;
  • Between 31 October 2012 and 30 September 2013: 20 days of monthly base salary and seniority per each year of employment; the amount of the monthly base salary and seniority may not be higher than 20 times the minimum monthly salary;
  • After 1 October 2013: 18 days of monthly base salary and seniority per each year of employment in the first three years of the contract, and 12 days of monthly base salary and seniority per each year of employment in the following years (the New Rules).

If the compensation calculated for the period until 31 October 2012 is equal or higher than 12 monthly base salaries and seniority or 240 of minimum monthly wage (Relevant Threshold), the period after 31 October 2012 will not be taken into account; if that compensation is less than the Relevant Threshold, the total compensation may not exceed the Relevant Threshold. The minimum compensation is three monthly base salaries and seniority.

For term contracts entered into before 1 November 2011, the severance compensation will be as follows:

  • Until 31 October 2012: three or two days of base salary and seniority per each month of employment, if the term of the employment is lesser or higher than six months, respectively, with a minimum of three monthly base salaries;
  • After 31 October 2012 and until 30 September 2013: 20 days of monthly base salary and seniority per each year of employment; the amount of the monthly base salary and seniority may not be higher than 20 times the minimum monthly salary;
  • After 1 October 2013: it is applicable the New Rules; and
  • Minimum compensation is three monthly base salaries and seniority.

For employment contracts entered into on or after 1 November 2011, the severance compensation will be calculated in accordance with the New Rules and the severance compensation may not exceed the Relevant Threshold. No minimum severance compensation amount is imposed by law.

In addition to the severance compensation, employees are entitled to all other existing labour credits, including outstanding amounts owed prior to the termination date (e.g. overtime work) and the proportional amounts of Christmas bonus and of the holiday leave period.


The General Data Protection Regulation (“GDPR”) promises to be the most significant global development in data protection laws across all European Union (“EU”) Member States since Directive 95/46/EC (“Data Protection Directive”), which was implemented in Portugal by Law 67/98, of 26 October 1998.

The GDPR will be directly applicable in all EU Member States from 25 May 2018. The new regulation will have a global scope, as businesses based outside the EU that offer goods or services to individuals in the EU may be required to comply with the GDPR.

The risk of fines up to 4% of annual worldwide turnover or €20 million is surely a strong incentive for companies to comply with the GDPR.

The new regulation is expected to be homogenously applied throughout the EU. Notwithstanding, Portuguese law will apply in cases it may impose more detailed conditions, such as those relating to the processing of sensitive data, particularly genetic data, biometric data or data concerning health. Portuguese law may also contain specific rules regarding the processing of employees' personal data, especially for the purposes of recruitment, performance and termination of the employment contract, which will apply together with the GDPR.

The combined application of the GDPR and the Portuguese law will be particularly relevant where companies collect and process data from Portuguese individuals and/or the Portuguese supervisory authority acts as lead authority due to the fact the main establishment or the single establishment of the controller or processor is located in Portugal.

Individuals, who are resident in Portugal, will have the right to lodge complaints with the Portuguese supervisory authority. For proceedings against a data controller or processor, the plaintiff will have the right to bring the action before the Portuguese courts if the data controller or processor’s business or the individuals’ residence is located in Portugal.

Although the core data protection rules remain broadly the same, there are important changes with impact on day-to-day business and for which companies should be aware of and prepare in advance.

As companies prepare for the entry into force of the GDPR, we propose a seven steps plan detailing the main aspects of the GDPR that companies need to take. This should be also used as an opportunity to improve the way the companies deal with personal data within their organization. The countdown to 2018 has started.


For further information about GDPR, please also see «Publicações» (only available in Portuguese)

IFLR 1000

"Excellent service, says a client on a refinancing transaction: I always trust on them when I have a legal issue in Portugal. [They are]...

Chambers and Partners

"Macedo Vitorino remains the go-to legal adviser for major telecoms players and specialises in the financing of public companies. Recent...

Chambers and Partners

"A compact but technically strong team, recognised for its corporate and M&A experience. Provides particular expertise in the TMT, energy...