Portugal
NATO founding member and NSA Tier B partner wired into Europol, Schengen, Prüm and the Lusophone (CPLP) network, its Atlantic coast a three-continent cable hub and its courts having struck down data retention three times
Overview
EU Member State (since 1986), NATO founding member (1949). For the EU framework, see the EU Framework page.
Portugal’s privacy framework is rooted in Article 35 of the Constitution (“Use of Information Technology”), guaranteeing data protection rights since the 1976 post-revolution constitution, a direct response to the PIDE/DGS secret police surveillance under the Salazar-Caetano dictatorship (1933–1974). The CNPD (Comissão Nacional de Proteção de Dados) enforces the GDPR via Lei 58/2019. The SIRP coordinates two intelligence agencies (SIS domestic, SIED foreign) under parliamentary oversight. NSA Tier B partner. Portugal’s Atlantic coastline (particularly Sines and Carcavelos) is a critical submarine cable junction connecting Europe to Africa, South America, and beyond. Lajes Field in the Azores is a jointly operated Portuguese-US Air Force installation with signals intelligence implications.[1][2]
Portugal’s outward data-sharing runs through its alliances and treaties, each detailed below. It is a NATO founding member (1949) and an NSA Tier B partner hosting the joint US-Portuguese Lajes Field installation in the Azores, and its SIS takes part in the Club de Berne intelligence forum and its Counter-Terrorism Group; it is a party to the 1959 Council of Europe Mutual Assistance Convention and the Budapest Convention on Cybercrime, belongs to the Schengen and Prüm frameworks and to Europol and the European Investigation Order, and cooperates on mutual legal assistance with the United States (through the EU-US instrument) and across the lusophone CPLP. These are the channels through which the domestic protections described below are, in practice, bypassed.[17][18][19][20][21]
International Data Sharing Agreements
Mutual Legal Assistance
EU Member States (26 countries): Portugal cooperates with the other EU states through the EU Convention on Mutual Assistance in Criminal Matters (2000), the Schengen Convention, and the European Investigation Order, which enables binding cross-border evidence requests.
European Convention on Mutual Assistance in Criminal Matters (1959, ETS 30): This Council of Europe instrument and its Additional Protocols apply between Portugal and all other parties. As of July 2026 it has 51 parties: all 46 Council of Europe member states (Albania, Andorra, Armenia, Austria, Azerbaijan, Belgium, Bosnia and Herzegovina, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Georgia, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Moldova, Monaco, Montenegro, the Netherlands, North Macedonia, Norway, Poland, Portugal, Romania, San Marino, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye, Ukraine, and the United Kingdom) plus five non-members (Chile, Israel, Mongolia, the Republic of Korea, and the Russian Federation).[17]
Convention on Cybercrime (the Budapest Convention, 2001, ETS 185): Portugal is a party to the Council of Europe’s cybercrime convention, which governs the expedited preservation and cross-border disclosure of stored computer and subscriber data. As of July 2026 it has 82 parties: 45 Council of Europe member states (every one of the 46 except Ireland, which has signed but not ratified), namely Albania, Andorra, Armenia, Austria, Azerbaijan, Belgium, Bosnia and Herzegovina, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Georgia, Germany, Greece, Hungary, Iceland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Moldova, Monaco, Montenegro, the Netherlands, North Macedonia, Norway, Poland, Portugal, Romania, San Marino, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye, Ukraine, and the United Kingdom; together with 37 non-member states: Argentina, Australia, Benin, Brazil, Cabo Verde, Cameroon, Canada, Chile, Colombia, Costa Rica, Côte d’Ivoire, the Dominican Republic, Ecuador, Fiji, Ghana, Grenada, Israel, Japan, Kiribati, Mauritius, Morocco, New Zealand, Nigeria, Panama, Papua New Guinea, Paraguay, Peru, the Philippines, Rwanda, São Tomé and Príncipe, Senegal, Sierra Leone, Sri Lanka, Tonga, Tunisia, the United States, and Vanuatu.[18]
Bilateral mutual legal assistance: A US-Portugal bilateral agreement was signed July 14, 2005 (Rice and Freitas do Amaral), but per DOJ records Portugal operates with the US under the EU-US MLA instrument only (in force February 1, 2010). CPLP: cooperation among police directors and military authorities with the nine lusophone nations (Portugal, Brazil, Angola, Mozambique, Cabo Verde, Guinea-Bissau, São Tomé and Príncipe, Timor-Leste, Equatorial Guinea) across four continents. Portugal ratifies its treaties by decree published in the Diário da República, where the full set is searchable.[11][12]
Intelligence Cooperation
NSA Tier B (“Focused Cooperation”): bilateral SIGINT partner; Portuguese persons targetable. Lajes Field (Terceira Island, Azores): jointly operated Portuguese-US Air Force installation, positioned midway between North America and Europe; served Cold War maritime patrol and Operation Nickel Grass (1973); carries signals intelligence implications for mid-Atlantic cable communications. NATO founding member (1949): participates in Alliance intelligence-sharing structures including the NATO Intelligence Fusion Centre. Portugal’s SIS participates in the Club de Berne and its Counter-Terrorism Group (CTG); the Club de Berne keeps no public roster, but it is reported to comprise the intelligence services of the 27 EU member states (Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden) together with Norway and Switzerland, with the United Kingdom also reported as a member; the CTG comprises the same services plus the United Kingdom.[22] EU-US Umbrella Agreement, SWIFT/TFTP, PNR. Interpol I-24/7. Egmont Group.[13][14][15]
EU Law Enforcement Cooperation
SIS II: Real-time query and alert sharing across the Schengen Area (29 states: Austria, Belgium, Bulgaria, Croatia, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and Switzerland).[19] Prüm: Automated DNA, fingerprint, and vehicle-registration exchange; the framework binds 31 states (all 27 EU members plus the non-EU Schengen associates Iceland, Liechtenstein, Norway, and Switzerland); Prüm II (2024) adds facial images and police records.[20]
Europol
As an EU member state, Portugal is one of the 27 EU members that constitute Europol, the EU Agency for Law Enforcement Cooperation (Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden). Europol also holds operational agreements permitting personal-data exchange with 17 non-EU states (Albania, Australia, Bosnia and Herzegovina, Canada, Colombia, Georgia, Iceland, Liechtenstein, Moldova, Monaco, Montenegro, North Macedonia, Norway, Serbia, Switzerland, Ukraine, and the United States) and cooperates with US law enforcement including the FBI, so Portuguese person data flowing through Europol is reachable onward.[21]
The Privacy Backdoor Effect
- NSA Tier B / Lajes Field: Bilateral SIGINT cooperation; Lajes Field serves as US signals intelligence and maritime patrol hub with implications for mid-Atlantic cable surveillance
- Atlantic Cable Hub Exposure: Carcavelos, Sesimbra, and Sines host cables connecting three continents; allied intelligence can access traffic at UK or US cable segments on the same systems
- Club de Berne / EU INTCEN: SIS intelligence shared among the Club de Berne services (27 EU states plus Norway and Switzerland, UK reported) outside GDPR
- NATO Founding Member: Intelligence shared within NATO frameworks not subject to GDPR at receiving-state level
- EU Framework: Portuguese data in SIS II, Prüm, EIO accessible to 27 EU states; through Europol, to US FBI
- MLAT/CoE Conventions: the US (via the EU-US instrument), the 51 parties to the 1959 Convention and the 82 parties to the Budapest Convention can request data through MLA channels
- CPLP: Security cooperation with lusophone nations across four continents
Surveillance and Intelligence
Historical Context: PIDE/DGS
Portugal’s intelligence framework exists in the shadow of the PIDE (1945–1969) and its successor DGS (1969–1974), the secret police of the Salazar-Caetano dictatorship. Using ~1,000 agents and 20,000 informants, the PIDE conducted pervasive surveillance, censorship, and political repression. The DGS was dissolved following the Carnation Revolution of April 25, 1974, though many records were destroyed. This history directly shaped Article 35 and the strict legal constraints on successor intelligence services.[3]
SIRP Intelligence System
The Sistema de Informações da República Portuguesa (SIRP), established by Law No. 30/1984 (most recently amended by Law No. 50/2014), coordinates two agencies:
SIS (Serviço de Informações de Segurança): domestic security intelligence, responsible for internal security, counter-terrorism, counter-espionage.
SIED (Serviço de Informações Estratégicas de Defesa): foreign/strategic intelligence. Originally SIEDM (with military component), restructured 2004.
SIS and SIED officers may access subscriber and equipment location data for national security, and traffic data for preventing espionage and terrorism. The CFSIRP (parliamentary oversight council) monitors intelligence activities with authority to inspect data centres and conduct unannounced visits. A separate Data Oversight Commission monitors each agency’s data processing.[4][5]
Internet Infrastructure and Submarine Cables
Atlantic Submarine Cable Hub
Portugal’s Atlantic coastline makes it one of Europe’s most strategically important cable landing zones. Landing stations at Carcavelos, Sesimbra, and Seixal host systems connecting Europe with Africa, the Middle East, and Asia:
EllaLink: direct Europe-South America cable linking Sines (Portugal) to Fortaleza (Brazil), bypassing North American routing. Operational since 2021.
2Africa: the world’s largest submarine cable (45,000+ km, 33 countries), landed at Carcavelos March 2024.
Equiano: Google’s cable connecting Sesimbra to South Africa (May 2022). Plus WACS, SAT-3/WASC, ACE, MainOne, SEA-ME-WE-3, and EIG.
Sines: Emerging Atlantic Hub
Sines is being developed as a major Atlantic connectivity hub through aicep Global Parques, EllaLink, and Start Campus (hyperscale data centre). The Olisipo domestic cable connects Sines to Lisbon; the Nuvem cable is planned to link Portugal to the United States; the Medusa cable will connect to North Africa via the Mediterranean.[6][7]
GigaPIX
GigaPIX (founded 1995) is Portugal’s primary IXP, operated by FCT|FCCN across three Lisbon data centres and one in Porto, with ~60 ASNs connected.[8]
Recent Developments
NIS2 Transposition, In Force April 3, 2026: Decree-Law 125/2025 (published December 4, 2025) entered into force on April 3, 2026 after a 120-day vacatio legis, fulfilling a long-delayed transposition of the NIS2 Directive. The CNCS (Centro Nacional de Cibersegurança) is designated as the national cybersecurity authority with oversight over essential and important entities. Key initial deadlines: by May 4, 2026 essential and important entities already in activity must notify CNCS of a designated cybersecurity officer and a 24/7 permanent contact point; self-identification via an electronic platform operated by CNCS must follow within 60 days of platform availability. Maximum fines: EUR 10 million or 2% of worldwide turnover (essential entities) and EUR 7 million or 1.4% (important entities). Portugal was among the 19 EU member states that received a Commission reasoned opinion in May 2025 for missed NIS2 transposition.[16]
2Africa Cable Landing (March 2024): the 2Africa landing at Carcavelos (detailed above) further cemented Portugal’s role as a critical Atlantic hub.[7]
Metadata Law Reform, Third Attempt (February 2024): Lei 18/2024 after Constitutional Court invalidated both Lei 32/2008 (April 2022) and the first replacement (December 2023).[10]
Data Retention
Portugal’s data retention framework has been struck down twice by the Constitutional Court. Lei 32/2008 (1-year blanket retention) was declared unconstitutional on April 19, 2022 (Acórdão 268/2022) for indiscriminate retention. Parliament’s first replacement was struck down in December 2023 (Acórdão 800/2023) for the same deficiency. A third attempt, Lei 18/2024 (February 2024), regulates metadata access specifically for criminal investigations. Whether this survives constitutional scrutiny remains open.[9][10]
Pending Legislation
- Data-retention regime (Lei 18/2024): Portugal’s third attempt at a metadata-retention/access law, after the Constitutional Court struck down its predecessors twice; whether Lei 18/2024 survives constitutional scrutiny remains an open question and further reform may be required.[9][10]
- NIS2 implementing measures: with Decree-Law 125/2025 in force (detailed above), the CNCS published Regulation No. 756/2026 in July 2026, defining the rules for the electronic platforms used for entity identification, qualification, communications and notifications with the cybersecurity authorities, and addressing compliance levels, risk-management duties, incident notification and governance contacts for essential, important and relevant public entities.[16][23]
- EU AI Act implementation: Portugal must designate AI market-surveillance authorities and adopt implementing legislation; this remains pending.