Portugal became the third-to-last Member State to update its national data protection laws to comply with the General Data Protection Regulation (GDPR) on August 8, 2019. The law applies to the processing of all personal data carried out in Portugal – both in public or private nature – and as well as data processing conducted outside of Portugal when it is performed for an entity in Portugal or affects individuals in the country. Penalties in violation of Portugal’s data protection laws range between €5,000 to €20,000,000, or 4 percent, whichever is greater, on companies and a maximum penalty of €500,000 for a natural person.
