The Comissão Nacional de Proteção de Dados is Portugal's national data protection authority. Its foundation is unusually layered: Article 35 of the Portuguese Constitution enshrines data protection as a fundamental right, and the CNPD operates under that alongside the GDPR and the Portuguese implementing laws, Lei 58/2019 and Lei 59/2019. It supervises processing across the public and private sectors, handles complaints, and issues binding decisions.
What the CNPD publishes
- Deliberações, its formal decisions and rulings
- Pareceres, advisory opinions including on draft legislation
- Orientações e recomendações, guidance and recommendations for controllers
- Diretrizes and regulamentos, directives and regulations on specific processing contexts
- Autorizações for particular processing activities
- Activity plans, annual reports and a quarterly publication
Why it matters for compliance teams
The constitutional footing gives Portuguese data protection an additional dimension: the CNPD has previously disapplied provisions of national implementing law it considered incompatible with the GDPR and the Constitution, which is a stronger posture than most European authorities take.
Seqlense DOC indexes CNPD deliberações and guidance in full text alongside EDPB material and the other national authorities, so a privacy team can see where the Portuguese reading diverges from the European baseline.