Firms To Watch: Data privacy and data protection

Under the leadership of Lisbon-based partner Pedro Vidigal Monteiro, TELLES is instructed by an impressive corporate client base from a variety of industries seeking advice on data protection compliance programmes, GDPR issues and data incidents.

Data privacy and data protection in Portugal

Morais Leitão, Galvão Teles, Soares da Silva & Associados

Morais Leitão, Galvão Teles, Soares da Silva & Associados brings together a multidisciplinary team that is equipped to assist domestic and international clients in all stages of data protection matters, from compliance to related litigation. In addition to being a trusted advisor to major companies in the banking, insurance, telecoms, retail and energy sectors when it comes to GDPR compliance, the group also possesses an impressive track record in criminal and misdemeanour proceedings involving data protection issues. The latter is an area of focus for department head Tiago Félix da Costa, who receives key support from Maria da Assunção da Cunha Reis in some of the most important projects handled by the team. Helena Tapp Barroso is singled out for her experience in data protection issues pertaining to the insurance sector.

Practice head(s):

Tiago Félix da Costa

Other key lawyers:

Helena Tapp Barroso; Maria da Assunção da Cunha Reis



‘I emphasise the quality of the services provided and the constant updating of knowledge manifested by MLGT, given the complexity of the Regulation, its implementation and verification of its compliance. I also emphasise the diversity of knowledge on other matters of law, which is particularly useful in this type of services, given the various implications that the GDPR has on other matters (eg labor legislation and contractual matters).’

‘There is a Privacy and Personal Data team headed by an absolutely exceptional lawyer, competent, with a superior delivery quality, deeply knowledgeable about matters, resilient, who knows the client and the business extremely well, which always adds value.’

‘Tiago Felix da Costa is the partner responsible for this area. This same lawyer is also a reference in criminal law and administrative offences. His participation in all matters assigned to him in both areas – privacy and criminal – is always outstanding and extremely recognised within the company.’

‘Firm with a recognised ability to provide a global service, covering all areas of practice, with a very high quality of service, and with expert teams per practice area that are very well prepared and monitored by responsible partners with extensive and recognised experience in the national legal market. One of the most relevant characteristics of the profile of the Morais Leitão office lies in the great focus that the teams have on the Client and on the solutions they seek to find for the client’s needs within the regulatory constraints. Teams with excellent monitoring and knowledge of the Client. Very transparent invoicing system.’

‘Helena Tapp Barroso – Partner with extensive experience in the area of privacy and data protection. Perspective highly focused on finding innovative solutions adapted to client needs. Excellent client management skills.’

‘They have demonstrated speed, efficiency, and creativity. We have faced a few unusual issues in the data protection space, and MLGTS has provided creative, smart advice even in the face of uncertainty and novel procedural questions. They have deep expertise, and relationships within the legal community that allow them to understand how opposing parties think, strategise, and react.’

‘Particular credit must be given to Tiago Félix da Costa, for his clarity of communication and excellent management of the team of associates working with us. We had little familiarity with the rules of the Portuguese system, and Tiago has been careful to educate us about what we can expect and what the various pathways ahead might look like, without being patronizing or assuming prior knowledge. Additionally, Tiago’s connections and insight into other parties’ approaches have been exceptional.’

Key clients

NOS Comunicações, S.A.

Banco Comercial Português, S.A.

Modelo Continente Hipermercados, S.A.

Sonae Financial Services (Universo)

Talkdesk, S.A.

Outsystems, S.A.



Oney Bank

Kromann Reumert

Scandinavian Tobacco Group Denmark A/S


Worten – Equipamentos para o Lar, S.A.

Wikimedia Foundation


Work highlights

  • Assisting Sonae Financial Services (Universo) with all data protection issues in the context of the restructuring of its credit operation related to Cartão Universo.
  • Assisting Fidelidade Seguros Group in data protection matters, including GDPR compliance.
  • Assisting NOS with the evaluation of data protection issues and building data protection compliant solutions related to personalised advertising for TV cable users.


Fielding one of the largest dedicated data protection teams in Portugal, VdA has established itself as a leader in data protection, privacy and cybersecurity matters. In addition to its longstanding experience in assisting clients in their digital transformation projects and data protection compliance programmes, the department is often called upon to handle the data protection aspects of M&A and technology transactions, and manage data breach incidents. It is instructed by a range of prestigious companies operating in an array of sectors, including banking, insurance, retail and healthcare. Leading the group is Magda Cocco, whose areas of expertise cover risk management, administrative proceedings and cross-border data transfer agreements. Inês Antas de Barros is another key name in the team, who is routinely involved in GDPR-related issues and multi-jurisdictional mandates; she was promoted to partner in early 2022. Focusing on privacy, cybersecurity and IT, Maria De Lurdes Gonçalves is counsel of choice for Brazilian companies facing challenges related to GDPR and the new Brazilian data protection law.

Practice head(s):

Magda Cocco

Other key lawyers:

Inês Antas de Barros; Maria de Lurdes Gonçalves


‘VdA is a firm with lawyers with enormous technical capacity and business orientation, which helps to identify the real challenges. I feel, as a client, that the competent way in which they provide makes them stand out in the market. Additionally, the support processes they provide allow for an innovative, quick and effective response.’

‘The seniority of the partner Magda Cocco and the associate Inês Antas de Barros continues to impress me very positively, for their experience, resilience and organisational capacity, even in highly complex processes.’

‘In addition to the enormous technical quality, the VdA team demonstrates a knowledge of the practical reality of companies and industry, providing effective and truly useful advice. I count on VdA even for the most difficult and innovative challenges, as I know that they will always have a critical, creative position based on enormous experience and security.’

‘From the team, I would like to highlight two people I turn to whenever I need support in the area of privacy and protection of personal data: Magda Cocco who has enormous knowledge and accumulated experience and Maria de Lurdes Gonçalves. Both seek to respond in a personalised way to the client’s needs, being interested in getting to know the business and the company’s experience.’

‘VdA was a forerunner in the development of an area specialising in privacy and data protection, thus acquiring enormous know-how and practical experience in solving these types of issues in the most diverse business areas.’

‘It is a law firm with a high reputation and credibility, and the Department of Privacy and Personal Data Protection also has the aforementioned qualities. The people on the team are always available, they keep their knowledge of the subject permanently up to date. They stand out in relation to the others for the experience they have, always pioneers in the analysis of the legal perspective of matters related to privacy.’

‘In-depth knowledge of the topic; experience in non-trivial cases of dealing with privacy and data protection; great availability to listen and understand the specific needs of the client; investment in the acquisition of knowledge, knowing that it is an area in constant change; multidisciplinarity, also investing in technological knowledge and not just in legal, considering the particularities of this area.’

‘Magda Cocco leads the team, with extensive knowledge of the matter, availability for dialogue and effective materialisation of solutions to legal problems, considering different angles. Her team, in particular Inês Antas Barros, is also distinguished by its professional excellence.’

Key clients


Altice Group

APS – Associação Portuguesa de Seguradores

Brisa Group

CTT Group


EDP Group

European Space Agency (ESA)


Fresenius Kabi Pharma PT

Fundação Calouste Gulbenkian

Fundação Bancária “La Caixa”

Generg Group

HPA Saúde Group


José de Mello Group

Lusíadas Saúde

Luz Saúde

Sistemas McDonald’s Portugal, Lda.

Sport Lisboa e Benfica Group (SLB)

Transportes Aéreos Portugueses, S.A. (TAP)

VIA Outlets Portugal

Vodafone Portugal

Sonae Sierra S.A.

World Economy Forum

World Bank

Work highlights

  • Advised EDP Group on a data protection impact assessment regarding the implementation of a Covid-19 contingency plan, as well as in the compliance assessment of an integrity due diligence programme.
  • Assisted Feedzai in the assessment of the use of vast personal and non-personal data databases, of its own and of third parties, in the context of an AI-based anti-money laundering and anti-fraud solution.
  • Advised SLB on the implementation of Covid-19 testing procedures, in determining the necessity of appointing a Data Protection Officer and in providing certified training in data protection matters.


DLA Piper ABBC has been particularly busy advising several domestic and multinational companies on the implementation of data protection compliance programmes. João Costa Quinta oversees the department, which also includes data protection and cybersecurity specialist Daniel Reis, who has been increasingly active assisting digital businesses with data breach matters. Vanessa Patrocínio is another noteworthy practitioner; she combines in-depth knowledge of GDPR compliance matters and data breach preventative measures.

Practice head(s):

João Costa Quinta 

Other key lawyers:

Daniel Reis; Vanessa Patrocínio


‘Proactive, practical and innovative at the same time, it anticipates the challenges that the client may face. It supports and monitors as if it were in-house, combining legal assistance with practical day-to-day solutions.’

‘In-depth knowledge and a very pragmatic view of matters relating to the protection of personal data.’

‘We value the expertise of Daniel Reis and also his simplicity in addressing complex matters.’

‘Availability and attention to detail.’

‘Daniel Reis – know how, pragmatist, solutions facilitator, integrated vision between reality and legal obligations/limitations. Vanessa Patrocínio is also recommended.’

‘Daniel Reis is an excellent professional, endowed with high technical knowledge, knowledgeable about the practice and available to the client.’

‘The service provided stands out for its professionalism, availability and flexibility of response. There is good collaboration and prompt response to customer needs.’


PLMJ provides high-level advice to a range of Portuguese and international clients in relation to data protection audits and day-to-day matters involving privacy risks and their implications. Companies operating in the healthcare, technology, insurance, financial and media sectors also turn to the team for assistance with cloud computing issues, international data transfers, data processing agreements, data breaches and litigation. Department head Pedro Lomba is seasoned in regulated sectors undergoing technological transformation. Marta Salgado Areias is also active in the practice, advising clients from the telecoms, insurance, retail and financial sectors in privacy and data protection matters.

Practice head(s):

Pedro Lomba

Other key lawyers:

Marta Salgado Areias


‘Transversal knowledge of the sector and accumulated experience.’

‘Pedro Lomba is recommended.’

Key clients


Minor Hotels

Free Now

National Association of Pharmacies

Clever Leaves







Moongy (ex-HIQ Consulting)

Pernod Ricard


United Investments Portugal

Tabaqueira (Philip Morris International)



Compara já

Work highlights

  • Advised Banco CTT on data protection matters in the context of the partnership with Sonae Financial Services in relation to the Universo card.
  • Assisting Starcampus in the implementation of the innovative hyperscale data centres in Sines.
  • Regularly assisting the fashion and retail company Hennes & Mauritz (H&M) in data protection matters.

SRS Legal

At SRS Legal, the data protection and cybersecurity team undertakes the entire spectrum of matters involving the implementation of GDPR programmes. The team is adept at acting for start-ups and clients from the banking, telecoms, insurance and healthcare sectors in administrative proceedings, data processing agreements and cybersecurity regulatory issues. The highly regarded Luís Neto Galvão, who is a leading figure in data privacy, is the main point of contact in the team.

Practice head(s):

Luís Neto Galvão


‘Close contact and relationship with the client, always with the intention of thinking together with the client about the next step to be taken.’

‘Strong knowledge of data protection and its implication in our business. Practical approach to problem solving.’

‘SRS has a truly differentiating ability in the market to understand the business context of the clients it works with. Combined with its knowledge of privacy and data protection, it is able to provide a high quality and differentiated service, seeking to develop pragmatic solutions for its clients.’

‘Luís Neto Galvão is an expert in this area of expertise, which I have recommended and would continue to recommend to any client.’

Key clients

Santander Consumer

Amorim Group

BT Portugal -Telecomunicações Unipessoal Lda.

Victoria Seguros de Vida, S.A.

Generali – Companhia de Seguros, S.A.

Mitsubishi Electric Europe B.V. – Sucursal em Portugal

Boheringuer Inghleim Portugal

Iqvia Solutions Portugal, Unipessoal Lda.

SAS Apostas Sociais, Jogos e Apostas Online, S.A. (Group Misericórdia de Lisboa)


Sepio Systems



Oxy Capital




Work highlights

  • Successfully represented 360 Imprimir (an online print shop) in an investigation from the Portuguese Data Protection Committee (CNPD) regarding a complaint from a client concerning marketing practices.
  • Conducted an analysis on the use of legitimate interest basis for the processing of personal data on behalf of Santander Consumer.

Abreu Advogados

World-renowned brands, multinational companies and medium-sized national enterprises from a variety of industries seek Abreu Advogados' assistance with data privacy and cybersecurity matters. The team, which comprises IP, IT and media experts, is frequently involved in GDPR compliance matters and cybersecurity risk assessments on behalf of clients in the consumer goods, banking, pharmaceuticals and telecoms sectors. Ricardo Henriques, who has a wealth of experience in emerging technologies and data privacy compliance, manages the practice group.

Practice head(s):

Ricardo Henriques

Other key lawyers:

José Maria Alves Pereira


‘Diversified team capable of responding effectively to issues in the most varied areas of law.’

‘Diversified practice areas and quick understanding of clients’ needs, providing useful and effective work with enormous technical quality and fair fees. I count on Abreu both on a daily basis and for the most demanding challenges, with the certainty that I will have quick and clear answers.’

‘Ricardo Rodrigues and José Maria Alves Pereira are recommended.’

‘Technical capacity, speed.’

Key clients








Federal Express (FedEx)







Thea Laboratoires




Fresenius SE & Co KgaA




Work highlights

  • Assisting Google in the implementation of new features for its products and services.
  • Assisted Porsche in several projects related to its online business and connected car services.
  • Advised FedEx on cross-border data protection agreements pursuant to the integration of TNT.

CCA Law Firm

CCA Law Firm's privacy practice, which comes under the banner of its TMT group, ‘is highly qualified and in permanent contact with new technologies'. Multinational companies instruct the team on a regular basis in relation to day-to-day privacy issues, GDPR compliance projects and processing of personal data. The firm is well known for its strong presence in the Portuguese start-up scene, and for its experience in right-to-be-forgotten cases involving search engines. Martim Bouza Serrano is the name to note for assistance with the implementation of GDPR programmes.

Practice head(s):

Martim Bouza Serrano


‘Young team that is highly qualified and in permanent contact with new technologies. They are so close to the client that it seems they are part of your team.’

‘A team that is technically well prepared, with effective experience in the area; efficient, proactive, and modern approach.’

‘It’s a very dynamic team and full of initiative. They demonstrate mastery of knowledge of new business models and activity sectors in the area of ​​new technologies. The value of its service goes far beyond legal knowledge: it is a team that has an in-depth knowledge of the business in the field of technologies, both at the level of large multinationals and at the startup level.’

‘Martim Bouza Serrano is a lawyer who stands out for his total availability and spirit of collaboration with clients, associating legal knowledge (which becomes evident in the advice he provides) with knowledge of the market, demonstrating total familiarity with new business models, innovative services and technological products.’

‘It stands out for its in-depth knowledge of the best market practices, that is, it goes beyond legal knowledge based on the field of legislation and jurisprudence, enriching its activity with benchmarking that provides its clients with aligned solutions with what is best practiced by other companies in each sector. I highlight Martim Bouza Serrano, for his evident knowledge and experience, allied to his permanent availability.’

Key clients




Havas Group


Vision box


Procter & Gamble

JTI | Japan Tobacco International​



Strong Charon



Eat Tasty

C&A Modas


Work highlights

  • Advised Procter & Gamble Portugal on the implementation of its GDPR compliance project.
  • Assisted Strong Sharon with the drafting of the needed clauses and framework to comply with the GDPR requirements for the transfer of personal data between Portugal and the US.
  • Assisted Special Variable with the implementation of the data flows and personal data consents in relation to a service technological platform (hAPI) that is integrated within the web page of banks and financial institutions.


Data privacy and cybersecurity audits, regulatory compliance and matters involving the processing of personal data are among the typical mandates handled by the privacy and data protection team at CMS. Multinational and start-up companies in the technology, communications, life sciences, retail and banking sectors feature on the team’s diverse client roster. José Luís Arnaut oversees the team, which also advises on data breaches; clients benefit from access to a mobile app (CMS Breach Assistant) which helps them understand the priority steps that should be taken when faced with a breach. João Leitão Figueiredo is praised by clients for being ‘reliable, pragmatic and technically sound on all aspects of data protection work‘.

Practice head(s):

José Luís Arnaut

Other key lawyers:

João Leitão Figueiredo


‘Good legal support, excellent command of the matters dealt with.’

‘Strong team led by João Leitão Figueiredo with a deep understanding of local regulatory concerns and approaches.’

‘João Leitão Figueiredo is reliable, pragmatic and technically sound on all aspects of data protection work.’

‘Availability and quick response.’

‘Experience and holistic view. Capacity and agility in the team’s response; anticipation of problems; pragmatism.’

Key clients























Work highlights

  • Advises on a daily basis all companies of GALP Group on data protection and privacy matters.
  • Advises all companies of BENSAUDE Group on data protection, privacy and compliance matters.
  • Assists all companies of NABEIRO Group (Delta Cafés) with data protection, privacy and compliance matters in Portugal, Spain, France, Luxembourg, Switzerland, Angola and Brazil.


The privacy and data protection service offering at Cuatrecasas was recently bolstered by the arrival of Joana Mota Agostinho and a group of associates from CTSU – Sociedade de Advogados, S.P., R.L., S.A., who bring significant experience in cybersecurity compliance programmes and digital transformation strategies. Other team developments include the promotion of practice leader Sónia Queiróz Vaz, who is skilled in matters pertaining to big data, e-privacy and the implementation of GDPR projects. She manages the group, which is retained by clients in a multitude of industries (including finance, technology, healthcare, telecoms and retail) seeking tailor-made advice on data protection issues involving the use of AI and new digital technologies.

Other key lawyers:

Ana Costa Teixeira


‘Availability, technical knowledge, quick responses, sympathy.’

‘The team reveals a very high degree of experience, agility and resilience, providing complete solutions in a timeframe compatible with the requirements of a multinational organisation in the digital era. The fusion of a quality technical-legal component into effective and pragmatic solutions that are easy to implement by the business proves to be extremely fruitful in mitigating legal risks without disabling management initiatives.’

‘I would highlight Ana Costa Teixeira.’

‘This law firm pays special attention to the Client, both with regard to the response time and the objectivity of the responses in order to resolve the question raised by the Client as best as possible.’

‘We had frequent interactions with Sónia Queiroz Vaz, who is a great professional as she responds with full knowledge of the facts and presents us with the solutions for our decision in complete detail with the respective consequences and degree of risk.’

‘Joana Mota Agostinho – What I most admire is her pragmatism, that is, she is concerned with applying the law, protecting us from possible fines, but never forgetting the business.’

‘Team and department with unique and unrivaled knowledge in the area of privacy in Portugal. They provide multinational legal advice with a unique speed of response and always taking into account the business, a fundamental factor for those in a company.’

‘Being able to count on a partner who knows the business and how the company works and who will provide adequate, fast and accurate advice.’

Key clients

BMW Portugal

BMW Financial Services


SAMSUNG Electrónica Portuguesa





















Work highlights

  • Provides ongoing legal assistance regarding personal data protection and privacy to Outsystems.
  • Advised Banco Inter on implementation of the General Data Protection Regulation (GDPR).
  • Advising BMW FS regularly on all projects related to personal data protection.


Benefiting from its close collaboration with the international data protection and privacy practice group, Garrigues' Lisbon-based team is predominantly engaged by clients in relation to M&A transactions, GDPR compliance programmes and post-breach issues. Tomás Pessanha and Alejandro Padín, who are based in Lisbon and Madrid respectively, jointly manage the group. Isabel Bairrão is the main point of contact in Portugal for privacy compliance audits and cybersecurity issues affecting clients from the technology, banking, pharmaceutical, retail and telecoms sectors, among others. With a special focus on banking and software development, Rute Silva Gomes is a key practitioner for data transfer agreements and compliance matters.


‘The Data Protection team at Guarrigues (Portugal) is a very competent and professional team with excellent expertise in data protection laws. This team is very responsive and always available.’

‘Isabel Bairrão has very good technical skills. She has a great understanding of our needs and expectations.’

‘The team is always on the side of the solution, seeking to ensure that the client can fulfil its objectives. The team is also very dedicated to the execution and delivery of its work, showing enormous availability to accompany clients.’

‘Isabel Bairrão: knowledge, technical capacity, dedication, effort, commitment.’

‘It has always demonstrated a high level of knowledge about privacy and data protection.’

‘Isabel Bairrão has an excellent posture and attitude in defending her clients, especially because of the high knowledge she demonstrates on the topics.’

‘Garrigues’ Data Privacy and Data Protection team have unmatched experience when it comes to determining and implementing the most effective GDPR compliance program, enabling clients to navigate the requirements relating to the life cycle of collection, use, disclosure and sharing of personal data.’

‘Isabel Bairrão is an outstanding experienced and skilled Privacy and Data Protection counsel, providing accurate, clear, pragmatic and business-focused legal advice that can add real value to your business. Isabel Bairrão shows a great depth of knowledge and experience and she is extremely innovative and dedicated. In short, her Privacy and Data Protection practice is a valued asset.’

Key clients



















Work highlights

  • Providing advice to payment processing company SIBS on disruptive projects in the field of online payments and solutions.
  • Providing regular assistance to the Portuguese companies of the Inditex Group in data protection matters.
  • Assisting an airline on the management and notification of a data breach to the Portuguese Data Protection Agency.

Sérvulo & Associados

Sérvulo & Associados is equipped to advise a range of clients on data protection and privacy issues, ranging from GDPR compliance to privacy policies, impact assessments, data share agreements and notifications of breaches. The firm is a popular choice for banking, payment services and insurance clients operating in Portugal, and is also skilled at handling matters involving the retail, automobile and pharmaceutical sectors. The team is under the leadership of João Carmona Dias, José Lobo Moutinho and Ana Rita Paínho, the lattermost of whom is recommended for her ‘deep knowledge not only of data protection but also its application to clients’ business‘.

Other key lawyers:

Inês de Sá


‘The uniqueness of this law firm is based on the simple way they approach legal issues in order to make them easily understood by the client. What distinguishes it from the rest of the market is the proximity, the excellent technical quality, the total availability and the team spirit that they form with the client.’

‘The team includes João Carmona Dias and Inês de Sá. What sets them apart is clearly their technical quality and their ability to communicate clearly and closely and their availability.’

‘Sérvulo has a great team of lawyers specialised in various areas which are necessary to support the daily activities of a company. Servulo has supported our company in an efficient, proactive and pragmatic way, providing great support for a very reasonable fee.’

‘João Carmona Dias is a very experienced lawyer, who is able to explain complex issues in a very clear way, providing pragmatic solutions and always ensuring the client is his priority. He has supported our company in various areas, and his assistance has always been great not only because of his expertise but also because he genuinely cares about the client, he is extremely polite and attentive.’

‘Sérvulo clearly stands out for the attention it pays to every detail of the issues under analysis. They always go beyond the obvious, respond with total diligence and in the required time, have total availability for their clients and are true partners. The quality of service is impeccable.’

I would recommend Ana Rita Paínho. She is decisive and solution oriented. She provides us with quick responses when required, and has deep knowledge of data protection issues.’

‘In the particular process of Privacy and Personal Data Protection, the responsible partner João Carmona Dias is clearly highlighted. Demonstrates in-depth knowledge of the topics covered, analyses the issues from all possible angles. He provides clear, direct advice and conveys tremendous confidence.’

Key clients

EDP Energias de Portugal, S.A.

SenseiData SA

DPD Portugal – Transporte Expresso, S.A.

Porsche Ibérica SL

Grünenthal, S.A.

Teva Group

Verizon Connect Portugal S.A.


Spin, Inc.

Frotcom International

Page Group


Banco BIC Português, S.A.

LG Electronics Portugal, S.A.

Hitachi Consulting Portugal, S.A.

Banco Primus, S.A.

Signify Portugal Unipessoal, Lda.

Ferrero Ibérica, S.A. (Sucursal em Portugal)



Banco Santander Totta, S.A.

Banco Credibom, S.A.

Companhia IBM Portuguesa, S.A.

Work highlights

  • Provided legal assistance to EDP in the negotiation of a cloud agreement for IT infrastructure with AWS.
  • Assisted SenseiData in the rollout of autonomous store projects, including all data privacy matters.
  • Assisting DPD in a global compliance project under the GDPR.