Data privacy and data protection in Portugal


VdA maintains its leading position in the market, showcasing longstanding expertise in privacy, data protection and cybersecurity matters. The sizeable department stands out for its wide-ranging sectoral knowledge, leading advice to key players from the banking, pharmaceutical, insurance, retail and energy sectors in Portugal and abroad. The firm's capabilities not only cover data protection impact assessments, but also include assistance in the context of M&A and technology transactions with data protection implications, as well as risk management in relation to cyber attacks and data breaches. As a response to the increasing number of cyber incidents, the firm developed a new product, Cybersecurity Tools, to help clients establish clear strategies, capable of preventing and reacting to attacks. Furthermore, practitioners excel in domestic and cross-border implementation of projects involving AI, blockchain and Internet of Things (IoT) issues. Practice head Magda Cocco, who is an established authority in the field, receives key support from Inês Antas de Barros and Maria de Lurdes Gonçalves, who 'stand out for their technical skills and availability'.

Practice head(s):

Magda Cocco

Other key lawyers:

Inês Antas de Barros; Maria de Lurdes Gonçalves


‘The technical knowledge and expertise of the Privacy & Data Protection team is outstanding. One can always be sure to be provided with the best practices as the team dominates the arena. With extensive expertise in the privacy and data protection fields and proven experience in the implementation of new legal frameworks, VdA has managed to consistently meet and sometimes exceed clients’ expectations.’

‘The VdA team stands out for its very practical approach. The team fully understands the business and therefore can anticipate potential problems related to privacy in the healthcare sector, which translates into a proactive approach, instead of a reactive response. This type of counselling saves time and money, and also helps to promote awareness within the organization.’

‘What absolutely provides a unique characteristic to this team is the experience they have. VdA has been working in data privacy and data protection for 15+ years and that shows. They are not only executors but they know how regulators handle and have handled subjects in the past. The team is used to innovative solutions and thinking which leads to better solutions in a time frame that is adequate.’

‘Practice head Magda Cocco is an extraordinary lawyer with a tremendous ability to understand clients.’

‘Very strong know-how is the main characteristic of this practice. They have a very strong positive and business attitude, trying to find the best possible business solution within the constraints of the law ’

‘Their knowledge is a very important asset. They can run with the ball when needed, letting the client stay back for a more strategic, negotiating position. I appreciate this in the team.’

‘VdA is extremely competent, with solid knowledge in laws, namely in data privacy and data protection laws and regulations. The team is reliable and responsible, and always meets deadlines. Transparency is key.’

‘The team is business-driven and always up to date with the most recent legislation, cases, recommendations (not only on local jurisdiction but in relation to a pan-European market). Lawyers are extremely professional and provide swift responses.’

Key clients


Altice Group

APS – Associação Portuguesa de Seguradores

Brisa Group

CTT Group

EDP Group

European Space Agency (ESA)

Fundação Calouste Gulbenkian

Fundação Bancária “La Caixa”

Generg Group

HPA Saúde Group


José de Mello Group

José de Mello Saúde (CUF)

Lusíadas Saúde

Luz Saúde

MantaOperations Unipessoal, Lda.

Sport Lisboa e Benfica Group (SLB)

Transportes Aéreos Portugueses, S.A. (TAP)

VIA Outlets Portugal

Wizink Bank, S.A.

Sonae Sierra S.A.

World Economy Forum

World Bank

Work highlights

  • Advised AGEAS Group (a major provider of insurance products) in the evaluation and implementation of a tele-medicine services platform within its MÉDIS app during the Covid-19 pandemic.
  • Advising Instituto Gulbenkian de Ciência (IGC), a research institute (part of Fundação Calouste Gulbenkian) devoted to biological and biomedical research, on the provision of services to several hospitals in Portugal regarding the testing of human samples for exposure and infection by Covid-19.
  • Actively providing legal advice to World Economic Forum in the contract for collaboration (C4DC) project and similar data sharing initiatives.


DLA Piper ABBC's data protection service offering was recently bolstered by the arrival of leading practitioner Daniel Reis, reinforcing the firm's expertise in data protection, cybersecurity and technology-related matters. Offering advice to a range of domestic and international clients, the group balances a busy workload, with a significant proportion of its mandates involving GDPR preparation, audits and data breaches. João Costa Quinta has a strong background in the technology and communications sectors, having also led advice to innovative start-ups in the country.

Practice head(s):

João Costa Quinta

Other key lawyers:

Daniel Reis; Vanessa Patrocínio

Key clients

Visteon Portuguesa

AC Nielsen


Work highlights

  • Providing legal advice and assistance on a regular basis to Visteon Portuguesa in relation to privacy and data protection legal requirements in order to comply with General Data Protection Regulation and remaining data protection law.
  • Advising AC Nielsen on privacy and data protection legal requirements in order to comply with General Data Protection Regulation and data protection laws.
  • Assisting Marktest in privacy and data protection matters on a regular basis, notably by analysing complex data flows, performing privacy impact assessments, drafting policies and procedures to ensure compliance with GDPR and applicable data protection laws.

Morais Leitão, Galvão Teles, Soares da Silva & Associados

Morais Leitão, Galvão Teles, Soares da Silva & Associados is regularly engaged by leading domestic corporations from a variety of sectors, such as financial services, telecoms, retail and insurance. Offering cross-practice services, the team benefits from lawyers' strong credentials in dispute resolution. Therefore, the group demonstrates strong risk assessment capabilities and is well equipped to advise throughout the entire life-cycle of data protection matters, including compliance and litigation. Leading the practice is litigator Tiago Félix da Costa, who is noted for his 'indisputable legal knowledge'. Helena Tapp Barroso is a key contact for data protection matters pertaining to the insurance sector. Another noted practitioner is Maria Assunção da Cunha Reis, who is an active member of the team.

Practice head(s):

Tiago Félix da Costa

Other key lawyers:

Helena Tapp Barroso; Maria Assunção da Cunha Reis; Marta Salgado Areias


‘The team shows a rock-solid knowledge of the law, guidelines, and non-binding recommendations to be able to provide in-house lawyers with a complete analysis of the subject matters at stake. More importantly, the team thinks ahead and it is very strategic. The assessment of risk is responsible and adapted to the client’s practical needs. The way to convey their messages is clear, practical and simple – they easily adapt to each internal stakeholder, with all sorts of backgrounds, this way enhancing engagement between internal teams.’

‘Technical knowledge, availability, excellent understanding of the market.’

‘Helena Tapp Barroso is knowledgeable and focuses on the client.’

‘Tiago Félix da Costa and Maria Assunção Reis have the ability to understand, listen and brainstorm, define personalised strategies, which is indispensable in this very new and innovative area.’

Work highlights

  • Assisting Kromann Reumert with the legalisation of data processing and cross-border data transfer between Portugal and Denmark.
  • Assisting SAG Group in creating and executing a GDPR compliance programme.
  • Advising Modelo Continente on the review of the privacy policy and terms and conditions applicable to Cartão Continente.


In data protection, PLMJ provides legal support on an ongoing basis to key clients, and demonstrates an ability to assist with comprehensive audits, as well as litigation. The team has seen recent growth in work for international players entering the Portuguese market, and in cross-border data privacy projects. The team is under the leadership of Pedro Lomba, who is experienced at acting for clients from regulated sectors, including transport, healthcare and media. Jorge Silva Martins is no longer at the firm.

Practice head(s):

Pedro Lomba

Other key lawyers:

Maria João Faísca


‘Extensive experience in the sector of privacy and protection of personal data, practical and pragmatic approach in monitoring the activity of its customers. Investment in knowledge, particularly in the context of the introduction of legislative changes and the publication of case law with relevance for the sector. Interdisciplinarity in critical areas of adjacent practice, namely regulatory. Rigor and innovation in the proposed solutions. Availability and response time well above average.’

‘Pedro Lomba is a brilliant lawyer, who knows exactly what the client needs. He is not only providing high-class legal services but can also see the problem as a business case that requires appropriate steps to take. Thus, Pedro’s approach of thinking outside the box helps the client succeed but be sure that the situation is handled professionally from a legal perspective at the same time.’

The speed of the responses and the technical quality are its most striking elements.’

‘Pedro Lomba combines traditional legal experience with knowledge of new and constantly evolving areas of law.’

Key clients



Minor Hotels

Hotel Urbano



Groupe SEB



Free Now

National Association of Pharmacies

Clever Leaves




HIQ Consulting


Empire Puzzle


Fresenius Kabi


ADENE – Agência para a Energia



Work highlights

  • Providing continuous data protection assistance to IKEA.
  • Provided legal advice to My taxi / Free Now on the data protection issues involving the migration flows of drivers and customers in the context of the merger between Kapten and My taxi.
  • Assisting global cannabis company Clever Leaves in preparing and reviewing its security policy, privacy statements and notices, data protection policy, data protection clauses in employment contracts, processing of biometric data, cross-border data protection and joint control agreements.

SRS Advogados

The data protection and cybersecurity practice at SRS Advogados works in close collaboration with other departments within the firm, including litigation, labour law and life sciences to advise on the entire array of data protection matters, including GDPR compliance and contentious issues. The team has particular experience in assisting start-ups in relation to the data protection legal framework. Luís Neto Galvão, who receives instructions from high-profile clients from the financial services, healthcare and telecoms sectors, is an expert in the field of personal data protection.

Practice head(s):

Luís Neto Galvão

Other key lawyers:

Maria Iordanova


This law firm provides full-service advice of excellence, oriented to the needs of clients in all business areas. Innovation is another characteristic of this law firm.’

‘Luís Neto Galvão possesses deep specialised knowledge. His availability, access to good sources of information and legislation and reputation among peers also deserve to be highlighted.’

Key clients

Santander Consumer

Amorim Group

BT Portugal -Telecomunicações Unipessoal Lda.

Repsol Portuguesa, S.A.

Victoria Seguros de Vida, S.A.

Generali – Companhia de Seguros, S.A.

Banco do Brasil AG – Sucursal em Portugal

Mitsubishi Electric Europe B.V. – Sucursal em Portugal

Boheringuer Inghleim Portugal

Montepio Crédito – Instituição Financeira de Crédito, S.A.

Iqvia Solutions Portugal, Unipessoal Lda.

SAS Apostas Sociais, Jogos e Apostas Online, S.A. (Group Misericórdia de Lisboa)

Tui Viagens

Sepio Systems


Europ Assistance

Oxy Capital




Work highlights

  • Advising Generali on the drafting and negotiation of a joint controller agreement in order to allow Generali and Seguradoras Unidas teams to work in common files and access personal data in the period before their merger.
  • Assisted Santander Consumer with a review and implementation of a large number of privacy impact assessments covering all sensitive data processing activities of the bank.
  • Advising Mediceus with regards to the legal and regulatory implications of its very ambitious project of an app that will collect and store health data of patients of hospitals and allow access to medical exams and diagnosis.

Abreu Advogados

Bringing together intellectual property and IT law experts, the data protection and cybersecurity group at Abreu Advogados is adept at assisting with GDPR compliance projects, privacy issues pertaining to human resources, cyber incidents as well as data transfers. Multinational companies and medium-sized domestic enterprises from the consumer, banking, healthcare, and telecoms sectors routinely seek the team's advice on a range of privacy issues. Ricardo Henriques has been involved in the design and implementation of numerous GDPR compliance programmes and stands out for his expertise in technology-related matters.

Practice head(s):

Ricardo Henriques

Other key lawyers:

José Maria Alves Pereira; João Vares Luís


‘This law firm has several good lawyers in their areas, in which I highlight data protection and intellectual property expert Ricardo Henriques.’

Key clients




Federal Express and TNT







Thea Laboratoires




Fresenius SE & Co KgaA





Chupa Chups, S.A.U

Credit Suisse


Synlab Health

Work highlights

  • Assisted SEAT with the implementation of a GDPR compliance programme.
  • Advised Porsche on several projects related to its online business and connected car services, including data protection issues.
  • Provided assistance to Federal Express and TNT in relation to cross-border data protection agreements.

CCA Law Firm

CCA Law Firm fields a dedicated data protection team whose experience in the field dates back almost twenty years. The practice, which has been actively supporting several companies in the implementation of GDPR, is skilled at advising on the processing of personal data in the context of human resources issues or in relation to new technology and the telecoms sector. Its track record in the data protection and privacy sphere also features right to be forgotten cases involving search engines. Martim Bouza Serrano focuses on matters pertaining to privacy, internet issues and freedom of information.

Practice head(s):

Martim Bouza Serrano

Other key lawyers:

Ana Rocha


‘CCA Law Firm is extremely responsive in communications, as well as capable of facing a heavy workload without losing quality. We love their practical approach to legal issues, always finding an efficient way to solve problems while optimising time and resources. They have shown a creative point of view for all cases and provided original solutions that most of the time ended with a successful result.’

‘Martim Bouza Serrano is a very solid litigator, with extensive experience in privacy, data protection or intermediary liability.’

‘CCA has a very pragmatic and fast-paced way of working, which makes it a firm of choice for matters that involve some level of complexity and expertise in this area.’

‘Martim Bouza Serrano is an exceptional lawyer who stands out for his knowledge of the market, and pragmatism of the solutions he presents.’

‘The main feature that sets this law firm apart from others is its in-depth knowledge of the business and its curiosity to know in detail the internal processes of its clients’ businesses.’

Key clients




Havas worldwide


Vision box





Work highlights

  • Represented Google in a case before the Portuguese Data Protection Authority, as well as before administrative and civil courts.
  • Advised Sephora on daily privacy matters related to the specificities of a retailer, including issues related to direct marketing, client loyalty cards and campaigns, and the use of images on their online portals.
  • Assisted C&A with drafting and implementing a process so that, during the Covid-19 crisis workers and providers that entered C&A’s building were scanned for temperature.


The privacy and data protection team at CMS acts for a varied client roster of companies operating in highly regulated sectors, notably technology, healthcare and financial services. The firm's service offering covers GDPR compliance, data breaches, online tracking, as well as use of cookies and data transfers. Clients benefit from firm-wide innovative tools, including an international 24/7 cyber breach response service and mobile app CMS Breach Assistant. Names to note include practice head José Luís Arnaut and João Leitão Figueiredo, who are both proficient in personal data and privacy protection.

Practice head(s):

José Luís Arnaut

Other key lawyers:

João Leitão Figueiredo


‘CMS reveals a degree of maturity and a perception of the national market in the field of data protection that is well above average. João Figueiredo is recommended.’

‘I would like to highlight their availability to resolve issues and the practical advice.’

‘Strong team focus with specialists in the field and experience to back it up. Excellent presentation skills and explanation of the law is always done within the commercial context of the business.’

‘I consider CMS’s main qualities to be the promptness and quality of the services provided. The experience of the partners combined with the youth of the associates guarantees the expected legal security while keeping abreast of all news.’

‘João Figueiredo, stands out for his excellence; he is one of the most competent lawyers in Portugal in this area.’

Key clients

Vinci Goup



Essilor Goup

DaVita Group

Angelini Group

Nabeiro Group

Bensaude Group

BEL Group

Prosegur Group

Douglas Group

NAV Portugal

EDP Group

GALP Group

ANA Aeroportos




Millennium bcp

Viveiros Monterosa

Associação Alzheimer Portugal


Work highlights

  • Advises on a daily basis all companies of GALP Group on data protection and privacy matters.
  • Advises all companies of BENSAUDE Group on data protection and privacy, and compliance matters.
  • Assisted Davidson Kempner European Partners LLP in the structure of the transaction pertaining to the acquisition of an NPL portfolio and related exposures; advice included regulatory compliance concerning data protection and banking confidentiality regulation.


Cuatrecasas acts for clients operating in a diverse range of sectors, including technology, banking, retail, healthcare and electronics, in data protection and privacy matters. Recently, the team has been kept busy with work pertaining to privacy and data protection issues surrounding the use of AI and new digital technologies, such as tele-medicine and contact tracing in the context of the Covid-19 pandemic. Big data, e-privacy and disruptive technology are core areas of expertise for Sónia Queiróz Vaz. The department was further strengthened by the arrival of Joana Mota Agostinho and a team from CTSU - Sociedade de Advogados, S.P., R.L., S.A. in March 2021.

Practice head(s):

Sónia Queiróz Vaz

Other key lawyers:

Nicole Fortunato; Ana Costa Teixeira; Joana Mota Agostinho


‘Knowledge, professionalism, empathy, availability. Sónia Queirós Vaz and Ana Costa Teixeira are recommended.’

‘Sónia Queiroz Vaz stands out for the quality of advice, clarity in the information provided and proximity to the client.’

The Cuatrecasas Privacy team demonstrates an enormous technical knowledge about the matters, turning them into the best and most practical advice while taking into account the daily life of the companies. The best lawyers are those who manage to have a solid legal base in order to be able to respond quickly and adapt to the particular needs of their clients. Cuatrecasas does it in the best way.’

‘Sónia Queiróz Vaz demonstrates unique knowledge of issues related to privacy and data protection. She is canny, thinks on her feet and is extremely competent in the way she conveys her messages, taking into account the different stakeholders (legal and non-legal).’

‘It is a specialised team with a great sense of urgency and dedication to the customer.’

Key clients

BMW Portugal

BMW Financial Services

SAMSUNG Electrónica Portuguesa











Work highlights

  • Providing ongoing legal assistance to Outsystems regarding personal data protection and privacy, specifically regarding the relationship with external contractors.
  • Advising BMW Portugal and BMW Financial Services  on all projects related to data privacy and personal data protection.
  • Legal assistance to the 13 companies which won the “Digital Solutions Covid-19” financing granted by the Gulbenkian Foundation for the development of Covid-19 related digital solutions.


Working in close collaboration with the Madrid-based international data protection and privacy group, Garrigues' team in Lisbon offers advice in relation to transactions involving data assets and issues, GDPR compliance programmes, as well as big data strategies and cyber incidents. Principal associate Isabel Bairrão is responsible for co-ordinating the data protection team; she has acted for several multinational clients from the banking, telecoms, retail and pharmaceutical sectors. Other key practitioners include Rute Silva Gomes, who has in-depth knowledge of data controllers and data processors.

Practice head(s):

Tomás Pessanha; Alejandro Padin

Other key lawyers:

Isabel Bairrão; Rute Silva Gomes


‘Isabel Bairrão is an expert in this field. The quality of the service is very good, due to its pragmatism and objectivity.’

I understand that Garrigues has an excellent department in this area, generating a lot of confidence in the proper handling of matters.’

‘Isabel Bairrão is an excellent professional, revealing a deep degree of knowledge and an immediate availability to respond to new requests.’

All members, without exception, of the team dedicated to our company are excellent professionals in the field. They are genuinely dedicated to the client, friendly, accessible, and available. Rute Silva Gomes and Isabel Bairrão are recommended.’

Key clients



























Work highlights

  • Providing legal advice to Samsung on several aspects of compliance with GDPR and local law in Portugal.
  • Advising the Portuguese branch of Sabadell, one of the largest banking institutions in Spain, in the review of its personal data processing activities in accordance with applicable data protection and privacy law.
  • Assisting Swedish Orphan Biovitrum (SOBI) with data protection issues related to the processing of health data within the scope of pharmacovigilance obligations.

Sérvulo & Associados

Sérvulo & Associados is the counsel of choice for numerous companies in the field of data privacy and GDPR compliance. The department has a wealth of experience in assisting clients from the pharmaceutical, advertising and communication industries, which seek advice in relation to data protection impact assessments, privacy policies and data breaches. Ana Rita Paínho, who has a strong background in data protection, oversees the practice, which also includes José Lobo Moutinho and litigator João Carmona Dias.

Practice head(s):

José Lobo Moutinho; Ana Rita Paínho; João Carmona Dias

Other key lawyers:

Inês de Sá


Full service partnership with reputable lawyers and easy relationship with the client, ensuring a very easy articulation of the issues.’

‘João Carmona Dias is a GDPR specialist and proposes innovative solutions, always focused on the client’s interest.’

‘High quality team that is very responsive. It provides clear advice and practical solutions that really support the client’s business. ’

‘I would like to highlight João Carmona Dias: he is very competent, and always aware, from a legal point of view, of topics related to privacy and personal data.’

‘They are totally dedicated to the client, available 24/7.’

‘Inês de Sá has transformed the general multinational protocols of my company in privacy matters into real enforceable local activities in Portugal.’

‘I would recommend Dr. João Carmona Dias for his high level of commitment to all the causes he embraces. He is a person endowed with above-average legal technical knowledge, always showing availability, commitment and professionalism.’

Key clients

Grünenthal, S.A.

Grünenthal Denmark ApS

Teva Group

Inosat Portugal (Verizon Group)

John Deere

Fuel Card Service Internacional, Lda

Page Group


EDP, Energias de Portugal, S.A.

Banco Santander Totta, S.A.

Banco BIC Português, S.A.

LG Electronics Portugal, S.A.

Hitachi Consulting Portugal, S.A.

Banco Primus, S.A.

Banco Credibom, S.A.

Signify Portugal, Lda.

Ferrero Ibérica, S.A.

Companhia IBM Portuguesa, S.A.

Work highlights

  • Assisting Grünenthal SA, which is part of the part of the German pharmaceutical group Grunenthal GmbH, in matters pertaining to the compliance with GDPR and local legislation.
  • Providing advice to Teva Group on all data protection matters of the company.
  • Assisted Nespresso in several data protection queries, including matters concerning cookies management compliance and marketing activities related to it.