On 10 January 2023, the Portuguese data protection
authority (Comissão Nacional de Proteção de
Dados- "CNPD") approved
Directive/2023/11 ("Directive") on
organisational and security measures. The purpose of this Directive
is to promote awareness among organisations of the importance of
implementing appropriate security policies. It makes it clear that
the significant number of attacks that occurred in 2022 is mostly
due to the lack of investment in this area, which has resulted in
vulnerabilities in infrastructures and a lack of user
training.
According to the CNPD, the majority of the most frequent attacks
affect personal data and result in data breaches that require the
application of the provisions of the General Data Protection
Regulation ("GDPR") - in other words, (i) a risk
analysis and documentation of the incident must be carried out,
and, depending on this analysis, (ii) the CNPD must be
notified within 72 hours (the CNPD stresses that this is
