In Portugal, the protection of privacy and confidentiality is deeply rooted in constitutional, civil, criminal and European legal frameworks. These protections aim to safeguard individuals’ private lives and personal data from unauthorised interference or dissemination.

The right to privacy concerning an individual’s personal life is established in the Portuguese Constitution, which outlines various rights, freedoms and guarantees. This right is closely linked to the Portuguese legal system’s fundamental principle – the human person’s dignity. It rests on the idea that individuals have a right to privacy that encompasses two main aspects: the right to prevent third parties from accessing information about their private and family life and the right to prevent the disclosure of information that others may hold regarding their private life. These principles collectively create a strict prohibition against third parties’ interference in an individual’s private life, whether through accessing or disseminating information. Article 80(1) of the Civil Code states that “everyone must respect the privacy of others’ private life”.

As a member of the EU, Portugal enforces the General Data Protection Regulation (GDPR), which provides robust mechanisms to protect personal data. The Portuguese Penal Code criminalises certain invasions of privacy – including unauthorised recording, dissemination of private communications, and breach of confidentiality – under Articles 190 to 194.

Establishing a case for a violation of privacy or confidentiality in Portugal requires the claimant to demonstrate specific criteria outlined as follows.

• Violation of a protected right – the claimant must show that their right has been infringed.
• Unlawful action – the claimant must prove that the action in question was unlawful.
• Damages – the claimant must demonstrate that the unlawful action caused material or non-material damage.
• Causal link – the claimant must establish a causal connection between the unlawful action and the harm suffered, which is crucial to proving liability on the defendant’s part.

In order to ensure the safeguarding of privacy and confidentiality in alignment with national and European standards, the Portuguese legal framework offers robust legal protections such as compensation for damage, injunctions (courts may issue orders to prevent ongoing or imminent breaches of privacy, such as stopping the publication of sensitive information), criminal sanctions (in which perpetrators may face fines or imprisonment), and also the “right to be forgotten” as recognised under GDPR provision.

The calculation of damages considers the severity of the harm, the extent of reputational damage, and the emotional distress caused to the claimant. While there is no fixed range for financial awards, the compensation typically depends on the facts of the case. Courts aim to balance fairness with proportionality, ensuring that the damages are sufficient to remedy the harm without being punitive; hence the Portuguese courts tend to award damages conservatively compared to other jurisdictions.

The deadlines/limitations depend on the unlawful action that was taken.

The limitation period for filing a defamation claim in Portugal is generally three years from the date the defamatory statement was made or published, as established under Article 498 of the Portuguese Civil Code. If the act constitutes a criminal offence (eg, injúria (insult)or difamação (defamation) under the Portuguese Penal Code), the statute of limitations is usually six months, depending on the nature of the crime, starting from the date the claimant becomes aware of that act.

Defendants in defamation or privacy violation cases can rely on several defences under Portuguese law and European principles. A key defence to defamation is proving that the statements in question are true. If the defendant can demonstrate the factual accuracy of the allegedly defamatory content, the claim may fail, as truth negates the harm to reputation. Also, statements made in the public interest – especially those relating to public figures or matters of political, social or economic significance – may be protected.

In addition, statements made in certain contexts (eg, parliamentary debates, judicial proceedings, or press reports) may be protected under qualified privilege, provided they are not malicious.

Courts must also consider whether the claimant consented or if the facts restricted their freedom of speech in a disproportionate or unnecessary way.

The Portuguese Constitution guarantees freedom of the press and prohibits censorship. The press is entitled to report on matters of public interest, provided it acts responsibly and respects individuals’ rights to privacy and reputation, and journalists and publishers are expected to act in good faith and verify their sources. The courts are required to balance the public interest in disclosure against the harm to reputation.

Portugal provides dual avenues for addressing defamation claims, privacy breaches, or other related reputational harms: civil and criminal law. Each serves distinct purposes and involves different procedural frameworks.

Civil claims are filled by the claimant (or their legal representative) and are primarily designed to compensate the victim for the harm suffered, whether financial, reputational or emotional. Remedies include monetary compensation (damages), the rectification of false information, and court orders (eg, injunctions or removal of content).

Criminal proceedings aim to punish the offender for violating the law, often for acts such as defamation, slander, or breaches of privacy under the Portuguese Penal Code, and must prove the alleged offence beyond a reasonable doubt. Defamation and privacy violations are typically “particular” or “semi-public crimes”, meaning the victim must file a formal complaint with authorities to initiate proceedings.

The main difference is that civil remedies often involve monetary awards, whereas criminal cases may result in penal sanctions.

Under Portuguese law, court proceedings are typically public. However, exceptions exist to safeguard individuals’ privacy, particularly in cases involving sensitive personal matters.

Establishing the necessary grounds for initiating legal action in Portugal requires the demonstration of the following elements:

• the existence of an act of publication or disclosure of false facts;
• jurisdiction and connection to the Portuguese legal framework – for example, the act within Portuguese territory or the harm (reputational or otherwise) occurred in Portugal, even if the publication originated abroad;
• evidence of harm/damage; and
• causal link (connection must be established between the defendant’s actions and the harm suffered).

Costs that are not fully recoverable may be recovered partially. Usually, the losing party pays the other party’s legal costs if the court decides that they should bear them – albeit, the court may also decide that the costs should be shared. Costs related to legal representation are usually not fully recoverable because they often result in only partial recovery of the actual legal expenses incurred.

• If the defendant in a criminal defamation case is acquitted, they are generally not responsible for any legal costs.
• If the victim brings a private prosecution and wins, they may recover court fees and some legal costs from the defendant.

Many professions require confidentiality of information, which is crucial in the legal profession – for example, specific agreements may be established to ensure that the obligations required by confidentiality are not jeopardised.

Portuguese law allows for a certain degree of freedom in creating agreements between parties, particularly concerning privacy and confidentiality protection clauses. For instance, if a worker violates a confidentiality clause in their employment contract by disclosing information regarding the employer’s organisation, production methods, or business, they may be required to compensate the company for the damages caused by their unlawful conduct, even if this occurred after the end of the employment relationship.

A clause – whether of confidentiality or another nature – cannot override “public order”, meaning the set of fundamental principles underlying the legal system that the State and society are substantially interested in upholding, even over private agreements.

A confidentiality clause may be null and void if it is excessively broad or violates the principle of proportionality – for example, by imposing disproportionate restrictions on the worker or unduly limiting their freedom of expression.

Despite the Council of Europe’s recommendation to promote the decriminalisation of defamation in various European countries (Council of Europe, “Decriminalisation of defamation: Council of Europe guidance on proportionality of laws and conformity with human rights”, 13 July 2018), Portuguese criminal law continues to address and penalise crimes against honour, including defamation, libel, and offences against legal entities.

Restrictions on freedom of expression are only permissible if they are provided for by law, correspond to a pressing social need, and respect the principle of proportionality. It is permissible to restrict freedom of expression when necessary to protect, in particular, the reputation and honour of others. However, the line between legitimate restrictions on freedom of expression and those considered excessive and disproportionate is often blurred.

According to the Portuguese Penal Code, anyone who attributes facts to another person – even in the form of suspicion – or makes judgments about them that are offensive to their honour or reputation (or reproduces such imputations or judgments) is subject to imprisonment or a fine.

On the other hand, the Portuguese Civil Code provides protection for personality rights, allowing for civil liability in cases of unlawful offence or threat of offence to an individual’s moral personality.

Anyone who feels their honour and/or reputation has been harmed may turn to the criminal courts by filing a “private accusation”, which is a specific criminal complaint for this type of offence. Alternatively, if opting for the civil action, it is possible to initiate a civil liability lawsuit in the civil courts, requesting compensation for the damages caused.

Additionally, as provided for in the Civil Code and the Civil Procedure Code, one can also resort to preventive or mitigating measures – commonly known as interim measures – tailored to each specific case. Mitigating measures, as the name suggests, aim to eliminate the effects of an ongoing or already materialised offence while also serving as a preventive measure against future harm. These are typically injunctions, meaning they impose or prohibit certain behaviours. Conversely, preventive measures are intended to prevent the materialisation of an offence and counter imminent or ongoing offences.

It is possible to seek compensation for damage caused, whether through a criminal action or a civil lawsuit. Portuguese courts determine the amount of compensation based on the specific circumstances of each case, considering factors such as the severity of the offence, its impact on the victim’s reputation, and the consequences suffered. There is no fixed amount, but compensation generally ranges from EUR1,500 to EUR15,000 – with lower amounts being more commonly awarded.

The general deadline for filing a criminal complaint is six months from the date the offended party became aware of the criminal act and its perpetrators. Regarding civil liability, the right to compensation expires within three years from the date the injured party became aware of their right to claim.

The crime of defamation is inherently connected to the right to freedom of expression and press freedom.

In Portugal, the media frequently face both criminal and civil actions brought by individuals seeking compensation for damage they believe was caused by publications, news reports, or advertisements issued by various Portuguese media. However, Portuguese courts acknowledge in their rulings that the right to honour and the right to freedom of expression have equal constitutional dignity. Therefore, the right to freedom of expression cannot completely override or nullify the right to honour and reputation.

Whether through criminal or civil action, compensation for damage caused by third parties can be obtained. The differences between these two types of actions are primarily related to the legal consequences sought. The main objective of a criminal action is to hold the perpetrator criminally accountable. In addition to obtaining compensation for the damage caused, the perpetrator will be criminally convicted. However, the purpose of a civil action is to repair the damage caused, not to punish the wrongdoer. There will be no criminal penalties in this case and the court will order the defendant to pay financial compensation for the damage.

The two actions can be cumulative, meaning that a criminal complaint can be filed alongside a civil action seeking compensation. The victim may request compensation within the criminal proceedings or, in the event of a conviction, through a civil claim presented later.

The court fees for the complainant are relatively low in criminal proceedings. However, in civil proceedings, the fees can be considerably high, depending on the amount of compensation requested.

In Portugal, the Regulation on Court Fees provides the possibility for the prevailing party to recover the expenses incurred during the judicial process. Therefore, the winning party has the right to claim these expenses from the losing party, provided that the expenses are properly documented and justified.

The European Court of Human Rights (ECtHR) has condemned the Portuguese State for violating freedom of expression from defamation convictions in national courts. Between 2005 and 2015, the ECtHR condemned Portugal 18 times for freedom of expression violations (International Press Institute, “Briefing: Criminal Defamation in Portugal. Report on the IPI Working Visit”, June 2015).

Thus, the ECtHR has reiterated that – while the protection of honour and reputation is legitimate – defamation convictions must be proportional and should not suppress freedom of expression. Courts must carefully assess the balance between protecting the honour and the right to freedom of expression, considering the statements’ context, intent and truthfulness.

As a point of interest, two recent cases in 2024 stand out: Vitor Veiga Cardoso v Portugal and Almeida Arroja v Portugal. In the first case, the ECtHR found the conviction by Portuguese courts to be disproportionate, condemning Portugal to pay a total compensation of EUR18,696.15 for the violation of freedom of expression. In the second case, for the same reasons, the ECtHR condemned the Portuguese State to pay EUR10,000 for non-pecuniary damages.

The crime of harassment is provided for in the Portuguese Penal Code and penalises all repetitive behaviours that involve pursuing or harassing another person by any means – directly or indirectly – causing them fear or distress or impairing their freedom of decision. This crime is punishable by imprisonment for up to three years or a fine unless a more severe penalty applies under another legal provision.

When committed under certain circumstances – namely, through threats, coercion, or against a particularly vulnerable person – the penalty may be increased to imprisonment for one to five years.

In addition to this provision (which requires repetitive conduct), the Portuguese Penal Code also penalises isolated acts that may fall within the broader concept of harassment, which encompasses legal interests such as sexual self-determination, privacy, and the victim’s image.

In criminal matters, in addition to the prison sentence and fine that may be imposed on the defendant, the judge may also prohibit the defendant from contacting or approaching the victim.

In civil matters, the victim may seek compensation for pecuniary damages (eg, medical expenses, loss of earnings) and non-pecuniary (or moral) damages caused by the harassment’s conduct.

Therefore, the amount of compensation depends on the specifics of the case and the severity of the damages caused, making it difficult to assign a precise total value. Inversely, for non-pecuniary damages arising from perpetrated harassment, the case law has awarded compensation amounts ranging between EUR1,000 and EUR12,000.

Harassment is a semi-public offence, meaning that initiating criminal proceedings always depends on a complaint filed by the victim.

Under the Portuguese legal system, there is a six-month statute of limitations for filing such a complaint, after which the suspect can no longer be held criminally liable for those acts.

It is important to highlight that, as the repetitive nature of the conduct is one of the elements required to constitute this type of offence, the date of the last act committed is the relevant moment for calculating the six-month period.

Regarding civil proceedings, through an action for liability arising from unlawful acts, the statute of limitations for the right to compensation is three years, counted from the date the injured party became aware of the right to which they are entitled.

The acts constituting the offence of harassment are also capable of giving rise to civil liability for unlawful acts, particularly for violations of legal provisions aimed at protecting personal rights, thus allowing for civil proceedings.

Under criminal procedural rules, the principle of adhesion applies, whereby civil proceedings are ruled in criminal proceedings. However, this principle may be set aside in certain circumstances. In civil proceedings, with regard to compensation for pecuniary and non-pecuniary damage caused by unlawful conduct, it is desirable for the unlawful acts to be adjudicated simultaneously – thereby determining the obligation to compensate the victim through the defendant’s criminal liability.

Portuguese law generally adheres to the principle of public trials regarding anonymity or privacy of proceedings. However, under exceptional circumstances, such as when the matter involves sensitive personal data, the dignity of the victim, or issues of public order, the court may determine (upon request by the defendant or the assistant) that proceedings be conducted in private or that public access to case documents be restricted. This is particularly relevant in harassment cases involving vulnerable parties or minors.

Generally speaking, both claimants and defendants can recover legal costs in criminal and civil proceedings. The losing party is typically required to pay the court costs incurred by the winning party and also a portion of the winning party’s attorney’s fees (full recovery of attorney’s fees is highly uncommon). However, if the case is only partially successful, the court may apportion costs between both parties.

The top five sources of information are Agência Lusa, the newspapers Público, Expresso, and Correio da Manhã, and the main TV station (SIC, TVI/CNN, and RTP).

There is a tendency to maintain respect for privacy at the minimum required levels. Generally, the right to privacy of a public figure will be more limited due to the public interest in information. An anonymous citizen will, in principle, see their privacy more safeguarded.

Journalists’ activities are governed by strict ethical and deontological duties, including professional independence and integrity. However, in practice, some principles are being increasingly degraded with the proliferation of biased news and the mixing of factual reporting with opinion.

There is a certain loss of objectivity.

Beyond the abundant legislation of the European Parliament and the Council that regulates social communication services, digital services in the EU single market, and various aspects of social and audiovisual communication, Portugal also has domestic legislation on the protection of rights relating to the personality, such as:

• the right to image (the Civil Code);
• the right to name (the Civil Code);
• the right to privacy in intimate life (the Civil Code);
• the protection of honour (the Penal Code); and
• the rights of reply and rectification regarding misleading or inaccurate information (the Portuguese Republic Constitution and the Press Law and the Television and On-Demand Audiovisual Services Law).

There is often a conflict between a citizen’s right to preserve their good name, honour, reputation and image and the freedom of expression and of the press. Court decisions are very disparate, reflecting the existence of this large grey area.

In successive judgments, the ECtHR has ruled that “freedom of expression constitutes one of the essential foundations of a democratic society, one of the basic conditions for its progress and the development of every person”. The right to freedom of expression is considered valid even when it concerns ideas or information that offend, shock or disturb. Therefore, exceptions to freedom of expression are few and only applicable when an imperative social need is at stake.

In addition to resorting to civil and criminal courts, citizens can, in certain cases, assert specific rights before the Portuguese Regulatory Entity for the Media (Entidade Reguladora para a Comunicacao social, or ERC), which supervises, in particular, news agencies and radio and television operators regarding the programmes they broadcast or the content they provide by any means (including electronically).

Any interested party may lodge a complaint with the ERC regarding behaviour that may violate rights, freedoms, guarantees, or any legal or regulatory rules applicable to media activities. Meanwhile, the ERC can call on operators to comply with informational accuracy and safeguard the right to information.

As part of the EU’s ongoing efforts to tackle online disinformation, the EC has introduced a range of policy measures to increase the responsibility of online platforms.

The establishment of the Code of Practice on Disinformation (created in 2018 and strengthened in 2022) and the Digital Services Act (DSA) aimed to ensure that online platforms take proactive measures to combat the spread of false or misleading information, ensuring a safer and more reliable digital environment for all.

The Portuguese National Communications Authority (Autoridade Nacional de Comunicações, or ANACOM) is the competent authority and coordinator of digital services in Portugal. It exercises broad functions that include developing national tools and guidelines regarding the complaint and redress mechanisms applicable in Portugal.

In situations where a particular measure or legal action is deemed to have been triggered by a request made with abuse of rights or in bad faith (malicious intent or gross negligence), the applicant may be sanctioned by the court to which the request is addressed. Being condemned as a vexatious litigant generally involves the payment of a fine and compensation. The aim is to combat the degradation of procedural standards and to enforce fair and good-faith litigation.

In Portugal, freedom of expression and information is enshrined in the Portuguese Constitution.

The Portuguese State is a signatory to conventions that guarantee certain conditions for the recognition and enforcement of foreign decisions, whether in matters concerning the exercise of freedom of expression or in other areas of civil, commercial or criminal law.

The recognition of foreign decisions in Portugal is not automatic. It follows the rules set out in national legislation, which the competent court applies to recognise the foreign decision.

The fundamental bases of the right to personal data protection are found in the EU’s Charter of Fundamental Rights.

The connection between the right to personal data protection and the right to privacy has often been used by the ECthR to protect the legal sphere of data subjects, invoking the ECHR, which states that“everyone has the right to respect for his private and family life, his home and his correspondence”.

The Portuguese Constitution grants personal data holders fundamental rights and establishes the essential foundations of the right to personal data protection, which are further developed in the applicable legislation.

Although there are other laws on data protection, the GDPR is the main instrument of the rule of law in Portugal. It applies to the processing of personal data of residents of the EU and aims to promote the freedom, security and well-being of citizens. It is a mandatory regulation that offers citizens a set of rights over their personal data that can be exercised by (or through) the companies that process and store it. Consequently, on the company side, it implies a set of technical and organisational measures to guarantee compliance with citizens’ rights.

Various remedies and regulatory sanctions can be applied at the administrative and judicial levels. Failure to comply with the legal norms can lead to penalties from the supervisory authorities – namely, reprimands, suspension of data processing, and/or compensation to data subjects for moral damage.

The GDPR dedicates Chapter VIII to legal remedies, liability and sanctions – not establishing specific measures but rather measures based on levels. In order to ensure their effectiveness, the measures must be effective, proportionate and dissuasive. Each penalty must take into account the following elements:

• the nature, gravity and duration of the breach;
• the actions taken to minimise the damage caused;
• the degree of responsibility involved;
• the means by which the breach came to the knowledge of the supervisory authority;
• compliance with the measures imposed on the data controller or processor; and
• adherence to a code of conduct or any other factors that may aggravate the situation.

Violations of obligations (eg, reporting a breach, notification obligations, co-operation with authorities) are considered the least serious breaches and financial awards can amount to up to EUR10 million or 2% of annual worldwide turnover. Conversely, rights violations are the most serious breaches (including duties towards data subjects, consent rules, and international data transfers) and financial awards can exceed EUR20 million or 4% of annual worldwide turnover.

As mentioned in 5.2 Data Protection Remedies, any person who has suffered harm due to the unlawful processing of data or any other act that violates the provisions of the GDPR or national law on the protection of personal data is entitled to obtain compensation from the controller or processor for the harm suffered.

The deadline to initiate legal action based on a GDPR violation for civil liability is three years. This period starts from the moment the data subject becomes aware of the violation or the damage caused and applies, for example, if the data subject feels they have been harmed due to the illegal processing of their personal data.

In criminal proceedings, there is a six-month limitation period for filing a complaint, and the date of the last act committed is the relevant date for calculating the time limit. However, the company must notify the supervisory authority without undue delay within 72 hours of becoming aware of the violation. If the deadline is not met, the reasons for the delay must be presented. In the event of a high-risk personal data breach, the controller is responsible for notifying the affected data subjects. If a subcontractor is involved, they will have to notify the controller of all data breaches after becoming aware of this.

The GDPR establishes the right to lodge a complaint with the supervisory authority without preventing the use of any other administrative or judicial remedy. Therefore, it is possible to resort to administrative means, such as complaints or hierarchical appeals, when the act in question was carried out under administrative law and the supervisory authority is not the entity competent to deal with complaints regarding data protection and possible violations of the GDPR.

In addition to these possibilities, the GDPR also establishes the right to take legal action against binding decisions by the supervisory authority. The right to take legal action against a supervisory authority does not preclude the right to resort to administrative channels or to out-of-court dispute resolution, nor is it prejudiced by the fact that these have been used.

The data subject can take civil action to obtain compensation for material and moral damages resulting from violating personal data.

If the matter involves a criminal offence, criminal proceedings may be initiated. In this case, the principle of adhesion applies, which allows civil proceedings to be integrated into criminal proceedings. This makes it possible for the unlawful facts to be assessed jointly, determining the victim’s compensation through the defendant’s criminal liability.

The rule regarding the privacy of proceedings is that trials are public – although in exceptional cases, such as when sensitive data or the dignity of the victim is involved, the court may decide to conduct the proceedings in secret or restrict access to documents, especially when vulnerable people or minors are involved.

With regard to jurisdiction, actions against supervisory authorities must be brought in the courts of the respective member states. If the action is against a controller or a processor, the jurisdiction shall generally lie with the courts:

• of the member state where they are established; or
• of the member state where the data subject is habitually resident (unless the controller is a public authority exercising its powers).

In Portugal, the matter of legal costs is set out in the Procedural Costs Regulation, which refers to the Code of Civil Procedure and the Codesof Criminal Procedure.

As a rule, the losing party – whether claimant or defendant – is responsible for paying the costs at the end of the process. If the case is only partially resolved in favour of either party, the court may allocate the costs between them.

In addition, in some cases, there may be an exemption or reduction in legal costs – especially if the party involved is an individual person in a situation of economic deprivation – but this all depends on the court’s analysis.