Your GDPR rights in Portugal: access, deletion and complaints

In short: If an organisation holds data about you in Portugal, the RGPD/GDPR (Regulation (EU) 2016/679) gives you concrete rights — to see your data (art. 15), correct it (art. 16), delete it (art. 17), move it (art. 20) and object to its use (art. 21). You exercise them by writing to the organisation, which must normally answer within one month and for free. If it refuses or ignores you, you can complain to Portugal's regulator, the CNPD, under article 77 and Lei n.º 58/2019. CourtStairs answers Portuguese and EU data-protection questions like these in plain language, with citations to EUR-Lex and the Diário da República you can check yourself.

Data-protection law in Portugal is EU law applied nationally. The rights come from the GDPR, which is directly applicable in every Member State, while Lei n.º 58/2019, de 8 de agosto fills in the national details and names the Comissão Nacional de Proteção de Dados (CNPD) as the supervisory authority. This post explains what each right does, how to use it, and how to complain — in plain English, for expats, foreigners and Portuguese readers who search in English.

What GDPR rights do I have in Portugal?

You have seven core rights under the RGPD/GDPR: access, rectification, erasure, restriction, portability, objection and protection from purely automated decisions (arts. 15–22). They apply to any organisation that decides why and how your data is processed — the controller (responsável pelo tratamento). None is unlimited; each has conditions and exceptions written into the article.

Two of these are near-absolute in practice. Objection to direct marketing (art. 21(3)) must be honoured with no exceptions — once you say stop, they stop. And a request for access cannot be met with a blanket refusal; the controller must either comply or justify a specific, lawful ground for not doing so.

How do I exercise a GDPR right in Portugal?

Send the organisation a clear written request naming the right you want to use — no lawyer, no form and no reason required (except where a right itself requires one). Email to the address in its privacy policy is enough, and it must answer within one month.

1. Find the right channelUse the contact in the organisation's privacy policy — often a data-protection officer (encarregado de proteção de dados / DPO) or a dedicated email.
2. Put it in writing and name the rightSay plainly what you want ("I request access to my personal data under art. 15 GDPR"). Email is fine; keep proof of sending.
3. Prove who you areThe controller may ask for reasonable identification before disclosing data, to avoid handing your data to someone else (art. 12(6)).
4. Wait up to one monthIt must respond within one month (art. 12(3)), extendable by two months for complex requests if it tells you why in time.
5. Escalate if neededNo reply, a refusal you disagree with, or a fee for a simple request? Complain to the CNPD (art. 77).

Can I force a company in Portugal to delete my data?

Sometimes, but not always. The right to erasure (art. 17) is real but conditional: a company can lawfully keep data the law requires it to retain — such as tax or employment records — or that it needs to defend a legal claim. The two rights people most want — delete my data and stop using it — are also the two most often misunderstood.

The right to erasure (art. 17) applies in defined situations: the data is no longer necessary, you withdraw the consent it relied on, you object and there is no overriding ground, or the processing was unlawful. But art. 17(3) lists carve-outs. A company can lawfully keep data where it must comply with a legal obligation — Portuguese tax law and the Código do Trabalho both impose retention periods — or where it needs the data to exercise or defend a legal claim. So "delete everything" often means "delete everything except what the law makes them keep."

The right to object (art. 21) works differently depending on the ground. Against direct marketing, it is decisive and immediate. Against processing based on legitimate interests or a public-interest task, the controller may continue only if it shows compelling legitimate grounds that override your interests — the burden is on them, not you.

How do I complain to the CNPD?

File a free complaint (participação) through the online forms at cnpd.pt, briefly describing the facts. The CNPD is the independent authority that supervises the GDPR and Lei 58/2019 in Portugal, and article 77 GDPR gives you the right to lodge a complaint whenever an organisation mishandles your data or ignores your rights — a right Lei 58/2019 confirms in national law.

Filing is free and done through the online forms at cnpd.pt, where the CNPD asks you to describe the facts briefly and indicate whether evidence exists; it will ask for documents later if it needs them. There are targeted forms for common issues (unsolicited marketing, video surveillance, biometric data) plus a general form.

The two routes are not mutually exclusive: you can complain to the CNPD and pursue the courts, and a right to compensation for material or non-material damage under article 82 exists independently. In practice most people start with the controller, keep the reply (or the silence), and take that record to the CNPD.

What does Portuguese law add on top of the GDPR?

Lei n.º 58/2019 fills in national details the GDPR left to Member States. For children's data in online services, the law sets the age of valid digital consent at 13 (art. 16) — one of the lowest thresholds in the EU — below which a holder of parental responsibility must consent. For a deceased person's sensitive or private data, the rights can be exercised by someone the person designated or, failing that, by their heirs (art. 17). And the CNPD can apply substantial administrative fines, in line with the GDPR's tiers, when controllers breach the rules.

If your data question overlaps with work or housing, related rights often sit close by — see our guides to your rights as a tenant in Portugal and the 14-day consumer right of withdrawal.

Where CourtStairs fits

This is exactly the kind of question CourtStairs is built for: it separates rights people confuse — erasure vs objection, complaining vs suing — gives a plain-language answer, and links each point to its source, whether that is art. 15, 17 or 77 of the RGPD on EUR-Lex or Lei n.º 58/2019 in the Diário da República, so you can read the provision yourself. It works in English and Portuguese and has a free tier.

This is general information about the law, not legal advice. Each right has conditions and exceptions that turn on your exact situation, EU and national rules interact, and the law changes, so confirm anything important against the primary source or a qualified adviser before you act.