Anyone who gives personal data to a business has the right to know who processes it, for what purpose, on what legal basis, to whom it may be disclosed and for how long it is kept. The General Data Protection Regulation (GDPR) establishes this duty to inform, which is usually met through a privacy policy.

In practice, many policies are templates adapted in a hurry, describing processing the business does not carry out and leaving out other processing that is actually part of its activity. A policy of that kind does not fulfil its purpose and may itself reveal non-compliance.

Legal framework

The GDPR (Regulation (EU) 2016/679) applies directly in Portugal. Law no. 58/2019 of 8 August ensures its implementation in the Portuguese legal system and sets out the institutional framework of the National Data Protection Commission (CNPD), as the supervisory authority.

The core rules on the duty to inform are in Articles 12 to 14 of the GDPR. Article 12 requires the information to be concise, transparent, intelligible and easily accessible, using clear and plain language.

Article 13 applies when personal data is collected from the data subject. Article 14 applies when it is obtained in another way, for example from third parties or from public sources.

The minimum content

When data is collected from the data subject, the privacy policy must state, at least:

  • Who the controller is and how to contact them, as well as the data protection officer, if one has been appointed;
  • The purposes of each processing operation and its legal basis;
  • The legitimate interests pursued, where that is the basis relied on;
  • The recipients or categories of recipients of the data;
  • Transfers to countries outside the European Economic Area, where they take place, and the safeguards that accompany them;
  • The retention period or, where it cannot be fixed, the criteria used to determine it;
  • The rights of data subjects, including the rights of access, rectification, erasure, restriction of processing, portability and objection, where applicable, as well as the right to withdraw consent and to lodge a complaint with the CNPD;
  • Whether providing the data is mandatory and the consequences of not providing it;
  • The existence of automated decision-making, including profiling, where applicable.

When the data is not collected directly from the data subject, the categories of personal data concerned and their source must also be stated, including, where applicable, whether they come from publicly accessible sources.

A legal basis for each purpose

Article 6 of the GDPR provides that the processing of personal data is lawful only when it rests on one of the legal bases it sets out: consent, performance of a contract or pre-contractual steps, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest, or the legitimate interests of the controller or of a third party.

The choice of legal basis matters. Invoicing a client stems, in particular, from compliance with legal obligations; processing the data needed to perform a contract is, as a rule, based on that contract; sending direct marketing communications, on the other hand, depends on the applicable legal conditions, which vary with the type of recipient and the context of the communication.

For electronic direct marketing communications, Article 13-A of Law no. 41/2004 of 18 August must also be taken into account. For recipients who are individuals, prior and express consent is, as a rule, required. For legal persons, a different regime applies, allowing such communications until the recipient objects and without prejudice to the lists provided for by law. There is also an exception for using the electronic contact details of customers to promote the business's own similar products or services, provided the legal conditions are met.

Presenting consent as the basis for all processing is a common mistake. Consent can be withdrawn at any time, so it should not be used where another legal basis is appropriate for the purpose pursued.

The most common mistakes

  • Copied or generic policy: it does not match the processing the business actually carries out, and may contain incorrect information or leave out relevant operations.
  • Open-ended retention periods: expressions such as «for as long as necessary», without stating the criteria that determine that period, do not adequately meet the duty to inform.
  • Service providers left out: IT hosting, email, invoicing or payroll companies may process data on the business's behalf. Where they act as processors, there must be a contract with the content required by Article 28 of the GDPR.
  • Unidentified international transfers: using storage, email or marketing services may involve transfers of data to countries outside the European Economic Area, subject to the conditions of Articles 44 et seq. of the GDPR.
  • Information provided only on the website: where data is also collected through contracts, paper forms, job applications or video surveillance systems, the information must also be given in those contexts and at the time required by law.

Cookies: a regime of their own

Placing cookies and similar technologies on the user's device is governed by Law no. 41/2004 of 18 August, as amended.

As a rule, prior consent is required to use these technologies. The exception covers cases where they are used solely to carry out the transmission of a communication over an electronic communications network or are strictly necessary to provide an information society service explicitly requested by the user.

That is why cookies are usually dealt with in a specific policy, linked to the privacy policy and to the consent management tool on the website. Simply mentioning cookies in the privacy policy does not replace compliance with the obligations on their placement and use.

Keeping the policy up to date

The privacy policy must keep pace with the reality of the business. New services, new providers, new technology tools or new ways of collecting data may require it to be revised.

It is equally important to ensure consistency between the privacy policy, the record of processing activities, the contracts with processors and the business's internal procedures.

Having a privacy policy does not, in itself, mean that all processing is lawful or that the business complies with the GDPR. The document must reflect actual practice and form part of a system for meeting legal obligations on data protection.

Frequently asked questions

Is a small business exempt from having a privacy policy?

No. The duty to inform applies to all controllers, whatever the size of the business, whenever processing subject to the GDPR is involved.

What allows a derogation, under Article 30(5), is the obligation to keep a record of processing activities, for organisations with fewer than 250 employees, provided the conditions laid down there are all met. The derogation does not apply, in particular, where the processing is not occasional, is likely to result in a risk to the rights and freedoms of data subjects, or includes special categories of data or data relating to criminal convictions and offences.

Is it enough to publish the privacy policy on the website?

Not always. The information must be given at the time the data is collected, in a way that suits the context. If data is collected through contracts, recruitment processes, paper forms or other means, the information must also be available in those contexts.

Who supervises compliance and what penalties apply?

Supervision of compliance with the GDPR is the responsibility of the CNPD, the national supervisory authority, with which data subjects may lodge a complaint under Article 77 of the GDPR.

Failure to meet the duty to inform may lead to fines under Article 83 of the GDPR and the national regime laid down in Law no. 58/2019.

Final note

Drawing up an adequate privacy policy takes more than adapting a template. It requires knowing the processing the business carries out, identifying the legal basis for each operation and making sure that the information given to data subjects actually reflects reality.

ME&JBA — Advogados, in Lisbon, provides legal advice on Data Protection and Technology, including drafting and reviewing privacy policies, analysing data processing procedures and assisting with matters relating to GDPR compliance.*

João Brazete de Almeida
Lawyer

* An artificial intelligence tool was used in preparing this article as an aid to structuring and drafting the text and to its linguistic review. The legal analysis, the selection and verification of the legal grounds and the final review of the content are the responsibility of the author.