Data Protection and Technology
Support with compliance with personal data protection rules (GDPR) and with contracts and legal matters relating to information technology.
Matters the office handles
GDPR compliance
Mapping of processing, records of processing activities, lawful bases and retention periods.
Policies and privacy notices
Privacy and cookie policies, information notices and consents.
Processors
Data processing agreements under Article 28 GDPR.
Data subject rights
Handling of access, rectification, erasure and objection requests.
Data breaches
Incident assessment, notification to the Portuguese supervisory authority (CNPD) and communication to data subjects.
CCTV and monitoring
Use of cameras and technological means in the workplace.
Businesses that process data of clients, employees or users, technology providers, and individuals exercising their rights.
Handled by the lawyers of ME&JBA
Each matter is personally handled by a lawyer of the office assigned to it, from the initial analysis of the facts and documents to its conclusion. Before work begins, the client is informed of the scope of the work, the expected steps and the criteria for setting fees.
Common questions on Data Protection and Technology
Must every business appoint a data protection officer?
No. Under Article 37 GDPR, appointment is mandatory for public authorities and bodies and for organisations whose core activities consist of processing that requires regular and systematic monitoring of data subjects on a large scale, or large-scale processing of special categories of data or data on criminal convictions.
What should be done after a personal data breach?
The controller must notify the Portuguese supervisory authority (CNPD) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to people's rights and freedoms (Article 33 GDPR). Where the risk is high, data subjects must also be informed (Article 34).
Which Portuguese law supplements the GDPR?
Law no. 58/2019 of 8 August implements the GDPR in Portugal and contains specific rules, for example on data processing in employment relationships and on CCTV.
General information, based on the legislation in force on 17.10.2026. Its application to a specific situation depends on the facts and requires its own legal analysis.