Subscribe to PLMJ’s newsletters to receive the most up-to-date legal insights and our invitations to exclusive events.
We are looking for people who aim to go further and face the future with confidence.
Subscribe to PLMJ’s newsletters to receive the most up-to-date legal insights and our invitations to exclusive events.
We are looking for people who aim to go further and face the future with confidence.
Decree-Law 85/2024 was published on 4 November 2024 to ensure the implementation into Portuguese law of Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018. This Regulation aims to ensure the free flow of non-personal data within the European Union, allowing data to be stored and processed in any Member State, except in specific cases of public security or national defence.
The objective is to allow for greater freedom and dynamism of the economy in the provision of data storage and processing services within the EU. Therefore, Member States should repeal any rules, regulations or practices that require non-personal data to be localised in a specific geographical area or national territory in order to restrict the storage and processing of data outside those specific geographical areas or territories.
This Regulation aims to remove unjustified obstacles to the free movement of non-personal data, thereby promoting a more integrated and efficient digital single market.
We would therefore like to highlight a few important points:
i) The AMA as the central authority: The Agency for Administrative Modernisation (AMA) is designated as the national contact point, centralising information on data localisation requirements. The AMA updates and provides information on legislation and facilitates communication between Portugal and other Member States.
ii) Single website for digital services: The AMA must maintain relevant information on data localisation standards on the Single Digital Services Website, providing transparency and access to applicable standards and laws.
iii) Supervision and penalties: The Food and Economic Safety Authority (ASAE) monitors compliance and imposes sanctions, such as minor or serious administrative offences, in cases of non-compliance. In addition, additional sanctions may be imposed in serious cases, with the cooperation of other regulatory bodies to strengthen supervision and enforcement.
iv) Regional Autonomy: The autonomous regions of the Azores and Madeira are free to adapt their inspection and enforcement practices, guaranteeing local alignment with the requirements of the decree. The revenue from fines is divided between the state (60%), AMA (10%) and ASAE (30%).
v) Administrative offences: The Legal Framework for Economic Administrative Offences, approved by Decree-Law 9/2021 of 29 January, will apply, in the alternative, to the administrative offences provided for in this Decree-Law.
Finally, the provisions of this law come into force 60 days after publication, giving organisations time to adjust their operations to the new requirements. This Decree-Law represents a step forward in standardising data processing in Portugal and strengthening digital integration with the European Union.