Laws and data licensing
Portugal: privacy laws and AI data licensing
Short answer
If your records include people in Portugal, the main rules are: EU GDPR plus Law 58/2019; the CNPD is the regulator.
In short
- Country
- Portugal
- Main privacy laws
- EU GDPR plus Law 58/2019; the CNPD is the regulator.
- Note
- Standard GDPR principles apply; records need a lawful basis for reuse unless truly anonymized.
- Last reviewed
- 2026-10-09
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What to know#
Standard GDPR principles apply; records need a lawful basis for reuse unless truly anonymized.
For suppliers#
- SourceX works with businesses based in Portugal, and their records may include customers abroad
- Records tied to other countries are reviewed against their rules or excluded
- Personal details are removed before anything is shared
Frequently asked questions
Which privacy laws apply to records about people in Portugal?
EU GDPR plus Law 58/2019; the CNPD is the regulator. Standard GDPR principles apply; records need a lawful basis for reuse unless truly anonymized.
Can a company based in Portugal license its data through SourceX?
Yes. SourceX works with companies based in Portugal, and U.S. companies are its priority. Records are reviewed against the rules that apply, and personal details are removed before anything is shared.
Can a U.S. business license records that include customers in Portugal?
Records tied to Portugal are reviewed against its rules or excluded from the license, and personal details are removed before anything is shared.
What happens to records that cannot be cleared?
Records that can't be cleared under the rules that apply are excluded, and the company approves every release before data moves.
General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel. Last reviewed 2026-10-09.