Notification of personal data breaches

Law no. 1.565 of December 3, 2024 introduces a new obligation for data controllers: they must notify any personal data breach of which they have become aware that is likely to result in a risk to the rights and freedoms of the affected individuals.

This notification must be made to the APDP in order to ensure that the rights and freedoms of the people affected by the breach are preserved.

In some cases, the notification may also be accompanied by a communication to the people affected by the breach.

To continue reading, you can download the factsheet here