INTRA/PTPortugal
What the record establishes for Portugal, measure by measure, and what each source requires of the measure it governs.
| Control | Source | What it establishes | Prerequisite or recommendation |
|---|---|---|---|
| 14Mandatory | |||
| AW001/PTWorkforce awareness on insider riskMandatory | Regulamento n.º 756/2026, Regulamento do Regime Jurídico da CibersegurançaCentro Nacional de Cibersegurança · read 5 Oct 2026 | For entities in scope, that HR processes, selection, hiring, position categorization, and termination, are assessed against the entity’s cybersecurity requirements, that identities and credentials are issued, managed, verified, revoked, and audited, that access follows need to know and least privilege, that privileged passwords sit in a password manager and remote and privileged access carries multi-factor authentication, that logs are collected, stored, protected, and reviewed regularly, their retention set by risk and proportionality, failures in log processing raising alerts and critical systems’ logs stored on an autonomous system, that internal and external threats, intentional or accidental, are identified, that all staff receive awareness and training under a measured plan which includes awareness of internal threats, and that a significant incident is notified through the CNCS platform in an initial notification, an end-of-impact notification, and a final or interim report. | For entities in scope, all staff are made aware and trained in cybersecurity under a plan whose success is measured, and at the higher conformity level the training includes awareness and communication of internal threats so that staff recognize and respond to them. |
| AW002/PTTransparency notice on what is observedMandatory | Código do Trabalho, articles 17, 20, 21, 22, and 170-AAssembleia da República · read 5 Oct 2026Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026 | That remote surveillance to control the worker’s professional performance is prohibited, that it is lawful for the protection and security of persons and goods or where particular requirements of the activity justify it, that the worker is informed of its existence and purpose, that its use is subject to authorization by the CNPD on a request accompanied by the opinion of the comissão de trabalhadores, that the notice reads “Este local encontra-se sob vigilância de um circuito fechado de televisão”, that the data are kept only for the period the purpose needs and destroyed on the worker’s transfer or on termination, that the worker has the right to confidentiality of personal messages and non-professional information sent, received, or consulted, the employer’s power to set rules of use notwithstanding, and that in telework the employer may not capture image, sound, writing, or history, nor impose permanent connection by image or sound. | The worker is informed of the existence and purpose of the means of remote surveillance; a camera carries the statutory notice. Before processing begins the worker is told the conditions of private use, the forms and methods of control, the data processed, the retention period, the tolerance admitted, and the consequences of misuse; the rules and forms of control stand in an internal regulation. |
| DP004/PTAccess control and least privilegeMandatory | Regulamento n.º 756/2026, Regulamento do Regime Jurídico da CibersegurançaCentro Nacional de Cibersegurança · read 5 Oct 2026Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026 | For entities in scope, that HR processes, selection, hiring, position categorization, and termination, are assessed against the entity’s cybersecurity requirements, that identities and credentials are issued, managed, verified, revoked, and audited, that access follows need to know and least privilege, that privileged passwords sit in a password manager and remote and privileged access carries multi-factor authentication, that logs are collected, stored, protected, and reviewed regularly, their retention set by risk and proportionality, failures in log processing raising alerts and critical systems’ logs stored on an autonomous system, that internal and external threats, intentional or accidental, are identified, that all staff receive awareness and training under a measured plan which includes awareness of internal threats, and that a significant incident is notified through the CNCS platform in an initial notification, an end-of-impact notification, and a final or interim report. | For entities in scope, access and permissions are granted on need to know and least privilege under an access and permissions policy, and identities and credentials are issued, managed, verified, revoked, and audited. Commercial, industrial, and intellectual property secrecy is protected upstream by strict access control to the confidential information, and not by reading email. |
| DP005/PTPrivileged access managementMandatory | Regulamento n.º 756/2026, Regulamento do Regime Jurídico da CibersegurançaCentro Nacional de Cibersegurança · read 5 Oct 2026 | For entities in scope, that HR processes, selection, hiring, position categorization, and termination, are assessed against the entity’s cybersecurity requirements, that identities and credentials are issued, managed, verified, revoked, and audited, that access follows need to know and least privilege, that privileged passwords sit in a password manager and remote and privileged access carries multi-factor authentication, that logs are collected, stored, protected, and reviewed regularly, their retention set by risk and proportionality, failures in log processing raising alerts and critical systems’ logs stored on an autonomous system, that internal and external threats, intentional or accidental, are identified, that all staff receive awareness and training under a measured plan which includes awareness of internal threats, and that a significant incident is notified through the CNCS platform in an initial notification, an end-of-impact notification, and a final or interim report. | For entities in scope, passwords for privileged access are held in a password management solution, and remote and privileged accounts carry multi-factor authentication. |
| DP012/PTRetention and disposal of program recordsMandatory | Código do Trabalho, articles 17, 20, 21, 22, and 170-AAssembleia da República · read 5 Oct 2026Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026 | That remote surveillance to control the worker’s professional performance is prohibited, that it is lawful for the protection and security of persons and goods or where particular requirements of the activity justify it, that the worker is informed of its existence and purpose, that its use is subject to authorization by the CNPD on a request accompanied by the opinion of the comissão de trabalhadores, that the notice reads “Este local encontra-se sob vigilância de um circuito fechado de televisão”, that the data are kept only for the period the purpose needs and destroyed on the worker’s transfer or on termination, that the worker has the right to confidentiality of personal messages and non-professional information sent, received, or consulted, the employer’s power to set rules of use notwithstanding, and that in telework the employer may not capture image, sound, writing, or history, nor impose permanent connection by image or sound. | Data from the control of private use of ICT are kept at most six months, save during a disciplinary or judicial proceeding; the logs of access to the monitoring system are kept one year. Remote surveillance data are kept for the period the purpose needs and destroyed on transfer or termination; breach of the retention rule is a contraordenação grave. |
| GV010/PTWorker representative engagementMandatory | Código do Trabalho, articles 17, 20, 21, 22, and 170-AAssembleia da República · read 5 Oct 2026Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026 | That remote surveillance to control the worker’s professional performance is prohibited, that it is lawful for the protection and security of persons and goods or where particular requirements of the activity justify it, that the worker is informed of its existence and purpose, that its use is subject to authorization by the CNPD on a request accompanied by the opinion of the comissão de trabalhadores, that the notice reads “Este local encontra-se sob vigilância de um circuito fechado de televisão”, that the data are kept only for the period the purpose needs and destroyed on the worker’s transfer or on termination, that the worker has the right to confidentiality of personal messages and non-professional information sent, received, or consulted, the employer’s power to set rules of use notwithstanding, and that in telework the employer may not capture image, sound, writing, or history, nor impose permanent connection by image or sound. | The request for authorization of remote surveillance is accompanied by the opinion of the comissão de trabalhadores, or, where it is not given within 10 days of consultation, by proof that it was requested. The internal regulation on use and control of ICT is heard by the comissão de trabalhadores or other representative structure under article 99(2) of the Labour Code, published, and sent to the ACT; access to a mailbox takes place preferably in the presence of a representative of the comissão de trabalhadores, a union delegate, or a person the worker names. |
| MD001/PTThreat modelling and detection scopingMandatory | Regulamento n.º 756/2026, Regulamento do Regime Jurídico da CibersegurançaCentro Nacional de Cibersegurança · read 5 Oct 2026 | For entities in scope, that HR processes, selection, hiring, position categorization, and termination, are assessed against the entity’s cybersecurity requirements, that identities and credentials are issued, managed, verified, revoked, and audited, that access follows need to know and least privilege, that privileged passwords sit in a password manager and remote and privileged access carries multi-factor authentication, that logs are collected, stored, protected, and reviewed regularly, their retention set by risk and proportionality, failures in log processing raising alerts and critical systems’ logs stored on an autonomous system, that internal and external threats, intentional or accidental, are identified, that all staff receive awareness and training under a measured plan which includes awareness of internal threats, and that a significant incident is notified through the CNCS platform in an initial notification, an end-of-impact notification, and a final or interim report. | For entities in scope, threats are identified and documented as internal or external, natural or human, accidental or intentional. |
| MD002/PTLog collection and centralizationMandatory | Regulamento n.º 756/2026, Regulamento do Regime Jurídico da CibersegurançaCentro Nacional de Cibersegurança · read 5 Oct 2026Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026 | For entities in scope, that HR processes, selection, hiring, position categorization, and termination, are assessed against the entity’s cybersecurity requirements, that identities and credentials are issued, managed, verified, revoked, and audited, that access follows need to know and least privilege, that privileged passwords sit in a password manager and remote and privileged access carries multi-factor authentication, that logs are collected, stored, protected, and reviewed regularly, their retention set by risk and proportionality, failures in log processing raising alerts and critical systems’ logs stored on an autonomous system, that internal and external threats, intentional or accidental, are identified, that all staff receive awareness and training under a measured plan which includes awareness of internal threats, and that a significant incident is notified through the CNCS platform in an initial notification, an end-of-impact notification, and a final or interim report. | For entities in scope, logs are collected, stored, protected, and reviewed regularly, their retention set by the risk of the systems and the activities and by proportionality; failures in log processing raise alerts; logs of critical systems are stored on an autonomous system. Access to the monitoring system is logged with user, timestamp, operation, a sequential id, and a hash over them, digitally signed for legal validity; anomalous situations are defined to feed an alarm system; a log analysis policy produces periodic reports kept for the CNPD. |
| MD004/PTEndpoint activity monitoringMandatory | Código do Trabalho, articles 17, 20, 21, 22, and 170-AAssembleia da República · read 5 Oct 2026Orientações sobre o controlo à distância em regime de teletrabalhoComissão Nacional de Proteção de Dados · read 5 Oct 2026 | That remote surveillance to control the worker’s professional performance is prohibited, that it is lawful for the protection and security of persons and goods or where particular requirements of the activity justify it, that the worker is informed of its existence and purpose, that its use is subject to authorization by the CNPD on a request accompanied by the opinion of the comissão de trabalhadores, that the notice reads “Este local encontra-se sob vigilância de um circuito fechado de televisão”, that the data are kept only for the period the purpose needs and destroyed on the worker’s transfer or on termination, that the worker has the right to confidentiality of personal messages and non-professional information sent, received, or consulted, the employer’s power to set rules of use notwithstanding, and that in telework the employer may not capture image, sound, writing, or history, nor impose permanent connection by image or sound. | In telework the employer may not capture image, sound, writing, or history, nor use other means of control that may affect privacy, nor impose permanent connection by image or sound; breach is a contraordenação muito grave. Software that records pages visited, the terminal’s real-time location, use of mouse and keyboard, screenshots, application access, and time per document is not admitted; the prohibition of remote control of performance applies in full to work from home. |
| MD006/PTElectronic mail and collaboration monitoringMandatory | Código do Trabalho, articles 17, 20, 21, 22, and 170-AAssembleia da República · read 5 Oct 2026Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026 | That remote surveillance to control the worker’s professional performance is prohibited, that it is lawful for the protection and security of persons and goods or where particular requirements of the activity justify it, that the worker is informed of its existence and purpose, that its use is subject to authorization by the CNPD on a request accompanied by the opinion of the comissão de trabalhadores, that the notice reads “Este local encontra-se sob vigilância de um circuito fechado de televisão”, that the data are kept only for the period the purpose needs and destroyed on the worker’s transfer or on termination, that the worker has the right to confidentiality of personal messages and non-professional information sent, received, or consulted, the employer’s power to set rules of use notwithstanding, and that in telework the employer may not capture image, sound, writing, or history, nor impose permanent connection by image or sound. | The worker has the right to confidentiality of personal messages and non-professional information sent, received, or consulted, email included; the employer may set rules of use of the means of communication. Control of email is not permanent or systematic; it is pontual, directed to the areas and activities of greater risk, and as a rule random; virus detection does not by itself justify reading received mail; filtering by file type is done with the workers’ knowledge; workers keep personal messages in identified personal folders. |
| MD014/PTVideo surveillance of the workplaceMandatory | Código do Trabalho, articles 17, 20, 21, 22, and 170-AAssembleia da República · read 5 Oct 2026 | That remote surveillance to control the worker’s professional performance is prohibited, that it is lawful for the protection and security of persons and goods or where particular requirements of the activity justify it, that the worker is informed of its existence and purpose, that its use is subject to authorization by the CNPD on a request accompanied by the opinion of the comissão de trabalhadores, that the notice reads “Este local encontra-se sob vigilância de um circuito fechado de televisão”, that the data are kept only for the period the purpose needs and destroyed on the worker’s transfer or on termination, that the worker has the right to confidentiality of personal messages and non-professional information sent, received, or consulted, the employer’s power to set rules of use notwithstanding, and that in telework the employer may not capture image, sound, writing, or history, nor impose permanent connection by image or sound. | Remote surveillance to control professional performance is prohibited; it is lawful for the protection and security of persons and goods or where particular requirements of the activity justify it; the worker is informed of its existence and purpose and the notice reads “Este local encontra-se sob vigilância de um circuito fechado de televisão”. |
| MD016/PTMeasurement of pace and performanceMandatory | Código do Trabalho, articles 17, 20, 21, 22, and 170-AAssembleia da República · read 5 Oct 2026Deliberação n.º 7680/2014, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes da utilização de tecnologias de geolocalização no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026 | That remote surveillance to control the worker’s professional performance is prohibited, that it is lawful for the protection and security of persons and goods or where particular requirements of the activity justify it, that the worker is informed of its existence and purpose, that its use is subject to authorization by the CNPD on a request accompanied by the opinion of the comissão de trabalhadores, that the notice reads “Este local encontra-se sob vigilância de um circuito fechado de televisão”, that the data are kept only for the period the purpose needs and destroyed on the worker’s transfer or on termination, that the worker has the right to confidentiality of personal messages and non-professional information sent, received, or consulted, the employer’s power to set rules of use notwithstanding, and that in telework the employer may not capture image, sound, writing, or history, nor impose permanent connection by image or sound. | Remote surveillance by technological equipment to control the worker’s professional performance is prohibited. Location data are never used to control the worker’s performance. |
| PS001/PTPre-employment screeningMandatory | Regulamento n.º 756/2026, Regulamento do Regime Jurídico da CibersegurançaCentro Nacional de Cibersegurança · read 5 Oct 2026 | For entities in scope, that HR processes, selection, hiring, position categorization, and termination, are assessed against the entity’s cybersecurity requirements, that identities and credentials are issued, managed, verified, revoked, and audited, that access follows need to know and least privilege, that privileged passwords sit in a password manager and remote and privileged access carries multi-factor authentication, that logs are collected, stored, protected, and reviewed regularly, their retention set by risk and proportionality, failures in log processing raising alerts and critical systems’ logs stored on an autonomous system, that internal and external threats, intentional or accidental, are identified, that all staff receive awareness and training under a measured plan which includes awareness of internal threats, and that a significant incident is notified through the CNCS platform in an initial notification, an end-of-impact notification, and a final or interim report. | For entities in scope, the processes that govern human resources, selection of candidates and hiring among them, are assessed and reviewed against the entity’s cybersecurity requirements. |
| PS008/PTLeaver processMandatory | Regulamento n.º 756/2026, Regulamento do Regime Jurídico da CibersegurançaCentro Nacional de Cibersegurança · read 5 Oct 2026Código do Trabalho, articles 17, 20, 21, 22, and 170-AAssembleia da República · read 5 Oct 2026 | For entities in scope, that HR processes, selection, hiring, position categorization, and termination, are assessed against the entity’s cybersecurity requirements, that identities and credentials are issued, managed, verified, revoked, and audited, that access follows need to know and least privilege, that privileged passwords sit in a password manager and remote and privileged access carries multi-factor authentication, that logs are collected, stored, protected, and reviewed regularly, their retention set by risk and proportionality, failures in log processing raising alerts and critical systems’ logs stored on an autonomous system, that internal and external threats, intentional or accidental, are identified, that all staff receive awareness and training under a measured plan which includes awareness of internal threats, and that a significant incident is notified through the CNCS platform in an initial notification, an end-of-impact notification, and a final or interim report. | For entities in scope, termination of the employment relationship is among the HR processes assessed against cybersecurity requirements, and credentials are revoked under the instituted processes. Data from remote surveillance are destroyed on the worker’s transfer to another workplace or on termination of the contract. |