What is the EU COVID Digital Certificate?

Due to the COVID-19 pandemic, and in order to limit or control the spread of the virus, Member States have adopted a number of measures restricting the free movement of their citizens within the European Union ("EU"), such as entry restrictions or requiring cross-border travelers to comply with quarantine or self-isolation periods, or undergo testing.

The EU COVID-19 Digital Certificate (hereafter referred to as the "Certificate") is the proof, issued by a Member State and recognized by the other Member States, that a citizen (i) has been vaccinated against COVID-19, (ii) has tested negative for COVID-19, or (iii) has recovered from COVID-19.

The Certificate is accepted in all EU Member States, allowing European citizens, once in possession of the Certificate, to move freely and safely within the EU. Member States should not impose additional restrictions on the movement of citizens holding the Certificate, other than in exceptional cases where such measures are necessary to safeguard public health and are proportionate.

All EU citizens and their family members, as well as third country nationals staying or residing in a Member State shall be entitled to have a Certificate free of any charges.

It should be noted that the Certificate is not a travel document. Those who do not meet the necessary requirements for the issue of the Certificate can still travel. They will, however, be subject to the limitations applicable to travellers - tests or quarantines.

In Portugal, the Certificate is issued by the Ministry of Health, and can be obtained on the portal SNS 24, through mobile application or sent to the holder to the email address registered in the National Health Record or in the Electronic Health Record.

The Certificate can be presented in digital format or on paper, being verified through the appropriate mobile application by reading the respective QR code, or manually, through the data contained therein.

The Digital Certificate regime came into force on 1 July 2021, the effective date of Regulation (EU) 2021/953, of 14 June , which established a regime for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates.

In Portugal, the Regulation was implemented by Decree-Law 54-A/2021, of 25 June 2021 ("DL 54-A/2021").


Types of Certificates

The Certificate constitutes proof that a person has been vaccinated, has tested negative for or has recovered from COVID-19. In this sense, there are three types of certificates.

The Vaccination Certificate confirms that the holder has undergone a primary vaccination schedule, at least 14 days earlier, or the complete primary vaccination scheme and booster dose with a vaccine against COVID-19 with marketing authorization in the EU.

The primary vaccination schedule is deemed complete after taking:

a)    A single dose of a COVID-19 vaccine with a one-dose vaccination schedule;

b)    the second dose of a COVID-19 vaccine with a two-dose vaccination schedule; or

c)    the first dose of a COVID-19 vaccine with a two-dose vaccination schedule by persons who have recovered from the disease, if the vaccination certificate indicates that the vaccination schedule was completed after the administration of one dose.

A 'booster dose' means a dose of a COVID-19 vaccine administered after completion of the primary vaccination schedule as defined above.

Delegated Regulation 2021/228 of 21 December extended the period of acceptance of Certificates of Vaccination based on the primary vaccination scheme for the purpose of travel between Member States of the European Union from 180 to 270 days, from the date of administration of the last dose of the primary vaccination scheme. Member States should not set a period of acceptance of less than 270 days for these purposes but may do so for other uses of the vaccination certificate. At a national level and for the purposes of access to events, restaurants, leisure and movement within the country Vaccination Certificates are also valid for 270 days from the completion of the primary vaccination schedule, in accordance with Decree Law No. 54-A/2021, as amended.

After the 270-day period a new Certificate of Vaccination may be requested and issued. However, if the primary vaccination scheme has been completed more than 270 days ago and no booster dose has been received, this Certificate will not be accepted in the European Union for the purpose of cross-border mobility, although it may be accepted by third countries that have not set an acceptance deadline.

The vaccination certificate issued following the administration of the booster dose will be valid without any defined period of acceptance, given the still limited information on the duration of immunity after the administration of the booster dose. The absence of a time limit is independent of whether the booster dose was administered during the 270-day acceptance period applicable to certificates indicating completion of the primary vaccination series.

The Test Certificate confirms that the holder has been tested and has tested negative for one of the following tests:

a)  nucleic acid amplification molecular test (NAAT), within the last 72 hours;

b)  rapid antigen test from the list established on the basis of the Council Recommendation of 21 January 2021, within the last 48 hours.

The Certificate of recovery confirms that the holder has recovered from a SARS-CoV-2 infection following a positive result in a NAAT test performed more than 11 days and less than 180 days ago.The extension of the certificate to citizens who have tested negative and who have recovered from Covid-19 tackles some ethical/legal dilemmas associated with a certificate that would only allow the freedom of movement of citizens who have been vaccinated. The system thus aims to safeguard the movement of citizens who are not infected, or who have an acceptably low risk of infection. In this way, arbitrary discrimination between Europeans is avoided, at a time when full vaccination is still far from being a universal reality.


Data Protection

The processing of personal data in connection with the issuance, verification and acceptance of EU COVID digital certificates - regulated under Regulation (EU) No. 2021/953 on the EU COVID Digital Certificate ("EU COVID Digital Certificate Regulation") - shall comply with the rules of the General Data Protection Regulation - (EU) 2016/779 ("GDPR").

Therefore, these digital certificates should, in light of the principle of data minimization, contain only the personal data which are strictly necessary to identify the certificate holder, namely personal data of the following categories:

(i) identity of the holder - including name and date of birth;

(ii) details of the vaccination, testing or recovery event, depending on the type of certificate; and

(iii) a unique identifier for the certificate - which shall not contain any data linking the data subject to other identification documents, namely the passport or identity card number.


Who is the data controller?

The Directorate General of Health ("DGS"), which is responsible for issuing the EU COVID digital certificates shall also be the controller of the personal data required for such purposes. DGS shall retain such data only for as long as is necessary to fulfil the purposes of the processing.


Lawfulness of processing

The processing of personal data in question is based on the compliance by DGS with the obligations set out in the EU Regulation on the COVID Digital Certificate, as well as reasons of important public interest - under the terms of Articles 6.1(c) and 9.2(g) of the GDPR, respectively.


What are the purposes of the data processing?

The data is processed for legally regulated purposes.

Therefore, the personal data included in the certificates will be processed by the competent authorities of the Member State of destination or transit only for the purpose of verification and confirmation of vaccination, test results or recovery. It should be noted that the storage of personal data processed in the context of digital certificates must remain in the issuing Member State and therefore countries of destination or transit that have access to them are prohibited from storing them.

The powers of the supervisory authorities established under the GDPR shall apply in full to the case at hand: data subjects have the right to lodge complaints about the processing of personal data in connection with the issuance and verification of digital certificates with the National Commission for Data Protection ("CNPD").


What are the rules for the use of the EU COVID Digital Certificate in air travel?

Decree-Law No. 54-A/2021, of 25 June 2021 (which implements Regulation (EU) 2021/953, of 14 June 2021 and Regulation (EU), both concerning the legal regime of the EU COVID Digital Certificate) states that all travelers with an EU COVID Digital Certificate are allowed to travel to Portugal for any reason.

The following EU COVID Digital Certificates are admitted:

a)    Vaccination certificate attesting that its holder has been fully vaccinated for more than 14 days and less than 270 days since the administration of the last dose, or attesting the completion of the booster dose with a COVID-19 vaccine with marketing authorization in accordance with Regulation (EC) No. 726/2004;

b)    Test certificate stating that the holder has been subjected to: (i) a nucleic acid amplification molecular test (NAAT) within the last 72 hours with a negative result; or (ii) a rapid antigen test included on the list drawn up by the European Commission based on the Council Recommendation of 21 January 2021 on a common framework for the use and validation of rapid antigen detection tests for COVID-19 and the mutual recognition of test results in the EU within the last 24 hours with a negative result;

c)    Certificate of recovery, certifying that the holder has recovered from a SARS-CoV-2 infection following a positive TAAN test result obtained more than 11 days and less than 180 days ago.

Presentation of an EU Digital COVID Certificate exempts travel related testing for SARS-CoV-2 infection. In addition, presentation of an EU COVID Digital Certificate for vaccination or recovery exempts holders of the certificate and accompanying minors from quarantine or isolation for travel purposes.

Verification of ownership of a valid EU COVID Digital Certificate is carried out by airlines at the time of departure as a condition of boarding to Portugal for the respective holders, without prejudice to random verification, upon arrival in national territory, by the Public Security Police or the Foreigners and Borders Service (SEF).


The other applications of the Digital Certificate: access to restaurants, leisure activities and movement within the country

Although the Certificate was designed to protect freedom of movement within the EU - preventing Member States from imposing restrictions on citizens who prove to have been vaccinated, who tested negative or who have recovered - DL 54-A/2021 as amended allows for its use in the country: the certificate can be used to travel between territories where restrictive measures apply, or to access certain events or places.

According to the DL 54-A/2021, the presentation of the Certificate (or of evidence of having taken the test) allows the holder to move freely within national territory, regardless of the rules limiting mobility established as a way to prevent the spread of the COVID-19 pandemic.

The presentation of the EU COVID Digital Certificate exempts the presentation of evidence of a negative test, in cases where such is required to attend or participate in events of a cultural, sporting, corporate or family nature, namely weddings and christenings. The same rule applies to establishments such as restaurants, hotels and local accommodations, casinos, gyms, and alike.

Due to the State of Calamity decreed through DL 104/2021, and the Council of Ministers Resolution of November 27, 2021, as amended it is mandatory to present a negative test, a recovery Certificate or vaccination certificate attesting to the completion of the booster dose:

  • On visits to residential structures, such as nursing homes;
  • On visits to patients hospitalized in health care facilities;
  • To access large events without booked seats or improvised venues and sports venues, and finally
  • To access bars and nightclubs.

Failure to comply with the duties of presentation and ownership of the EU COVID Digital Certificate, when required, or with the duty to wear a mask or visor, is considered an administrative offence, punishable with a fine from € 100 to € 500, when committed by natural persons, and € 1 000 to € 10 000 when committed by legal persons. The same administrative offence applies in case of non-compliance with the duty to request and verify the Certificate or negative test by the persons in charge of the venues and establishments, or event organizers.


This information is being updated on a regular basis.

All information contained herein and all opinions expressed are of a general nature and are not intended to substitute recourse to expert legal advice for the resolution of real cases.