Law Implementing the Digital Services Act (DSA) in Portugal

Law Implementing the Digital Services Act (DSA) in Portugal

April 2026
Law Implementing the Digital Services Act (DSA) in Portugal

On 15 April, Law No. 12-A/2026 of 15 April (Law 12-A) was published. This law ensures the implementation, within the Portuguese legal system, of Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a single market for digital services — commonly referred to as the Digital Services Act (DSA).

The publication of this legislation marks the end of a process that had been pending since February 2024, ensuring that there is now a national framework for the supervision and enforcement of the DSA in Portugal, designating the competent authorities, conferring investigative and enforcement powers, and establishing obligations and sanctions applicable to intermediary service providers, including fines of up to 6% of global turnover.

Contacts

April 2026
Law Implementing the Digital Services Act (DSA) in Portugal

Obligations of Intermediary Service Providers

The DSA and Law 12-A apply to three types of intermediary services: those providing internet access, those temporarily storing information (such as caching providers) and those hosting user content, such as cloud service providers. It is also within this latter group that digital platforms fall, such as: social media, marketplaces, video-sharing platforms or discussion forums. Search engines are also covered.

Companies providing these services now must assure their compliance with DSA’s obligations, such as: (i) having a contact person whom the authorities and users can call or write to; (ii) clearly explaining the rules that apply to their users; and (iii) publishing regular reports showing how much content has been removed from their services and for what reason.

Companies that host content must also provide simple mechanisms for users to report illegal content, such as dedicated buttons or forms. If reports of hate speech or counterfeit goods are received, for example, the company must act swiftly to remove or block such content, or risk being held liable.

Social media platforms and marketplaceshave even more obligations — they must set up internal appeal systems — for example, to challenge the removal of a post. They are prohibited from using design tricks (so-called ‘dark patterns’) that push users towards choices they would not make of their own free will, and must also clearly show who is paying for the advertising we see and how the algorithm decides what appears in the feed. They must also provide special protection for children and young people, and marketplacesmust verify the identity of sellers.

In addition, intermediary service providers are obliged to comply with the orders of the competent judicial authorities or administrative bodies, in particular to take action against illegal content, provide information on individual recipients of their services, and supply lists of recipients of their services.

Digital Services Coordinator and Competent Authorities

The National Communications Authority (ANACOM) is designated as the competent administrative authority and as the Digital Services Coordinator, acting as the single point of contact with the European Commission, the European Digital Services Board and the coordinators of other Member States.

Law 12-A also assigns specific powers to other bodies: the Media Regulatory Authority (ERC) and the National Data Protection Commission (CNPD).

The ERC is designated as the competent authority responsible for the supervision and enforcement of matters relating to advertising on online platforms and the protection of minors, in accordance with Article 14(3), Article 26(1) and (2) and Article 28(1) of the DSA.

The CNPD, meanwhile, is responsible for the supervision and enforcement of the provisions of Article 26(3) and Article 28(2) of the DSA, in particular with regard to advertising based on special categories of personal data and personal data of minors.

 

Investigative and Enforcement Powers

ANACOM has extensive investigative and supervisory powers, including:

  • Requiring the provision of information, with a minimum response time of 10 working days, except in duly justified urgent cases.
  • Requesting the judicial authority to carry out inspections and searches with the seizure of documentation and information, regardless of the medium on which it is stored.
  • Accepting binding commitments from providers.
  • Ordering the cessation of infringements, imposing fines, applying periodic penalty payments and requesting interim measures from the judicial authority.
  • Request the temporary restriction of access to the service or online interface in question.

As regards matters referred to the ERC and the CNPD, these are the competent authorities for their supervision and the imposition of sanctions.

The exercise of these powers is expressly limited by the application of the guarantees set out in the Constitution, the Code of Administrative Procedure, the Penal Code, the Code of Criminal Procedure, amongst others, and the right to privacy and the rights of defence must be ensured, including the right to be heard, the right of access to the file and the right to judicial review.

Orders to act on illegal content must include, amongst other elements, the identification of the issuing authority, a description of the specific elements of the illegal content in question, the territorial scope of enforcement, the legal basis and the deadline for enforcement. Similarly, orders to provide information must identify the information to be provided, the individual recipients concerned, the legal basis and the redress mechanisms.

Interessé par cet article ?