Following an extended legislative process, Law 12-A/2026, of 15 April, ensuring the implementation, of Regulation (EU) 2022/2065, the Digital Services Act (“DSA”), into Portuguese law (“Law 12-A”), has been officially published. This legislation establishes the national framework for the supervision and enforcement of the DSA in Portugal, designating competent authorities, conferring investigatory and enforcement powers, and setting out the obligations and penalties applicable to providers of intermediary services.

This article provides an overview of the key aspects of this new legal framework that providers of intermediary services should take into consideration.

Competent Authorities and Their Competences

Law 12-A designates the Portuguese National Communications Authority (Autoridade Nacional de Comunicações, ANACOM) as the Digital Services Coordinator for the purposes of the DSA. In this capacity, ANACOM holds general supervisory and enforcement competence under the DSA and serves as the single point of contact with the European Commission, the European Board for Digital Services, and the Digital Services Coordinators of other Member States.

Two additional authorities are assigned sector-specific supervisory competences.

The Portuguese Media Regulatory Authority (Entidade Reguladora para a Comunicação Social, ERC) is designated as the competent authority for the supervision and enforcement of Article 14(3), Articles 26(1) and (2), and Article 28(1) of the DSA. These provisions concern transparency requirements for terms and conditions, advertising obligations applicable to online platforms, and the protection of minors on such platforms.

The Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados, CNPD) is designated as the competent authority for the supervision and enforcement of Article 26(3) and Article 28(2) of the DSA. These provisions establish the prohibition of profiling-based advertising using special categories of personal data and the prohibition of profiling-based advertising directed at minors.

Powers of the Competent Authorities

ANACOM, as the Digital Services Coordinator, is vested with a comprehensive set of investigatory and enforcement powers.

Regarding investigatory powers, ANACOM may require intermediary service providers, as well as any natural or legal persons acting within the scope of their commercial or professional activity who may reasonably be expected to have knowledge of information relating to a suspected infringement, to supply relevant information within prescribed deadlines. It may also request the competent judicial authority to order inspections of any premises used by providers for commercial purposes, for the purpose of examining, seizing, or copying information relating to a suspected infringement. Furthermore, it may request any employee or representative of providers to provide explanations concerning any information relating to a suspected infringement.

With regard to enforcement powers, ANACOM may accept commitments offered by providers concerning their compliance with the DSA and render such commitments binding. It may also order the cessation of infringements and, where appropriate, impose proportionate corrective measures. To this end, it has the power to impose administrative fines for non-compliance, as well as periodic penalty payments to ensure the cessation of ongoing infringements. It may further request the competent judicial authority to adopt interim measures to prevent the risk of serious harm.

Notable Instances of Gold-Plating

Law 12-A exceeds the minimum requirements laid down by the DSA in certain respects.

First, Law 12-A provides that judicial and administrative authorities may, in addition to ordering providers to act against illegal content and to provide information on specific individual users of their services, also require providers to furnish lists of users of their services or to provide information concerning a group of unidentified users.

Second, Law 12-A empowers authorities to establish specific time limits for providers to comply with their orders and requests for information. Orders to act against illegal content must specify a time limit for execution and for compliance with the corresponding obligations under Articles 9(1) and 9(5) of the DSA. Likewise, orders for the provision of information must specify a time limit for execution and compliance with the obligations under Articles 10(1) and 10(5) of the DSA. In the context of requests for information issued by the Digital Services Coordinator, the time limit for compliance may not be less than 10 working days, except in duly substantiated cases of urgency.

Entry into Force and Financing

Law 12-A entered into force on 20 April 2026.

The financing of the Digital Services Coordinator's functions is ensured through revenues from the 5G spectrum auction. The annual budget allocation amounts to €2,175,000 for 2025 and €3,080,000 for 2026, as set out in the annex to Law 12-A. For the 2027 to 2029 financial years, financing will continue to be derived from the same source.

What Providers of Online Intermediary Services Need to Do

Immediate Compliance Obligations

Providers of online intermediary services should act promptly to ensure compliance with a number of core obligations arising under the DSA, as implemented in Portugal, according to the category of service they provide. These obligations include the designation of a single point of contact for authorities and users of the service, the formal appointment of a legal representative where the provider is not established in the EU, and the publication of annual transparency reports on content moderation. The 2025 transparency reports should have been published by the end of February.

These are obligations for which Law 12-A establishes specific infringement provisions. Failure to comply may therefore give rise to administrative offence proceedings and the imposition of administrative fines.

Compliance Assessment for Other DSA Obligations

Providers should undertake a comprehensive assessment of their compliance with the full range of obligations applicable to them under the DSA. These include, inter alia, obligations relating to the availability and content of terms and conditions, the establishment of notice-and-action mechanisms, the provision of statements of reasons for content moderation decisions, the establishment of internal complaint-handling systems, cooperation with out-of-court dispute resolution bodies (applicable to online platforms), transparency in advertising, the traceability of traders on online marketplaces, and the protection of minors.

Law 12-A provides for administrative fines of up to 6% of the provider's worldwide annual turnover for the most serious infringements, which underscores the importance of conducting a thorough and timely compliance review.