In the first hours of an incident?
Speak to counsel — +351 919 497 920 — monitored outside working hours · first steps01What it is
The GDPR governs the processing of personal data. Its central demand is not that an organisation comply, but that it be able to demonstrate compliance — to a supervisory authority, to a court, to an acquirer, to a customer's procurement team.
That is what makes it different from the compliance regimes that preceded it, and it is where most programmes are weakest. A policy that describes what should happen is not evidence that it does.
02Who it applies to
Controllers and processors established in the EU, and those outside the EU who offer goods or services to people in the EU or monitor their behaviour. Establishment is not required; the activity is enough.
For international groups, the practical question is usually not whether the GDPR applies but which supervisory authority leads, and whether the group framework fits the Portuguese position. Consent, direct marketing and communications with data subjects are where frameworks designed elsewhere most often fail here — national implementing law, the transposition of the ePrivacy Directive, and CNPD practice do not align across Member States.
03Core obligations
04Timeline
05Where it meets the other regimes
GDPR ↔ ePrivacy — the layering that trips people up
The ePrivacy Directive governs the storing of, or access to, information on a user's device and requires consent, subject to narrow exemptions. The GDPR supplies what consent must mean, and governs the subsequent processing. The consequence, which many organisations get wrong: legitimate interests is not available for the placing of a non-exempt cookie, however carefully the balancing test is drafted, because the ePrivacy consent requirement operates first and independently.
GDPR ↔ AI Act
The AI Act asks which systems you operate and in which role. The GDPR asks a different set of questions about the same systems — lawful basis for training data, transparency to the people affected, the rules on automated decision-making in Article 22, and whether a DPIA is required alongside the AI Act's own assessment. Satisfying one does not satisfy the other.
GDPR ↔ NIS2 and CRA — the clocks
One incident can start three clocks. NIS2 requires an early warning to the CSIRT within 24 hours where the incident is significant. The CRA requires notification to ENISA within 24 hours for actively exploited vulnerabilities and severe incidents. The GDPR requires notification to the CNPD within 72 hours where there is a personal data breach likely to result in a risk. The triggers are different, and an incident can engage one without engaging the others.
06What we are instructed on
GDPR advisory and governance, legal audits, transfers, data subject rights, breach response, and proceedings before the CNPD.
Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.