Data protection advice that survives being tested.

Accountability under the GDPR is not a state of mind. It is an evidential burden: the organisation must be able to demonstrate compliance to a supervisory authority, to a court, to an acquirer, to a customer's procurement team — and increasingly to a client's own auditors.

Most compliance programmes are built to satisfy an internal review. Fewer are built to survive an external one. The difference tends to appear at the worst moment: after a breach, during due diligence, or when a regulator's letter arrives.

For international groups there is a second difficulty. A framework designed at headquarters rarely fits the Portuguese position exactly — Portuguese implementing law, national supervisory practice, and the CNPD's own positions can change the analysis on employee monitoring, retention, video surveillance and the handling of data subject rights.

We advise on the questions that determine whether a programme holds: whether the lawful basis is the right one rather than the convenient one; whether the records reflect what the organisation actually does; whether transfers are supported by an assessment that would withstand challenge; whether the processor arrangements allocate risk in a way the client would accept if the risk materialised.

When something goes wrong, we act quickly: breach assessment, notification analysis, communication with data subjects, and engagement with the CNPD. When a supervisory authority opens a file, we conduct the proceedings.

Where a group's framework must operate in Portugal, we work as the local anchor within it, rather than proposing a parallel structure.

GDPR · Portuguese implementing law · the ePrivacy Directive as transposed by Law 41/2004 · CNPD deliberations and guidance · EDPB guidelines · sectoral rules. Where AI, cybersecurity or financial regulation is also engaged, the analysis has to be run across all of them at once.