Digital Services Act (DSA): Portugal Approves Implementation Law

On 27 February 2026, the Draft Law ensuring the implementation, within the domestic legal order, of Regulation (EU) 2022/2065 (the Digital Services Act or, shortly, DSA) was approved. This legislation defines the institutional and sanctioning framework applicable to intermediary service providers in Portugal. Promulgation by the President of the Republic is now awaited.

In this context, we highlight the following points:

1. The creation of a communication platform, managed by the Coordinator, is envisaged. This platform will constitute the central channel for coordination between intermediary service providers, judicial authorities, administrative entities and the Coordinator itself, thus functioning as essential infrastructure for the implementation of the Regulation in Portugal. The law provides for the integration of this platform with the database of the registry of companies offering electronic communications networks and services, allowing the use of data relating to companies providing intermediary services in Portugal. Judicial and administrative authorities shall establish a secure connection, with access authentication, in accordance with requirements to be determined by the Coordinator.
2. The jurisdiction of the Competition, Regulation and Supervision Court in these matters is defined, with appeals lying to the Lisbon Court of Appeal.

Institutional Architecture

ANACOM is designated as the competent administrative authority and Digital Services Coordinator, serving as the single point of contact with the European Commission, the European Digital Services Board and the coordinators of other Member States.

ERC is responsible for supervising matters related to commercial communications and the protection of minors, while CNPD assumes competences regarding the protection of personal data in targeted advertising and the protection of minors.

The new law introduces Article 7-A, which imposes cooperation between competent authorities, including the conclusion of protocols, the sharing of relevant information and, where necessary for the application of the Regulation, the transmission of personal data.

An Advisory Council is also created within the structure of the Coordinator, composed of representatives from the scientific community, civil society (including consumer associations) and business associations, with advisory and recommendation-issuing functions.

Sanctioning Regime

The law establishes an administrative offence regime differentiated by type of provider:

1. Intermediary service providers in general: breach of information obligations, failure to designate a point of contact, violation of terms and conditions, among other infringements.
2. Hosting service providers: lack of diligence in removing illegal content, absence of accessible notification mechanisms, breach of content moderation obligations and failure to report crimes to authorities.
3. Online platforms: violations related to advertising, recommendation systems, protection of minors, dark patterns and manipulative interfaces, as well as breach of obligations to provide information on the number of users.
4. Online marketplaces: breach of trader traceability obligations, failure to suspend non-compliant traders and violation of duties to inform consumers about illegal products.

Fines and pecuniary penalties

Fines are determined according to the type of infringement and the nature of the infringer. For the most serious infringements, fines may reach up to 6% of annual worldwide turnover in the case of legal persons and up to 6% of annual income in the case of natural persons. For less serious infringements, the limits are 1% of annual worldwide turnover and 1% of annual income, respectively. In cases of negligence or attempt, the maximum amounts are reduced by half.

The Coordinator may also impose periodic penalty payments of up to 5% of average daily turnover, for a maximum period of 30 days, to ensure the cessation of infringements or compliance with investigation orders.

Practical implications for companies in Portugal

Intermediary service providers established in Portugal, or directing their activity here, must ensure compliance with the obligations arising from the Regulation, namely: designation of points of contact and legal representatives; provision of mechanisms for reporting illegal content; transparency in terms and conditions and recommendation systems; compliance of advertising practices; and implementation of measures for the protection of minors.

Next Steps

We will monitor the complementary regulation and the operationalisation of the communication platform. For any clarification on the impact of this regime on your organisation's activity, our team is available.

Ricardo Henriques (Partner) and Marta Boura (Of Counsel)