What changed
Since 15 September 2026 the CNPD treats three kinds of report concerning children's and young people's personal data as urgent. The announcement is dated 17 September. The channel does not replace the personal data breach notification under Art. 33 GDPR, does not replace the general complaint forms, and is not an interpretation of the law: it is a different way for the authority to work.
The first thing to grasp is the direction, because that is what decides whether anything needs doing. The channel creates no new obligation for the controller: it is a tool in citizens' hands, meant for reporting, not for notifying. What changes for anyone processing minors' data is not one more task. It is the speed at which a report about them reaches the authority and is picked up.
- Improper access to minors' data.
- Collection and disclosure of images or recordings with sensitive or violent content, without consent.
- Advertising targeted at minors.
The channel can be used by the children and young people themselves, and by any citizen who notices the unlawful sharing of such content. You need not be the data subject or the parent: seeing it is enough. That choice widens considerably the set of people who can start a case.
What the CNPD states it may do once a report arrives matters more than the channel itself: adopt urgent measures to limit the unlawful online spread of content that puts rights and freedoms at serious risk; pass the information to competent public authorities, judicial ones in particular; and, where the processing is cross-border, transmit the data to European Economic Area authorities through the IMI system. That last point is why this is not only a Portuguese matter: an Italian or Spanish controller processing minors' data can end up in an IMI exchange started by a Portuguese report.
Where this goes wrong
The presence of minors among a processing operation's data subjects is not enough to say this news concerns it. If it were, the school, the paediatrician, the sports club and the summer camp would all light up at once, and the DPO would stop reading the alerts. What counts is the concrete operation: filming and photographing children, platforms used by minors, behavioural advertising with minors among the recipients, access to minors' data granted to over-broad profiles.
In practice, for every client processing minors' data it is worth rereading the record looking for those operations rather than for the word «minors». Where they exist, what deserves to go on file is short: that the channel's applicability was assessed, the date, the CNPD reference and any referral made. The official form is filled in on the authority's own site and should not be reproduced elsewhere, if only because it has a captcha and rejects certain characters: a copy diverges at the first adjustment. Evidence is kept on restricted access, without duplicating sensitive content more than necessary.
The two tracks can run together
In a case involving minors' data, the Canal Prioritário and the Art. 33 GDPR breach notification can apply at the same time. The first is a report reaching the authority from outside; the second is a duty of the controller. They neither exclude nor replace one another.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free