Portugal's CNPD sets out where it will be looking until 2029

On 24 July 2026 the Comissão Nacional de Proteção de Dados approved its multiannual activity plan for 2027-2029, the report on the public consultation that preceded it, the twenty strategic actions of the 2027 plan, and the 2027 activity plan itself.

The public consultation asked just two questions: which actions are the highest priority, and what else should be developed over the three years or already in 2027. Three associations replied - AMD, APDSI and Ius Omnibus - along with a lawyer who is also a DPO.

The three strategic objectives

• Strengthen the protection of personal data, with wider public communication of the authority's mission and of data subjects' rights, organising and optimising the available resources
• Increase the capacity for strategic observation of the risks and opportunities of technological acceleration, in permanent dialogue with academia, science and business
• Strengthen the regulation of personal data in Portugal through national and international cooperation mechanisms, respecting the Commission's independence

Where they will actually look

For the three-year period the authority sets out five priorities. The fifth is the striking one: neurodata formally enters the plan of a European supervisory authority.

• Training on data protection in the digital environment
• Digital vulnerability
• Capacity for digital regulation, for the Digital Services Act and the Portuguese implementing law (Lei 12-A/2026, of 15 April)
• Competences on artificial intelligence under the AI Act
• Deepening the science of neurodata and its link to AI

Of the twenty-three strategic actions for the three years, twenty were selected for 2027. The Commission notes that several are cross-cutting and do not end within the year.