All news
Regulation July 24, 2026 4 min

Portugal's CNPD sets out where it will be looking until 2029

Three-year plan 2027-2029 approved after public consultation: twenty-three strategic actions, twenty already scheduled for 2027. Neurodata among the priorities

On 24 July 2026 the Comissão Nacional de Proteção de Dados approved its multiannual activity plan for 2027-2029, the report on the public consultation that preceded it, the twenty strategic actions of the 2027 plan, and the 2027 activity plan itself.

The public consultation asked just two questions: which actions are the highest priority, and what else should be developed over the three years or already in 2027. Three associations replied - AMD, APDSI and Ius Omnibus - along with a lawyer who is also a DPO.

The three strategic objectives

  • Strengthen the protection of personal data, with wider public communication of the authority's mission and of data subjects' rights, organising and optimising the available resources
  • Increase the capacity for strategic observation of the risks and opportunities of technological acceleration, in permanent dialogue with academia, science and business
  • Strengthen the regulation of personal data in Portugal through national and international cooperation mechanisms, respecting the Commission's independence

Where they will actually look

For the three-year period the authority sets out five priorities. The fifth is the striking one: neurodata formally enters the plan of a European supervisory authority.

  • Training on data protection in the digital environment
  • Digital vulnerability
  • Capacity for digital regulation, for the Digital Services Act and the Portuguese implementing law (Lei 12-A/2026, of 15 April)
  • Competences on artificial intelligence under the AI Act
  • Deepening the science of neurodata and its link to AI

Why it is worth reading

An authority's activity plan is public information almost nobody consults, and it says in advance where checks and inspections will concentrate. It works as a method for any authority, not just the Portuguese one: declared priorities are the cheapest way to know where to look first.

Of the twenty-three strategic actions for the three years, twenty were selected for 2027. The Commission notes that several are cross-cutting and do not end within the year.

Official source:CNPD - Plano Estratégico 2027-2029 e Plano de Atividades 2027 (24/07/2026)Official source:CNPD - Plano Anual de Atividades 2027 (PDF)Official source:CNPD - Consultas públicas: piano triennale, relazione e contributi ricevuti

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Regulation
nullathe decision on a worker taken by the algorithm alone, from 23 October

A dismissal decided by the algorithm is void: from 23 October in Italy

Published in Official Gazette no. 234 of 8 October 2026 and in force since 23 October, decree no. 179/2026 provides that final decisions on the employment relationship cannot be based solely on automated processing, that the worker may request an understandable explanation, and that decisions taken in breach are void. In parallel, AI systems affecting work organisation enter the risk assessment under Article 28 of decree 81/2008. For a DPO this is the rare case where the consequence is not economic but civil, and it changes how the check is framed.

Oct 08, 2026New 8 min
Regulation
3signals that make notification due

Poland's UODO: not every breach must be notified. Public-register data on one side, PESEL, health and financial data on the other

If an invoicing system leaks only a sole trader's name, business name, tax number and registered address, already public in the business register, risk is normally unlikely. If it also leaks the national ID number, purchase details revealing health, or financial data, notification is due. Either way, the decision goes into the internal register.

Oct 05, 2026New 5 min
Regulation
120days to charge you, not to fine you

The 120 days are not the deadline to fine you: they are the deadline to charge you

Anyone who built an appeal on the authority's delay should re-read the calendar. The Court clarifies three things: the complaint procedure and the sanctioning procedure are autonomous, so overrunning the nine-to-twelve months on the complaint does not extinguish the power to fine; the 120 days are for notifying the charge, not for imposing the fine; and they run from the «definitive finding», which is not the first notice but the moment the authority can assess every element — including the hearing of your side. After the charge, only the five-year limitation period remains.

Sep 20, 2026 7 min