Digital Services Act (DSA): Portugal Enacts the Implementing Law

On April 15, Law No. 12-A/2026 (“DSA Law”) was published in the Official Gazette, ensuring the implementation, within the domestic legal system, of Regulation (EU) 2022/2065 (Digital Services Act – “DSA”). This law establishes the national framework for supervision, oversight, and enforcement in Portugal.

Competent Authorities

The National Communications Authority (“ANACOM”) is designated as the competent administrative authority and as the Digital Services Coordinator (“DSC”). It will serve as the single point of contact for all matters related to the application of the Regulation.

The following are also designated as competent administrative authorities for specific matters:

• Regulatory Authority for the Media (“ERC”): responsible for supervising and enforcing provisions regarding terms and conditions applicable to minors, the transparency of commercial communications, and the protection of minors on online platforms;
• National Data Protection Commission (“CNPD”): responsible for supervising and enforcing provisions covering the prohibition of advertising based on profiles built using sensitive data, as well as advertising targeted at minors.

An Advisory Council is also established, responsible for supporting the competent authorities and issuing recommendations for the effective implementation of the Regulation and the law.

Penalty System

The DSA Law classifies non-compliance with the obligations arising from the Regulation as administrative offenses and establishes a two-tiered fine structure:

• Less serious infringements: maximum fine of 1% of global annual turnover (legal entities) or annual income (natural persons);
• More serious infringements: maximum fine of 6% of global annual turnover (legal entities) or annual income (natural persons), plus a periodic penalty payment of up to 5% of the global average daily turnover, per day, for a maximum of 30 days.

In cases of negligence or attempted violations, the maximum amounts are reduced by half. Failure by management bodies to comply with the determinations issued to them by the CSD constitutes an independent administrative offense.

Practical implications

• Requests for information: the CSD may request information from intermediary service providers in the event of a suspected violation, with a minimum response period of 10 business days, except in duly justified urgent cases.
• Provisional measures: during an investigation, the CSD may impose provisional measures when there is sufficient evidence of an ongoing violation likely to cause serious harm that cannot be prevented before a final decision.
• Binding commitments: service providers may submit compliance commitments to the CSD; acceptance of such commitments suspends ongoing administrative violation proceedings and prevents new proceedings regarding the same facts for the duration of the commitment.
• Liability of management bodies: as a last resort, the CSD may issue a written determination to the management body, requiring an action plan to cease the violation. Failure to comply constitutes an independent administrative offense and may entail direct liability of management.
• Orders regarding illegal content: the competent authorities may order service providers to take action regarding illegal content, under the terms and conditions provided by law.
• Judicial review: CSD decisions may be appealed to the Court of Competition, Regulation, and Supervision and, in the final instance, to the Lisbon Court of Appeal.

Next steps

Covered entities must assess the impact of the DSA on their internal processes, ensure the designation of contact points and, where applicable, legal representatives, and review their content moderation, advertising, and child protection policies.

Representatives on the Advisory Board must be designated within 90 days of the law’s entry into force.