Law No. 12-A/2026: Portugal, Platform Obligations, Offence Regime, Fines & Enforcement

Portugal’s Law No. 12-A/2026, published in the Diário da República on 15 April 2026, implements the EU Digital Services Act (Regulation (EU) 2022/2065) into the Portuguese legal order and reshapes the compliance landscape for every digital service provider operating in or reaching Portuguese users. The statute designates ANACOM as the national Coordinator of Digital Services, introduces a tiered administrative offence regime (contraordenação) with fines scaled to global turnover, and imposes concrete platform obligations covering notice-and-action workflows, transparency reporting and data preservation. This guide breaks down who is in scope, what must change operationally, who enforces, the penalty exposure and a practical 90-day compliance checklist that in-house teams can act on immediately.

Key Takeaways for Platform Teams

• Immediate effect. Law No. 12-A/2026 entered into force on 20 April 2026, five days after publication. Compliance obligations are already live.
• ANACOM is the primary regulator. The Autoridade Nacional de Comunicações (ANACOM) acts as the national Digital Services Coordinator, with ERC and CNPD handling sectoral competences.
• Fines reach 6 % of global turnover. The most grave administrative offences carry fines of up to 6 % of annual worldwide turnover; coercive pecuniary measures can add up to 5 % of average daily turnover per day of non-compliance.
• Notice-and-action SOPs are mandatory. Platforms must receive, process and act on determinations issued by judicial or administrative authorities within prescribed deadlines, maintaining auditable records throughout.
• Transparency reports are non-negotiable. Periodic reporting requirements apply to all intermediary categories, with enhanced monthly obligations for very large online platforms (VLOPs) and very large online search engines (VLOSEs).

Overview: What Is Law No. 12-A/2026 and Its Legal Basis

Law No. 12-A/2026 (Lei n.º 12‑A/2026, de 15 de abril) is the Portuguese implementing statute for the Digital Services Act (DSA), formally known as Regulation (EU) 2022/2065 of the European Parliament and of the Council. While the DSA is directly applicable in all EU Member States, it expressly requires each Member State to designate competent national authorities, define the administrative offence framework and establish procedural rules for enforcement. Law No. 12-A/2026 fulfils each of these mandates for Portugal.

The law was published in the Diário da República on 15 April 2026. It entered into force on 20 April 2026, following the standard five-day vacatio legis rule. Alongside establishing the new enforcement architecture, the statute amends Decree-Law No. 7/2004 of 7 January (Portugal’s pre-existing e-commerce regime), modifies the Law on the Organisation of the Judicial System, and repeals Decree-Law No. 20-B/2024, the interim measure that had previously governed DSA coordination on a provisional basis.

For compliance teams, the critical timeline is this: DSA obligations under EU law have applied since 17 February 2024 (for all providers) and since 25 August 2023 (for designated VLOPs and VLOSEs). What Law No. 12-A/2026 adds is the domestic enforcement machinery, the authorities, the fines, the investigation powers and the procedural rules that determine how non-compliance is detected and sanctioned in Portugal specifically.

Who and What Is in Scope Under Law No. 12-A/2026

The statute applies to all categories of intermediary service providers as defined in the Digital Services Act Portugal framework, including mere conduit services, caching services, hosting services, online platforms, online marketplaces, and very large online platforms and search engines. The territorial scope follows the DSA’s establishment-based and effects-based tests: providers established in Portugal fall under Portuguese jurisdiction, as do non-EU providers that direct services to Portuguese users and have designated a legal representative in a Member State.

Law No. 12-A/2026 layers additional Portuguese-specific procedural duties on top of the DSA baseline. Industry observers expect that platforms with a Portuguese user base, even if headquartered elsewhere, will need to engage directly with ANACOM on information requests and enforcement orders.

Platform Obligations Portugal: Notice & Action, Transparency and Risk Assessments

Law No. 12-A/2026 specifies the common duties that intermediary service providers must fulfil, building on the obligations established by the DSA itself. For compliance teams, three operational pillars demand immediate attention: notice-and-action handling, transparency reporting and data preservation.

Notice-and-Action Workflow

The statute requires platforms to receive and process determinations issued by competent judicial or administrative authorities regarding illegal content removal in Portugal. Operationally, this means:

• Single point of contact. Each provider must designate and publish a legal point of contact for Portuguese authorities, ensuring that orders reach the correct team without delay.
• Structured receipt and triage. When an authority order is received, the platform must log it, verify its authenticity, triage it to the relevant internal team (legal, trust & safety, product) and commence action within the deadline set by the issuing authority.
• Action and counter-notice. Where the platform acts on a notice (by restricting or removing content), it must inform the affected user and provide a statement of reasons. Users have the right to submit a counter-notice, which the platform must consider and respond to within a reasonable period.
• Record-keeping. All determinations, actions taken and communications must be retained in an auditable format. Law No. 12-A/2026 empowers authorities to establish specific time limits for providers to comply with their orders and information requests.

Transparency Reporting, What to Include

All intermediary service providers must publish periodic transparency reports detailing the volume and type of content moderation actions taken, the number of authority orders received and processed, and the outcomes of internal complaint-handling mechanisms. VLOPs and VLOSEs face enhanced reporting requirements, including monthly reporting on systemic risks and the measures adopted to mitigate them. These reports must be made publicly accessible and submitted to ANACOM as the national Coordinator under Portugal’s DSA enforcement framework.

Data Preservation and Information Requests

Platforms must preserve evidence and produce data upon request from competent authorities. This includes user data, content logs, and metadata relevant to investigations into illegal content or systemic risk assessments. The GDPR continues to apply in full, the CNPD (Comissão Nacional de Proteção de Dados) remains the competent authority for data protection issues in Portugal. Where a data breach occurs, platforms must notify the CNPD within 72 hours in accordance with GDPR requirements and, where the breach affects Portuguese users in connection with DSA-regulated services, cooperate with ANACOM on any related enforcement action. The practical effect is that compliance teams must maintain parallel notification workflows: one for data protection (CNPD/GDPR) and one for DSA-related content and systemic obligations (ANACOM).

Administrative Offence Regime Portugal: Fines and Coercive Measures

Law No. 12-A/2026 establishes a detailed administrative offence (contraordenação) regime that classifies breaches into two tiers, less grave and most grave, each with penalty bands calibrated to the seriousness of the infringement and the provider’s global turnover. This framework for fines for online platforms in Portugal is one of the most consequential aspects of the new law.

Fine Bands

• Less grave offences (e.g., failures in transparency reporting, incomplete record-keeping, delays in responding to information requests): fines of up to 1 % of annual worldwide turnover for legal persons. For individuals (including directors or managers held personally liable), equivalent caps apply based on personal income.
• Most grave offences (e.g., systematic failure to process authority orders, persistent non-compliance with content moderation obligations, obstruction of investigations): fines of up to 6 % of annual worldwide turnover.
• Negligence and attempt. Where the offence is committed through negligence rather than intent, or where the offence remains at the attempt stage, the applicable fines are reduced in accordance with the general principles of Portuguese administrative offence law.

Coercive Pecuniary Measures

In addition to fines, the competent authority may impose coercive pecuniary measures (sanções pecuniárias compulsórias) of up to 5 % of average daily turnover per day of continued non-compliance, for a maximum period of 30 days. These measures are designed to compel prompt action where a platform fails to comply with an order or determination within the prescribed deadline.

Worked Example

These figures illustrate why DSA Portugal enforcement carries board-level significance. Even for mid-size platforms, the combined exposure from a fine plus coercive measures can reach seven figures.

Who Enforces Law No. 12-A/2026: ANACOM, ERC and CNPD

One of the most operationally important aspects of Law No. 12-A/2026 is its designation of competent national authorities and the allocation of supervisory competences among them. Understanding which authority does what is essential for platforms determining where to direct responses and how to manage enforcement risk.

The law establishes formal cooperation protocols between these three authorities. ANACOM, as Coordinator, acts as the primary interface between Portuguese enforcement and the European Board for Digital Services. Early indications suggest active inter-agency coordination is already underway, ANACOM has been engaging with platforms and technology providers on practical implementation since the statute’s entry into force. For platforms operating in Portugal, the likely practical effect is that ANACOM will be the first point of contact for most DSA enforcement activity, but investigations with a data protection dimension will involve CNPD in parallel, and media-sector platforms should anticipate ERC involvement.

Compliance Checklist and Practical Timelines for Platforms

For platform teams operationalising compliance with Law No. 12-A/2026, the following checklist provides a structured 90-day implementation pathway. Given that the statute is already in force, teams should treat this as a prioritisation framework rather than a future-dated plan.

Days 1–30: Foundation

• Governance. Appoint a DSA compliance officer or team; assign board-level accountability for Portuguese enforcement risk.
• Legal point of contact. Designate and publish a single point of contact for ANACOM and other Portuguese authorities.
• Gap analysis. Map existing content moderation, notice-and-action and transparency workflows against Law No. 12-A/2026 requirements. Identify gaps in record-keeping and evidence preservation.
• GDPR alignment. Confirm that data breach notification workflows route to CNPD (72-hour GDPR timeline) and that DSA-related data requests from ANACOM are handled through a separate, tracked process.

Days 31–60: Operationalisation

• Notice-and-action SOP. Draft or update standard operating procedures for receiving authority orders, triaging them, executing content actions and issuing statements of reasons to affected users.
• Template responses. Prepare template acknowledgement, action confirmation and counter-notice responses for ANACOM orders.
• Vendor and subprocessor review. Audit third-party agreements (hosting, moderation, advertising) to ensure contractual compliance with DSA obligations and data preservation duties.
• Training. Roll out training for trust & safety, legal and product teams on the new enforcement landscape, including escalation protocols for most grave offences.

Days 61–90: Reporting and Audit Readiness

• Transparency report preparation. Establish data collection pipelines for periodic (or monthly, for VLOPs/VLOSEs) transparency reporting. Define metrics, templates and publication schedules.
• Audit trail. Implement or upgrade logging systems to create immutable records of all authority interactions, content moderation decisions and user notifications.
• Risk assessment. For VLOPs and VLOSEs, conduct or update systemic risk assessments and document mitigation measures. Prepare for independent audit requirements.
• Legal review. Engage administrative law counsel to review enforcement response protocols, appeal strategies and privilege management procedures. If you need specialist guidance, contact Global Law Experts for a referral to qualified Portuguese administrative lawyers.

Enforcement Procedure: Investigations, Orders, Appeals and Judicial Review

When a platform receives an investigation order or determination from ANACOM under Law No. 12-A/2026, the following practical steps apply:

1. Receipt and acknowledgement. Log the order immediately; confirm receipt to ANACOM within the timeframe specified in the order itself.
2. Internal triage. Route the order to legal counsel for privilege review and to the operational team responsible for execution.
3. Evidence production. Gather and produce the requested information or take the required content action within the deadline. Failure to comply triggers coercive pecuniary measures.
4. Right to be heard. Before a fine is imposed, the platform has the right to present its defence under Portuguese administrative procedure rules.
5. Appeal. Decisions may be challenged through administrative appeal to the relevant authority and, subsequently, through judicial review in the Portuguese administrative courts, ultimately reaching the Supreme Administrative Court (Supremo Tribunal Administrativo).

Conclusion: Immediate Actions Under Law No. 12-A/2026

Law No. 12-A/2026 is not a future obligation, it is already in force. Platforms serving Portuguese users must designate a legal point of contact, operationalise notice-and-action workflows, prepare transparency reports and ensure their record-keeping meets the evidentiary standards that ANACOM can demand at any time. The administrative offence regime Portugal has enacted carries fines that scale to global turnover, making non-compliance a genuine financial risk at board level. For in-house teams and external counsel, the priority now is to close the gap between existing content moderation practices and the specific procedural requirements that Law No. 12-A/2026 imposes.

Those seeking specialist administrative law guidance on Portuguese DSA implementation can find qualified practitioners through the Global Law Experts network, request a referral here.

Sources

1. Diário da República, Lei n.º 12‑A/2026, de 15 de abril
2. PGD Lisboa, Lei n.º 12‑A/2026 (consolidated text)
3. ANACOM, Digital Services Coordinator announcements
4. CNPD, Comissão Nacional de Proteção de Dados
5. EUR-Lex, Regulation (EU) 2022/2065 (Digital Services Act)