GDPR for Employees (Portugal)

The GDPR requires the controller to apply appropriate technical and organisational measures, and provides that anyone working under its authority may process data only on its instructions (Articles 24, 29 and 32). The law does not require a particular course or certificate. Training employees is a common way of meeting those duties.

No. It is a certificate of completion: it shows that you finished the course and passed the test. It is not a course certified by DGERT (the Directorate-General for Employment and Industrial Relations) or a regulated qualification, and it is not accredited or approved by the CNPD (the National Data Protection Commission) or any other public body. The employer decides whether this training meets the company's needs.

The employer is the controller. It must still set internal policies and instructions, including specific instructions for each job and system, inform workers and data subjects, keep the record of processing activities where required, sign contracts with processors, apply security measures, have procedures for personal data breaches and for requests from data subjects, and appoint a data protection officer and publish their contact details where the law requires it. A general course does not take over that responsibility.

The General Data Protection Regulation (Regulation (EU) 2016/679), Lei n.º 58/2019 of 8 August (Law 58/2019, which implements the GDPR in Portugal) and the rules of the Código do Trabalho (Labour Code) on private life, remote monitoring and messages (Articles 16 to 22). It deals with the principles, lawfulness, special category data, monitoring and biometrics at work, data subjects' rights, security and phishing, personal data breaches and penalties. The rules may change. See more at cnpd.pt.

The CNPD. Lei n.º 58/2019 classifies infringements as very serious and serious administrative offences (Articles 37 and 38). The limits are those of Article 83 of the GDPR: up to €20 million or 4 % of worldwide annual turnover for the most serious infringements, and up to €10 million or 2 % for the rest. The CNPD has stated that it does not apply the amounts the law sets according to the size of the entity, because it considers them contrary to the GDPR. Fines apply to public bodies too. Some acts, such as unauthorised access to data, are crimes and are tried by the courts. The last lesson explains this.

The course covers the rules that apply in every workplace. Some sectors have rules of their own, for example health, education, public administration and finance. Ask your employer which specific rules and systems apply in your job.

Most people finish the eight lessons and the 25-question test in about one to two hours. You can stop and continue later on the same device.

You pay nothing. You see which lessons are worth reviewing and can retake the test as many times as you need.

Only after you pass: €12 for the certificate. The course and the test are free.

Every certificate has a number and a QR code. When it is scanned, or when the number is entered on our verification page, your name, the course and the date you passed appear.

The law sets no period of validity for this kind of training. It is good practice to repeat training regularly, because rules and threats change. That is why the certificate states a validity of 24 months from the date you passed. Ask your employer what is required in your company.