PORTUGAL: An Introduction to TMT

Main Trends and Legal Challenges of the TMT Sector in Portugal

Portugal has been fruitful in new initiatives in the TMT sector, in line with international trends. For instance, Portugal’s privileged geographic location has established the country as a critical landing point for submarine cables, attracting big tech companies like Meta, Google and EllaLink. The Portuguese government has instructed certain authorities to take actions aimed at streamlining the licensing procedures for the installation of submarine cables, which may further increase this industry’s attractiveness.

Furthermore, a procedure for granting individual rights of use for radio spectrum in the 26 GHz range is expected soon, which will enable the development of multiple 5G and IoT solutions supported by millimetre-wave bands.

In addition to these trends, the TMT sector faces various legal challenges that can impact operations and profitability of its players. One of the most pressing concerns is the growing adoption of emerging technologies, particularly AI, and the complexities surrounding its regulation. Compliance with evolving legal frameworks entails significant regulatory costs and challenges in ensuring that technology solutions remain future-proof. Data and cybersecurity threats have significantly increased, posing serious risks to corporate reputations and exposing companies to substantial fines and liabilities. Regulators are scrutinising the TMT sector around issues such as compliance, consumer protection, and content moderation. TMT companies must address these legal challenges proactively to protect their interests, maintain their reputation, and remain competitive.

Electronic communications sector

General legal framework

Law 16/2022 (the “Electronic Communications Act”), transposing into national law Directive (EU) 2018/1972, is at the core of the sector’s regulatory framework. Other relevant acts include the Decree-Law 123/2009, which defines the legal regime of construction, access and installation of electronic communications networks and physical infrastructures (which shall be replaced by Regulation (EU) 2024/1309 – ie, the “Gigabit Infrastructure Act” with effect from 12 November 2025).

Requirements for obtaining a licence/authorisation to provide electronic communications services and networks

Undertakings that wish to provide publicly available electronic communication services and networks in Portugal are required to submit a communication, through a pre-approved form, to ANACOM (the Portuguese regulatory authority for the communications sector) before commencing their activities under the general authorisation regime. Some undertakings, such as operators of number-independent interpersonal communications services, are exempt from this prior communication obligation.

Framework applicable to operators of interpersonal communications services

The Electronic Communications Act has brought about significant changes to the provision of interpersonal communication services, which were not defined under the previous framework. For instance, operators of number-based interpersonal communications services are now subject to the general authorisation regime, placing them alongside traditional operators in certain matters, such as end-user protection requirements, reflecting their market growth. Number-independent interpersonal communications services have a more light-touch regime.

Security of electronic communications networks and services

The Electronic Communications Act and ANACOM Regulation No 303/2019 set forth a series of obligations that operators must comply with regarding the security of electronic communications networks and services. These obligations require undertakings, among other things, to (i) implement technical and organisational measures that ensure a security level proportional to the risks posed to the security of networks and services, and (ii) notify significant security incidents affecting the operation of networks or services to ANACOM and the Portuguese Cybersecurity Centre (CNCS). The rules set forth in the Electronic Communications Act governing these matters, as well as ANACOM Regulation No 303/2019, will be replaced by the legislation transposing Directive (EU) 2022/2555, which is expected to be published and enter into force soon.

Annual or recurring fees

Under the Electronic Communications Act, undertakings subject to the general authorisation framework are obliged to pay (i) the annual financial contribution (superseding the annual fee, whose outlines were partially ruled unconstitutional by the Constitutional Court’s Ruling No 779/2024); (ii) radio spectrum and numbering resources fees, if applicable; and (iii) rights of way fee (of up to 0.25% of the total monthly bill issued to end customers within a specific municipality).

Coverage of “white areas” with very high-capacity networks

In the context of the National Strategy for Connectivity in Very High-Capacity Electronic Communications Networks 2023-2030, a public tender for the installation, operation, and maintenance of very high-capacity networks in areas currently without coverage (“white areas”) was recently launched. This tender entails an investment of EUR425 million and aims to enhance network coverage across the white areas. The selected entities are expected to be revealed during 2024.

Broadcasting/media sector

General legal framework

Besides the consumer protection panoply and the laws related to advertising and unfair commercial practices, the main legal instrument for regulation of the broadcasting sector is TV Law (Law 27/2007). Regarding other media-related activities, Radio Law (Law 54/2010) applies to radio broadcasting, while press activity is regulated by Law 2/1999.

Requirements for obtaining a licence/authorisation to provide services

Audiovisual service providers, depending on the nature of the services they provide, are subject to (i) licensing, by means of public tender, or (ii) authorisation, or (iii) registration requirements which they must meet before they begin providing services in Portugal. The competent authority for this purpose is the ERC (the Portuguese regulatory authority for the media sector).

Restriction on common ownership/limits on participation

The TV Law only restricts the common ownership of free-to-air channels with nationwide coverage to protect and promote plurality. Specifically, the same natural or legal person cannot hold, directly or indirectly, ≥50% of the total licences available in the market for free-to-air channels with nationwide coverage for similar services with the same coverage.

Data protection and cybersecurity

General overview of the current and prospective legal framework

Portugal has a well-established Data Protection Framework based on the GDPR and Law 58/2019 and further supported by EU and national guidelines and case law. In recent years, the Portuguese Data Protection Authority (CNPD) has been particularly active, with a focus on international data transfers, marketing communications, and data subjects’ rights. In addition, Law 18/2024, which was published and entered into force in early February 2024, introduces new obligations and requirements on access to electronic communications metadata for criminal investigation purposes. Furthermore, several EU regulatory initiatives are expected to impact the Portuguese market directly, such as the Data Governance Act (including the national implementing Decree-Law 2/2025) or the recently published (but not yet applicable) Data Act.

Moreover, the national Cybersecurity Framework consists of Law 46/2018, introducing security requirements and incident notification obligations for various entities, such as operators of essential services, the Cybersecurity Act (Decree Law 65/2021) and Commission Implementing Regulation (EU) 2018/151. This framework will soon be revoked (a draft transposition decree-law recently underwent public consultation and is expected to be published and enter into force soon) by a Decree-Law transposing Directive (EU) 2022/2555, a matter to be closely followed by electronic communications operators, as they are within the latter’s scope.

Finally, Regulation (EU) 2022/2554 (DORA) on digital operational resilience for the financial sector establishes a common framework for managing risks associated with information and communication technologies and requires financial entities to ensure a high level of digital operational robustness, which includes implementing protection measures against cyber-attacks and other ICT-related vulnerabilities.

Digital services

General overview of the Digital Services Act

The DSA, together with the DMA, marks a new era of regulation in the EU’s digital ecosystem. Applicable to a wide range of intermediary services and governed by the principle of “what is illegal offline should be illegal online”, its main goal is to create a secure, predictable, and trustworthy online environment, by imposing, for instance, (i) measures to counter illegal content, goods, and services online, and (ii) effective safeguards for content moderation. ANACOM was designated as the Digital Services Coordinator in Portugal, alongside other competent authorities. An implementing law for the DSA in Portugal was proposed in November 2024 and it is expected to be published soon.

IT sector

Blockchain

Despite notable growth in recent years, there are relatively few significant new projects in the Web3 space. However, the adoption of blockchain and smart contract solutions continues, particularly in areas such as data sharing, digital identity, the NFT market, and the Metaverse.

While the EU has introduced several Web3-related initiatives, such as the DLT Regulation, 5AMLD, MiCA, EUDIR, and the Data Act, there is still no unified regulation for DLT, smart contracts, or NFTs in Portugal. Nevertheless, the EU Blockchain and Web3 Strategy, which aims to establish a “gold standard” for blockchain and promote the use of DLT and smart contracts, is expected to significantly impact the Portuguese market.

Artificial Intelligence

The AI market is rapidly growing, with numerous start-ups and SMEs offering a wide range of AI-based solutions. In Portugal, two projects funded by the Portuguese government and the European Council’s NextGenerationEU programme are driving the development and adoption of responsible AI solutions and policy standards, including the sustainable implementation of the AI Act:

• the Center for Responsible AI Consortium; and
• Bridge AI.

These initiatives align with the National Digital Strategy, which aims to boost innovation and investment in the AI ecosystem.

The AI Act, which came into force on 2 August 2024, is directly applicable in Portugal and is expected to have a significant impact on the Portuguese market. To ensure compliance and protect fundamental rights under the AI Act, the Portuguese government has designated 14 public authorities, co-ordinated by ANACOM, to oversee its implementation.

Furthermore, the Portuguese legislature is set to transpose the Product Liability Directive II by 9 December 2026, and, once finalised, the AI Liability Directive (currently in proposal form).