Data Processing Agreement in Portugal: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) is the written contract that must exist whenever one organisation (the controller, which decides why and how personal data is processed) uses another (the processor, which processes that data on the controller's instructions). It is not an optional add-on. Where a processor handles personal data for a controller, EU law requires a contract with a defined set of terms, and a missing or inadequate DPA is itself a breach that can be fined. In Portugal the rules come from the EU General Data Protection Regulation (GDPR), which applies directly, and from the national implementing Law 58/2019, overseen by the data protection authority, the Comissao Nacional de Protecao de Dados (CNPD). This guide sets out the law that actually bites, the clauses a Portugal DPA must contain under Article 28 GDPR, and a section-by-section skeleton you can adapt. It is general information, not legal advice; confirm the detail with qualified Portuguese counsel before you sign. ## Portugal: the local law that shapes your DPA The controlling instrument is Article 28 of the GDPR. It states that processing by a processor must be governed by a contract that is binding on the processor, sets out the subject matter, duration, nature and purpose of the processing, the type of personal data and categories of data subject, and the obligations and rights of the controller. It then lists the specific terms the contract must contain, which are set out below. Because the GDPR is a Regulation, these requirements apply in Portugal in the same words as across the EU. Portugal's Law 58/2019 implements and supplements the GDPR nationally. It confirms the CNPD as the supervisory authority, with powers of investigation, audit and access to a controller's or processor's premises, and it addresses matters the GDPR leaves to member states. For the content of a DPA, Article 28 is the master text; Law 58/2019 and the CNPD's guidance sit around it. Note that after Law 58/2019 was enacted, the CNPD by resolution set aside several provisions it considered incompatible with the GDPR, so always read the statute together with the GDPR itself. ### International transfers If the processor or a subprocessor is outside the European Economic Area, the DPA must also address a lawful transfer mechanism, most often the European Commission's Standard Contractual Clauses, plus any supplementary measures the transfer needs. Build this into the DPA rather than leaving it to a side letter. ## The clauses a Portugal DPA must contain Article 28(3) GDPR sets a mandatory checklist. A compliant DPA must require the processor to: - Process only on documented instructions from the controller, including on international transfers, unless required to act by law.

• Ensure confidentiality, so that people authorised to process the data are bound to keep it confidential.
• Apply appropriate security measures under Article 32 (the security of processing).
• Respect the rules on subprocessors, engaging another processor only with the controller's authorisation and passing the same obligations down the chain by contract.
• Assist the controller in responding to data subject requests (access, erasure, portability and the rest).
• Assist with compliance on security, breach notification, data protection impact assessments and prior consultation.
• Delete or return all personal data at the end of the services, and delete existing copies unless storage is legally required.
• Make available the information needed to show compliance, and allow and contribute to audits and inspections by the controller or an appointed auditor. Around that core, a workable DPA also sets out the detail Article 28(3) opens with: the subject matter and duration, the nature and purpose, the types of data and categories of data subject, breach notification timing, the transfer mechanism, and the list of approved subprocessors. ## A data processing agreement skeleton you can adapt Use this running order as a drafting checklist. It is a skeleton, not a finished contract, and it is not legal advice. 1. Parties, and their roles as controller and processor

2. Definitions (aligned to the GDPR)
3. Subject matter, duration, nature and purpose of processing
4. Types of personal data and categories of data subject (often an annex)
5. Processing only on documented instructions
6. Confidentiality of authorised persons
7. Security measures (Article 32), often a technical and organisational measures annex
8. Subprocessors: authorisation, flow-down and liability
9. Assistance with data subject rights
10. Assistance with security, breach notification, impact assessments
11. Personal data breach notification timing and content
12. International transfers and the transfer mechanism
13. Deletion or return of data on termination
14. Audits, inspections and records
15. Liability, and interaction with the main agreement
16. Governing law (Portuguese) and the relationship to the underlying contract ## Common mistakes to avoid - Treating the DPA as boilerplate. Article 28 is a mandatory checklist. Dropping one of the required terms leaves the contract non-compliant even if every commercial point is covered.

• Vague instructions. The processor must act only on documented instructions. If the DPA does not describe the processing precisely, that limit is meaningless.
• Ignoring subprocessors. Every subprocessor must be authorised and bound by the same terms. An unflowed-down chain is a common audit failure.
• Forgetting transfers. If data leaves the EEA, name the mechanism. Standard Contractual Clauses do not apply themselves.
• No deletion plan. The DPA must say what happens to the data at the end. Keeping it indefinitely with no basis is a breach. ## Keeping the agreement alive after signing The work does not stop at signature. A DPA carries a living subprocessor list, breach-notification clocks, audit rights, transfer mechanisms that change when the law changes, and a deletion obligation at the end of each underlying contract. Most problems come not from a badly drafted clause but from a subprocessor added without notice, a breach clock missed, or a deletion step nobody tracked. That is the case for keeping drafting, review, version history and obligation tracking in one place rather than spread across inboxes, a shared drive and a spreadsheet. Adira is one such AI workspace: you draft from your own templates, see each clause flagged as favourable, neutral or unfavourable to you, edit clauses in plain English, and keep a live timeline of every subprocessor change, audit and obligation, built on Anthropic's Claude. Adira is India-first today; deeper support for Portuguese and EU data protection law is on its roadmap rather than live, so treat it as a workflow layer here and keep local counsel for the legal substance.