Law No. 133/V/2001 on the Protection of Personal Data, rights of data subjects

Lei n.º 133/V/2001, de 22 de Janeiro, arts. 11-14 (direitos dos titulares dos dados)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Tell a data subject, except where they already know it, your identity and any representative's, the purposes of processing, the recipients or categories of recipients, whether a reply is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access and rectification, at the time of collection or, if not collected from the data subject, no later than first disclosure to a third party.
Warn a data subject, when their data is collected over an open network and unless they already know it, that their personal data may circulate without security measures and risk being seen or used by unauthorised third parties.
Give a data subject, without constraints, at reasonable intervals and without excessive delay or expense, confirmation of whether you process their data, the purposes, categories and recipients, an intelligible copy of the data and its source, and let them exercise access to health data, including genetic data, through a doctor of their own choosing.
Let a data subject object, on compelling legitimate grounds relating to their particular situation, to processing you carry out for a public interest or legitimate interest ground, and let them object free of charge and without needing a reason to processing, or a first disclosure to a third party, for direct marketing or other research purposes.
Do not base a decision that produces legal effects on, or significantly affects, a person solely on automated processing evaluating personal aspects such as their work performance, creditworthiness, reliability or conduct, unless it occurs in entering into or performing a contract at the data subject's request with safeguards for their legitimate interests, or the CNPD has authorised it with safeguards.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 11 requires the controller or their representative to provide a data subject, from whom data is collected, with at least their identity and address, the purposes of processing, the recipients or categories of recipients, whether replying is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access and rectification, at the time of collection or, where data comes from elsewhere, no later than its first disclosure to a third party.

Article 11 also requires the data subject to be warned, when their data is collected over an open network and unless they already know it, that it may circulate without security measures and risk being seen or used by unauthorised third parties.

Article 12 gives a data subject the right to obtain from the controller, without constraints, at reasonable intervals and without excessive delay or expense, confirmation of whether their data is processed, the purposes, categories and recipients, an intelligible copy of the data and its source, and lets the data subject exercise access to health data, including genetic data, through a doctor of their own choosing.

Article 13 lets a data subject object, on compelling legitimate grounds relating to their particular situation, to processing carried out for a public interest or legitimate interest ground, and object free of charge and without needing a reason to processing, or a first disclosure to a third party, for direct marketing or other research purposes.

Article 14 gives every person the right not to be subject to a decision that produces legal effects concerning them or significantly affects them, based solely on automated processing intended to evaluate personal aspects such as their performance at work, creditworthiness, reliability or conduct, subject to Article 14(2)'s exception for a contract related automated decision with safeguards or the CNPD's own authorisation.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
generates_content

Read the law

Official English translation of Law No. 133/V/2001 of 22 January
on the Protection of Individuals with Regard to the Processing of Personal Data, published by the Comissão Nacional de Protecção de Dados (CNPD)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app