Law No. 133/V/2001 on the Protection of Personal Data, cross border transfer

Lei n.º 133/V/2001, de 22 de Janeiro, arts. 19-20 (transferência internacional de dados)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Confirm that a destination country ensures a level of data protection at least equal to this law's before transferring personal data there, and expect the CNPD to decide adequacy by the nature, purpose and duration of the processing, the country of origin and destination, and the legal, professional and security rules in force there.
Before transferring personal data to a country that does not ensure an adequate level of protection, obtain the CNPD's authorisation based on the data subject's unequivocal consent or one of the law's other listed grounds, such as contractual necessity, an important public interest or legal claim, the data subject's vital interests, or a public register open to consultation.
Provide adequate contractual guarantees for the privacy and fundamental rights of data subjects, such as appropriate contractual clauses, to obtain the CNPD's authorisation for an ongoing transfer to a country without an adequate level of protection.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 19 permits transfer of personal data undergoing or intended for processing only in compliance with this law and other applicable data protection legislation, and to a State that has an adequate level of data protection, leaving it for the CNPD to decide whether a foreign State ensures that adequate level.

Article 20 lets the CNPD allow a transfer to a State that does not ensure an adequate level of protection where the data subject has given unequivocal consent, or where the transfer is necessary for a contract with or for the benefit of the data subject, for an important public interest or a legal claim, to protect the data subject's vital interests, or is made from a public register open to consultation by the general public or a person with a legitimate interest.

Article 20 also lets the CNPD authorise an ongoing transfer to a State without an adequate level of protection for as long as the controller provides adequate contractual guarantees for the privacy and fundamental rights of individuals.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

Official English translation of Law No. 133/V/2001 of 22 January
on the Protection of Individuals with Regard to the Processing of Personal Data, published by the Comissão Nacional de Protecção de Dados (CNPD)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app