Law No. 133/V/2001 on the Protection of Personal Data, sensitive data categories

Lei n.º 133/V/2001, de 22 de Janeiro, arts. 8-9 e 16 (dados sensíveis)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process personal data revealing philosophical, ideological or political beliefs or penalty, religion, political party or trade union affiliation, racial or ethnic origin, privacy, or health and sex life including genetic data, unless the data subject has expressly consented with a guarantee of non-discrimination, a legal authorisation applies with the same guarantee, or another of the law's listed grounds is met.
Process health and sex life data, including genetic data, only through a health professional bound by professional secrecy, only for preventive medicine, medical diagnosis, care or health service management, and only once notified to the CNPD under article 23, with adequate information security measures.
Create or keep a central register on persons suspected of illegal activities or on criminal or administrative offences, penalties or security measures only as a public service acting under a legal provision cleared with the CNPD's prior opinion, or under the CNPD's own authorisation, and limit processing for police investigation to what a specific danger or a particular offence requires.
Take the listed special security measures for sensitive, credit and solvency, and criminal record data, including controlling entry to processing premises, controlling who can read, copy, alter or transmit the data, and logically separating health and sex life data, including genetic data, from other personal data.

What it reaches

Obligation class

Prohibition, Consent, Security

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 8 prohibits processing personal data revealing philosophical, ideological or political beliefs or penalty, religion, political party or trade union affiliation, racial or ethnic origin, privacy, or health and sex life including genetic data, except where the data subject has expressly consented with a guarantee of non-discrimination and adequate assurance, a legal authorisation with the same guarantee applies, the processing is purely statistical and not individually identifiable, the data subject was physically or legally incapable of consenting and processing protects vital interests, a nonprofit political, philosophical, religious or trade union body processes only its own members' or regular contacts' data with their consent, the data subject has manifestly made the data public, or the processing serves the establishment, exercise or defence of a legal claim.

Article 8 additionally permits processing health and sex life data, including genetic data, for preventive medicine, medical diagnosis, medical care or treatment, or health service management, provided a health professional bound by professional secrecy carries it out, it is notified to the CNPD under article 23, and adequate information security measures are in place.

Article 9 restricts central registers on persons suspected of illegal activities, criminal and administrative offences, and decisions applying penalties, security measures, fines or additional penalties to public services vested with that specific responsibility by law, with the CNPD's prior opinion, and lets the CNPD separately authorise such processing subject to the data protection and information security rules, limiting processing for police investigation purposes to what preventing a specific danger or prosecuting a particular offence requires.

Article 16 requires the controllers of sensitive, credit and solvency, and criminal record data to take special security measures, including controlling entry to processing premises, controlling who may read, copy, alter or transmit personal data, and logically separating health and sex life data, including genetic data, from other personal data.

When LexLint raises it

crawls_web
trains_models
handles_health_records

Read the law

Official English translation of Law No. 133/V/2001 of 22 January
on the Protection of Individuals with Regard to the Processing of Personal Data, published by the Comissão Nacional de Protecção de Dados (CNPD)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app