Electronic Transactions Law, data subject rights and information notice

Lei n.º 3/2017, de 9 de Janeiro, arts. 63(3)-(4), (6), 65(2) (direitos do titular dos dados)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Where personal data was not collected from the data subject directly, give the subject the reason it was collected and your identity as the processor, by the time the data is first disclosed to a third party, unless notice is impossible, disproportionately burdensome, permitted by law, or the data is collected for statistical, historical, or scientific purposes.
On a data subject's request, confirm whether their personal data is held and communicate it to them within a reasonable period on payment of a fee, and give a reasoned refusal in writing where you decline either request.
Where a data subject objects to data concerning them and the objection is accepted, remove, rectify, complete, or alter it.
Make available to any person specific information about your policies and practices for managing personal information, including who to contact with a complaint or question, how to obtain access to personal information you retain, and a description of the type of personal information retained and its general use.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 63(3) requires the data processor, where personal data was not collected from the data subject directly, to give the subject the reason for collecting it and the processor's identity by the time the data is first disclosed to a third party. Article 63(4) excuses that notice where it is impossible, involves a disproportionate effort, is permitted by law, or the data is registered for statistical, historical, or scientific purposes.

Article 63(6) gives every person the right to obtain confirmation from a data controller of whether it holds data about them, to be told about that data within a reasonable period on payment of a fee, to receive a reasoned refusal where a request under either of those points is denied, and, where they object to data concerning them and the objection is accepted, to have it removed, rectified, completed, or altered.

Article 65(2) requires the data processor to make available to any person specific information about its policies and practices for managing personal information, including who is responsible for those policies and to whom a complaint or question should be directed, how to obtain access to personal information the processor retains, and a description of the type of personal information retained, including a general report of its use.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

Text of Lei n.º 3/2017, de 9 de Janeiro (Lei das Transacções Electrónicas), Boletim da República I Série, mirrored by DataGuidance

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app