Firms To Watch: Data privacy and data protection

Under the leadership of Jacinto Moniz de Bettencourt, the team at Deloitte Legal is a key port of call for domestic and international clients from the banking, pharmaceuticals, insurance and fintech sectors on a variety of privacy and cybersecurity matters, including compliance and regulatory issues.

Data privacy and data protection in Portugal

Morais Leitão, Galvão Teles, Soares da Silva & Associados

Noted for its ‘great knowledge’ and ‘high quality of advice’, the data privacy and protection team at Morais Leitão, Galvão Teles, Soares da Silva & Associados acts for a diverse range clients in all stages of data protection work, from compliance programmes to investigations and disputes. Adopting a cross-practice approach, the team boasts specialists from a wide range of fields including TMT, labour, criminal, corporate and insurance law. Practice head Tiago Félix da Costa, praised for his ‘professionalism’, seamlessly integrates his data protection practice with a litigation focus, showcasing an impressive track record in handling some of Portugal’s most significant date protection and cybersecurity cases. Other practitioners to note include Helena Tapp Barroso, who is often instructed by clients across the technology, banking, insurance, pharmaceuticals and automotive industries in relation to contractual matters and compliance issues, and sssociate Maria da Assunção da Cunha Reis.

Responsables de la pratique:

Tiago Félix da Costa


Autres avocats clés:

Helena Tapp Barroso; Maria Assunção da Cunha Reis


Les références

‘Very diverse team. They work with a large number of clients in many sectors, which allows it to have a broad view of the solutions to the questions posed to them.’

‘Tiago Félix da Costa stands out for his professionalism, availability, competence, excellent knowledge of the subject, and client skills.’

‘I particularly recommend Helena Tapp Barroso. Deep knowledge of topics related to the protection of personal data, combined with strong knowledge of a wide range of other fields (labour, litigation, etc.).’

VdA

Recognised as a ‘leading law firm’, VdA‘s privacy and data protection team seamlessly integrates into the larger information, communication, and technology group. Praised for its ability to ‘provide truly remarkable solutions’, the team comprises specialised practitioners in specific industries, who adeptly support clients across sectors such as retail, healthcare, energy, insurance, transport, banking and gambling. The practice is steered by Magda Cocco, who has in-depth knowledge and experience in innovative technological projects in the electronic communications industry, is a key name in the market for data transfers, data breaches and compliance issues. Focused on data protection compliance programmes in Portugal and Africa, Inês Antas De Barros is noted for her work across the IT, insurance, banking, transport, pharmaceuticals, distribution and retail sectors. Managing associate Maria De Lurdes Gonçalves is also part of the core team focused on data protection and cybersecurity mandates.

Responsables de la pratique:

Magda Cocco


Autres avocats clés:

Inês Antas de Barros; Maria de Lurdes Gonçalves


Les références

‘VdA is a leading law firm. It has been absolutely remarkable to witness, as a long-time client, that each year VdA is dedicated to innovation and enhancing the already excellent service it consistently delivers.’

‘They provide truly remarkable solutions. The team is incredibly fantastic, in terms of knowledge, experience, creativity and innovation.’

I highlight Magda Cocco and Inês Antas de Barros for the incredible work they do with their team(s). I consider and testify to their enormous skills and sense of responsibility, making them a great reference in the market for me and, thus, justifying my loyalty as a client.’

Principaux clients

AGEAS Group


Altice Group


APS – Associação Portuguesa de Seguradores


Bial – Portela & Cª, S.A.


Brisa Group


ComparaMais, Lda.


CTT Group


CUF


EDP Group


European Space Agency (ESA)


E-REDES – Distribuição de Eletricidade, S.A.


Fresenius Kabi Pharma PT


Fundação Calouste Gulbenkian


Galp Energia, SGPS, S.A.


Gilead


HPA Saúde Group


IQVIA


José de Mello Group


Luís Simões


Lusíadas Saúde


Luz Saúde


MEO – Serviços de Comunicações e Multimédia S.A.


Mudum


ProChild Lab


Sistemas McDonald’s Portugal, Lda.


Sport Lisboa e Benfica Group (SLB)


VIA Outlets Portugal


Vodafone Portugal


Sonae Sierra S.A.


Zurich Insurance plc – Sucursal em Portugal


Principaux dossiers


  • Advised AdvanceCare on a privacy by design and by default assessment of wellness and health-related mobile applications, while ensuring compliant deployment of AI solutions.
  • Assisted EDP Group with the implementation of two social projects (“Inclusão Energética” and “Solar Solidário”) aimed at providing efficiency and energy saving solutions to low-income families and individuals.
  • Assisted CVC Brasil (a Brazilian travel agency) with the incorporation of a Portuguese branch to operate in Portugal, drafting standard contracts for the Portuguese branch to use when providing services to Brazilian consumers, but also with European based hotels, transportation services and similar.

DLA Piper ABBC

Singled out for its ‘pragmatism and knowledge’, the team at DLA Piper ABBC is regularly instructed by major multinationals in the full spectrum of data privacy, protection, and cybersecurity issues, notably in the implementation of compliance programmes and GDPR work. The team is jointly led by corporate and M&A specialist João Costa Quinta and Daniel Reis, who noted for his wealth of experience in tech-related matters and cybersecurity incidents. Highly regarded by clients for her 'in-depth knowledge of personal data', recently promoted partner Margarida Leitão Nogueira focuses on the intersection of IP and technology, often advising on privacy, data protection, and cybersecurity issues.

Responsables de la pratique:

João Costa Quinta; Daniel Reis


Autres avocats clés:

Vanessa Patrocínio; Margarida Leitão Nogueira


Les références

‘The privacy and personal data protection team stands out for its pragmatism and knowledge of our business.’

‘We highlight Margarida Leitão Nogueira for her in-depth knowledge of personal data and her availability and ability to clearly offer quick and effective answers to the questions presented to her.’

‘Vanessa Patrocínio has a very good technical knowledge of issues related to data protection and is always available to answer our questions.’

Principaux clients

EDP


NielsenIQ


Marktest


Multipessoal


PPG Dyrup


Metro Markets


Yamaha


Michael Page


iMM


Randstad


Ibersol


Principaux dossiers


  • Supporting EDPR on data protection matters.
  • Advising NielsonIQ on a regular basis.
  • Advising Ibersol on a regular basis.

PLMJ

Praised for its ‘client-oriented approach’, the privacy and data protection team at PLMJ is a key port of call for large corporations seeking assistance with cross-border compliance projects, audits, data breaches, litigation and the data protection aspects of high-value M&A. Spearheading the team is Pedro Lomba, who advises clients across a wide range of regulated sectors, such as media, mobility, IT, online platforms, healthcare and AI. Associate Inês de Castro Ruivo handles a variety of data protection and data privacy compliance matters for major banking, TMT and energy players. Other names to note at the associate level include Marta Salgado Areias, who brings together expertise in IP, data protection and consumer law, and Rita de Sousa Costa, who handles complex audits and litigation cases.

Responsables de la pratique:

Pedro Lomba


Autres avocats clés:

Inês de Castro Ruivo; Marta Salgado Areias; Rita de Sousa Costa; Nádia da Costa Ribeiro


Les références

‘From the Privacy and data protection team, I would like to highlight Nádia Ribeiro, with whom we work regularly. Nádia has in-depth knowledge of the subject and is always “one step ahead” in relation to the questions and problems that are posed to her. Nádia is committed and focused, and with above average dedication to her clients.’

‘The prompt response and experience of the professionals involved make the experience very positive.’

‘They possess a client-oriented approach to solving business problems.’

Principaux clients

Microsoft


Accenture


Free Now


National Association of Pharmacies


Clever Leaves


Galp


Ford


Pandora


Impresa


Herbalife


Glovo


Ascendi


CateringPor


StartCampus


United Investments Portugal


Tabaqueira (Philip Morris International)


H&M


DefinedCrowd (dba Defined.ai)


Flixbus


REN


Angola Cables


Principaux dossiers


  • Assisted H&M with the identification and managing of a data breach incident, including the necessary communication and notification process with the Portuguese Date Protection Authority.
     
  • Assisting the Impresa Group with all data protection aspects of its activity.
  • Assisting Galp’s Data Protection Officer (DPO) with data protection impact assessments and other high-risk data processing activities.

SRS Legal

SRS Legal houses a data privacy and protection team that is praised for its ‘pragmatism’ and ‘great knowledge’. Clients from across the TMT, banking, insurance and life sciences sectors regularly turn to the department for advice on a range of matters, including GDPR compliance issues, data sharing agreements and regulatory investigations. At the helm sits Luís Neto Galvão, a reference in the market for TMT, healthcare, and financial sector clients; he brings to the table more than two decades' experience in this space and has been described as a ‘deep expert’ in all matters pertaining to data protection. Managing associate Milène Zorrón is responsible for the compliance department and the German and Brazilian desks.

Responsables de la pratique:

Luís Neto Galvão


Autres avocats clés:

Milène Zorrón


Les références

‘Luis Neto Galvão is a deep expert in this area.’

‘The depth of their knowledge both on the matters of law as well as the business issues at stake is extremely valued by clients. I find their advice to be practical and useful.’

‘Availability and pragmatism, combined with knowledge of the topics in question make SRS a valuable partner for us.’

Principaux clients

NAU – Highgate Group


Adam Foods


iBASIS


ANOVA


Virbac


BT Portugal


Pinsent Masons


Gamalife


GALP


IQVIA Solutions Portugal


Dentons


Mitsubishi Electric Europe


Rubis


Associação Mutualista Montepio Geral


SAS


Santander Consumer


SAS Apostas Sociais, Jogos e Apostas Online (Group Misericórdia de Lisboa


Goldenergy


Securitas Direct


Montepio Geral


Principaux dossiers


  • Advising iBASIS in relation to the privacy aspects of a cybersecurity service provided to telecoms operators.
  • Advising the Data Protection Officer (DPO) of GALP on all data protection related matters subject to the review and advice of the DPO.
  • Assisting Montepio with a significant project, which implied a thorough review of all data flows and processing activities undertaken by all the directories of Montepio.

Abreu Advogados

Praised for its ‘high technical knowledge’, the data privacy and protection team at Abreu Advogados is a popular destination for household name companies seeking assistance with cross-border data transfers, GDPR compliance, audits and privacy policies. Under the leadership of Ricardo Henriques, the practice excels at assisting clients across the TMT, insurance, healthcare, life sciences and retail sectors. Henriques is noted for his focus on technology, advising on matters such as software licensing, compliance projects regarding emerging technologies and issues related to e-commerce, including data protection-related matters. Senior associate José Maria Alves Pereira has extensive experience in mandates concerning GDPR compliance.

Responsables de la pratique:

Ricardo Henriques


Autres avocats clés:

Simão de Sant’Ana; José Maria Alves Pereira


Les références

‘The Abreu team offers us enormous confidence in the work we entrust them with. We consider that their mastery of the subject, the experience of the professionals and above all their permanent updating and practical sense when advising us makes them unique.’

‘The team at Abreu Advogados is always reliable and provides excellent support in IT matters, including the protection of personal data.’

‘Ricardo Henriques is always available to provide practical advice to clients. His knowledge and understanding of the client’s needs in the Portuguese market make him a great partner to work with.’

Principaux clients

Acciona


Bial


Casio


Coca-Cola


Colt Technology Services


CooperVision


Daimler


Enterprise


Essity


Federal Express (Fedex)


Fresenius SE & Co Kgaa


Genpact (Pnmsoft)


Globalvia


Google


Ikea Group


Lidl & Companhia


Mitsubishi Motors Corporation


Netflix


Porsche


Primark


Robert Bosch GmbH


Sap


Sitel


Thea Laboratoires


Veolia


Visa


Vodafone


Principaux dossiers


  • Assisting Porsche with several projects related to its online business and connected car services.
  • Advising Primark on a data protection project related to communication tools for employees.
  • Assisting LIDL with data protection and cybersecurity matters.

CCA Law Firm

The team at CCA Law Firm, lauded for its ‘in-depth knowledge’, stands out for its experience advising companies in the TMT sector on GDPR compliance, privacy policies and data processing arrangements. Lawyers earn further praise for their ability to act for clients operating in the financial, pharmaceuticals, banking, and retail industries. Filipe Mayer and Martim Bouza Serrano, the latter of whom focuses on tech, privacy, IP and other TMT-related matters, jointly head up the practice. Eduardo Magrani stands out for his strong performance in data protection, IP, AI and cybersecurity mandates.

Responsables de la pratique:

Filipe Mayer; Martim Bouza Serrano


Autres avocats clés:

Eduardo Magrani


Les références

‘Constant availability and in-depth knowledge of the topics covered.’

‘Martim Bouza Serrano stands out for his proximity, empathy, availability and technical knowledge.’

Principaux clients

Google


Vodafone


IBM


Sephora


P&G


Havas Group


Cofina Media


Farfetch


C&A


JTI – Tabaco


Sendit


Special Variable


Zuvi Nova


Clinica Bexiga


Jimpisoft


Europcar


Eat tasty


CMS

Counting large domestic and multinational companies among its key client roster, CMS is well versed in cross-border compliance projects, data transfers, GDPR-related work, and privacy policy matters. The practice is spearheaded by IP specialists José Luís Arnaut and João Leitão Figueiredo. Arnaut often acts for public and private companies in the implementation of compliance programmes, while Figueiredo is noted for his expertise in data breaches, data transfers and issues pertaining to online tracking. Associate Sara Rocha is another key individual to note for mandates involving the protection of personal data, including compliance projects and privacy policies.

Responsables de la pratique:

José Luís Arnaut; João Leitão Figueiredo


Autres avocats clés:

Sara Rocha


Les références

‘CMS stands out for its lawyers’ knowledge of legislation, doctrine and authorities’ decisions in this area of ​​law, as well as their ability to convey them clearly and adapt their advice and solutions to clients’ concerns.’

‘João Leitão Figueiredo has a deep and comprehensive technical knowledge of legislation, even when it comes to recently published legislation, as well as the ability to understand the client’s reality, providing practical and efficient legal support.’

‘Dedicated team, always available and focused on client needs. High quality work and solid knowledge in the area.’

Principaux clients

Galp Group


Delta Cafés (Nabeiro Group)


Fromageries Bel


Bensaude Group


Essilor Portugal


DaVita Group


Angelini Group


Solera Group (Audatex)


SRT Group (Stuart)


Vinci Energies


EDP Group


IKEA Industries


NAV Portugal


DOUGLAS GmbH


Principaux dossiers


  • Advising all companies of GALP Group on a daily basis on data protection and privacy matters.
  • Advising all companies of Nabeiro Group (Delta Cafés) on a daily basis on data protection, privacy and compliance matters in Portugal, Spain, France, Luxembourg, Switzerland, Angola and Brazil.
  • Advising all companies of the Bel Group on a daily basis on data protection, privacy, and compliance matters.

Cuatrecasas

The ‘very cohesive’ team at Cuatrecasas excels in privacy matters relating to sensitive data in the healthcare sector. Additionally, the practice is well positioned to advise clients across the telecoms, hardware and electronics, banking, technology and retail sectors. The team is jointly led by Sónia Queiróz Vaz, noted for her focus on privacy and data protection issues, including Big Data, e-commerce and long-distance agreements, and Joana Mota Agostinho, who is a key port of call for clients hailing from the TMT and other highly regulated industries.

Responsables de la pratique:

Sónia Queiróz Vaz; Joana Mota Agostinho


Autres avocats clés:

Ana Costa Teixeira; Catarina Castanheira Lopes


Les références

‘The team has in-depth knowledge of current legislation. The response time in relation to urgent requests and the degree of constant availability is fantastic.’

‘The data protection team has provided an excellent service in the area of ​​developing and maintaining a company privacy management system that guarantees full compliance with the requirements of the GDPR and other applicable legislation. It also provides an excellent service through Data Protection Officer services and ensures exemplary coordination with the organisation’s internal and external stakeholders.’

‘Joana Mota Agostinho is a competent lawyer with extensive experience in the field of data protection law. Pragmatic and solution-oriented in high-risk situations and with short response times. High ethical standards and trust.’

Principaux clients

BMW Portugal


Santander bank


Galp


BMW Financial Services


Roche


IPO Coimbra


HUAWEI


Outsystems


Banco Inter


Globo


Volup


Novo Nordisk


Grupo Porto Editora


Auto-Estradas do Atlântico


DHL


Grupo Sogrape


Volkswagen Autoeuropa


ONI


Nowo


Farfetch


Feedzai


Infraestruturas de Portugal


Águas de Portugal


Fundação Champalimaud


Principaux dossiers


  • Advised OutSystems on personal data protection and privacy issues, specifically on the relationship with external contractors.
  • Advised Samsung Electrónica Portuguesa regularly on projects related to personal data protection.
  • Advised Huawei on several matters including compliance with personal data protection and privacy laws and regulations, associated with its activities as a market leader in the provision of information and communication technology (ICT) smart device infrastructure.

Eversheds Sutherland

Praised for its ‘collaborative stance’, the team at Eversheds Sutherland is well placed to assist clients engaged in the energy, telecoms, healthcare and manufacturing sectors on a broad range of data privacy matters, including GDPR compliance and data processing issues. Practice head Margarida Roda Santos handles the full scope of IP matters, and has extensive experience on IT and data protection issues in Portugal, Angola and Mozambique. Key support is offered by Pedro Sampaio Neves and José Luís Monteiro , both of whom advise on the implementation of GDPR programmes.

Responsables de la pratique:

Margarida Roda Santos


Autres avocats clés:

Paulo Sampaio Neves; José Luís Monteiro


Les références

‘The proximity to the client is the main advantage. The service is always adapted to the client’s needs, making the entire process faster and more efficient.’

‘Margarida Roda Santos is always available, has extensive knowledge in her area of ​​expertise, systematically seeks solutions for the situations presented to her. Paulo Sampaio Neves provides very valid opinions and with a high sense of responsibility.’

‘José Luís Monteiro is clearly the face of privacy and personal data protection at the firm, offering a clear and client-oriented service. Demonstrates a lot of availability and is very reliable in meeting goals and deadlines.’

Principaux clients

Amplifon


Reckitt Healthcare


Roche Diagnostics


Pluricall


Antalis


Viking Cruises S.A.


FCA Bank Portugal S.A.


KEDRION Biopharma


Perrigo


EMIS


HCL Technologies


DHL


Garrigues Portugal

The ‘reliable and client-centric’ team at Garrigues Portugal regularly handles data processing agreements, M&A, privacy policy issues, data breaches and proceedings before the Portuguese Data Protection Authority (CNPD). The practice is jointly steered by Tomás Pessanha, and Alejandro Payá. Senior associate Rute Silva Gomes works with domestic and multinational companies on data protection and commercial mandates. Isabel Bairrão left the firm in January 2024.

Responsables de la pratique:

Tomás Pessanha; Alejandro Padín


Autres avocats clés:

Rute Silva Gomes


Les références

‘The team we work with always demonstrates enormous availability and speed in analysing the requested topics. Great capacity for analysis and quick proposal of solutions for the topics under discussion. The quality of the service provided is based above all on team quality in terms of knowledge, proactivity and collaborative spirit.’

‘I recommend Rute Gomes. What distinguishes her is her ability to respond quickly, her knowledge of the topics , practical responses, and ability to contextualise what she thinks in a simple way for different interlocutors.’

‘They have a quick response capacity and absolute availability. Absolute knowledge of the themes underlying the area of ​​data protection, from a national and European point of view. They provide a lot of security.’

Principaux clients

Samsung


Coca-Cola


L’Oreal


Volvo


Endesa


Honda Motor Europe


Iberdrola


Jaguar


Inditex Group


JLL group


Angelini


SAS Automotive


Hikma Farmaceuticals


Robert Bosch


CBRE


JTI – Japan Tobacco International


SOBI


Polestar


Apax/Gamalife


Henderson Park


Lundbeck


Oralmed


Evox Technologies


Neuraspace


Principaux dossiers


  • Advising JTI Japan Tobacco International on the implementation of the e-commerce website for selling Ploom X in Portugal, from a data protection perspective.
  • Advising L’Óreal on data protection matters.

Sérvulo & Associados

The ‘multidisciplinary team’ at Sérvulo & Associados earns praise for its ‘professionalism’ and ‘technical knowledge.’ Well positioned to advise clients on a range of data and protection matters, the group excels in GDPR compliance projects, audits, and data processing and transfer agreements. The team is under the joint leadership of a capable trio: Ana Rita Painho, who is singled out for her expertise in the gamut of data protection matters; dispute resolution specialist José Lobo Moutinho; and João Carmona Dias , who acts for companies from an array of sectors, including banking and payment services, energy, insurance, healthcare, IT, electronics and distribution, and brings together expertise in data protection, commercial and corporate law.

Responsables de la pratique:

Ana Rita Paínho; José Lobo Moutinho; João Carmona Dias


Autres avocats clés:

Ana Mira Cordeiro; Inês de Sá


Les références

‘Sérvulo has a genuine client focus, listening carefully to clients’ problems. It is a multidisciplinary team, which naturally comes together to find a solution that addresses the various perspectives of the problem. They are always available and proactive in providing advice and assistance.’

‘The team has an attitude of extreme professionalism and seriousness, and possesses great knowledge of the matter at hand. They do not hesitate to involve colleagues from different areas to address specific topics. They transmit absolute confidence in the recommendations and advice they give us.’

‘Professionalism, technical knowledge, speed of response, quality of service provided, and availability.’

Principaux clients

EDP Energias de Portugal


SenseiData


Porsche Ibérica


Grünenthal


Verizon Connect Portugal


Frotcom International


Page Group


Banco BIC Português


LG Electronics Portugal


Hitachi Consulting Portugal


Banco Primus, S.A.


Signify Portugal Unipessoal


Ferrero Ibérica, S.A. (Sucursal em Portugal)


SPMS – Serviços Partilhados do Ministério da Saúde


Abbott Laboratórios, Lda.


Abbott Medical (Portugal)


SIBS Processos – Serviços Interbancários de Processamento


Banco Comercial e de Investimentos (BCI)


Principaux dossiers


  • Assisted EDP SA and the EDP Group with data protection and data privacy matters.
  • Advising SenseiData on the implementation of a project of its full autonomous store which uses cameras and AI.
  • Advising Porsche on data privacy matters in Portugal since 2019.

TELLES

The ‘excellent’ data privacy and protection team at TELLES advises clients from a myriad of sectors, including banking, retail, technology and automotive, on a range of matters. The practice is steered by Pedro Vidigal Monteiro, who has combined expertise in IP, tech-related matters and data privacy issues. Ana Ferreira Neves, who possesses extensive experience in e-commerce and consumer law, and Maria Abreu Ferreira who regularly carries out data protection compliance assessments, are other names to note in the team.

Responsables de la pratique:

Pedro Vidigal Monteiro


Autres avocats clés:

Ana Ferreira Neves; Maria Abreu Ferreira; Beatriz Reis Santos


Les références

‘The team carries out excellent work. I highlight their dedication in providing contracted services to the client, always meeting their needs. Quality of service provided and adequate technical knowledge in the field of privacy and protection of personal data.’

‘Pedro Vidigal Monteiro and Maria Abreu Ferreira – Exceptional quality, extensive knowledge and mastery of subjects, seniority, pragmatism, availability and response times. An excellent and lasting collaboration.’

‘Telles has great knowledge of the business and understands how legal topics can be articulated with the requirements of different businesses.’

Principaux clients

Galp


Municipio de Lisboa


Voltalia


Agência para a Modernização Administrativa


FinTru


Matudis (Pepsi Company)


Serviços Partilhados Ministério da Saúde (Portuguese Ministry of Health)


Lusíadas


Super Bock Group


Zippy (Sonae Group)


AGEAS


Natixis Bank


RedBull


HERTZ


DAUFOOD PORTUGAL UNIPESSOAL, LDA.


IGFEJ (Ministry of Justice – Portugal)


MCCANN ERICKSON


NTT DATA (former “Everis”)


Cloudcomputing


Modalfa (Sonae Group)


Thorco Projects


Domes Resorts


Pangaia


Hospital de Loulé


Armis


Stay Hotels


NORS


Health Cluster Portugal


Positive Materials (Nodes)


C.Santos VP (Mercedes Concessionaire)


Rummo


Procimo Technology


Salsa (Sonae Group)


HomeServe


Black Bolt


Progrow


Tlantic


Soplast


Principaux dossiers


  • Advised Explorer IV – Venture Capital Fund, managed by Explorer Investments – Sociedade de Capital de Risco on the acquisition of a 60% stake in DevScope.
  • Advised SPMS on projects related to the development of health in a perspective of enhancing citizen proximity and digital access to health.
  • Advised Instituto de Gestão Financeira e Equipamentos da Justiça (IGFEJ) on data protection matters.