Portugal Recording Laws: All-Party Consent, Penalties, and 2025 Reforms

Portugal requires consent from every participant before any conversation may be recorded. Article 199 of the Código Penal criminalizes capturing private words or images without that consent, whether you are a party to the conversation or a bystander. Penalties reach one year in prison or fines up to €120,000.

Quick Answer: Is Portugal One-Party or All-Party Consent?

Portugal is an all-party consent country. Under Article 199 of the Código Penal, recording any private conversation, phone call, or spoken words without the knowledge and agreement of every participant is a criminal act. This applies whether you are a party to the conversation or a third-party bystander.

The all-party standard flows from a constitutional foundation. Article 26 of the Portuguese Constitution guarantees the right to one's image and word (direito à palavra) as a fundamental right. Article 34 declares all private communications inviolable, with only judicial authorities permitted to order access during criminal proceedings.

For travelers, foreign businesses, or anyone calling into or out of Portugal: assume you need consent from everyone on the line before you press record. The law does not create an exception for calls that originate outside Portugal when a Portuguese resident is on the other end.

Article 199 of the Código Penal: Core Framework

The central statute governing recording in Portugal is Article 199 of the Código Penal, titled "Gravações e Fotografias Ilícitas" (Unlawful Recordings and Photographs). It sits in Chapter VIII of the Criminal Code, covering crimes against personal legal interests.

What Paragraph 1 Prohibits (Audio)

Paragraph 1 targets audio recordings. It criminalizes two distinct acts:

• Recording words spoken by another person that are not intended for public dissemination, without that person's consent. This applies even when the words are spoken directly to you, the recorder.
• Using or permitting others to use such recordings, even when the recording itself was lawfully made.

The second point is significant. If you recorded a conversation lawfully (with consent), but later use that recording in a way the speaker objects to, you commit a separate criminal offense under the same article.

What Paragraph 2 Prohibits (Visual)

Paragraph 2 extends the same protections to images. It criminalizes:

• Photographing or filming another person against their will, including at events where the person lawfully participated.
• Using or permitting the use of such photographs or films, even when they were originally obtained lawfully.

Penalties Under Article 199

Both audio and visual violations carry the same base penalty: imprisonment of up to one year or a fine of up to 240 daily rates.

The daily rate system (taxa diária) works differently from a flat fine. Under Article 47 of the Código Penal, each daily rate is set by the judge between €5 and €500, calibrated to the offender's economic situation and personal obligations. At the maximum, that yields a fine of up to €120,000. Courts may allow installment payments over up to two years.

Aggravated Penalties via Article 197

Paragraph 3 of Article 199 incorporates Article 197 of the Código Penal by reference, which increases base penalties by one-third in both their minimum and maximum when the offense is committed:

• For profit, reward, or enrichment, or with intent to harm another person or the state.
• Through mass media, the internet, or any other means of widespread public dissemination.

Posting an unauthorized recording to social media therefore pushes the maximum prison sentence from twelve months to approximately sixteen months.

Complaint-Based Prosecution

Under Article 198 of the Código Penal, prosecution for most recording offenses requires a formal complaint (queixa) from the victim. Police and prosecutors do not typically initiate cases without a complainant. The victim must file with the police or the Public Prosecutor to trigger an investigation.

Articles 192, 193, and 194: Related Privacy Offenses

Three adjacent articles fill gaps that Article 199 leaves, and all three were strengthened by Lei 26/2023 of May 30, 2023.

Article 192: Devassa da Vida Privada (Invasion of Privacy)

Article 192 criminalizes intentional intrusions into another's private life, including family and sexual intimacy, through any of these acts:

• Intercepting, recording, registering, using, transmitting, or disclosing private conversations, phone calls, or electronic messages.
• Capturing, photographing, filming, or disclosing images of persons or intimate spaces.
• Observing or listening to people secretly in private places.
• Disclosing facts about another person's private life or serious illness.

Following the Lei 26/2023 amendment, subsections (b) and (d) -- capturing and disclosing intimate images or facts about private life -- now carry imprisonment of up to three years or a fine of 10 to 360 days. Other subsections retain the previous penalty of up to one year. This was a direct legislative response to Portugal's growing non-consensual intimate image problem.

Article 193: Devassa Através de Meios de Comunicação

Article 193 was renamed and restructured by Lei 26/2023. Previously titled "Devassa por meio de informática" (privacy breach by digital means), it now addresses privacy breach through social media, the internet, or any other means of widespread public dissemination.

The penalty is imprisonment of up to five years. A key procedural change introduced by the 2023 reform: when an Article 193 offense results in the victim's suicide or death, or when the victim's interests require it, the Public Ministry may proceed without a formal victim complaint. This removes a significant barrier in the most serious cases.

Article 194: Violação de Correspondência ou de Telecomunicações

Article 194 specifically addresses violations of correspondence and telecommunications. Recording a phone call without all parties' consent implicates both Article 199 and Article 194. The base penalty is the same: imprisonment of up to one year or a fine of up to 240 daily rates.

The aggravation mechanism under Article 197 applies to Article 194 as well, increasing penalties by one-third when the offense is committed for profit or through media or online channels.

Constitutional Foundation: Article 26 and Article 34

Article 26: Right to Personal Identity and Privacy

Article 26 of the Portuguese Constitution guarantees a cluster of fundamental rights: personal identity, personal development, civil capacity, citizenship, good name and reputation, the right to one's image, the right to speak, and the right to protect the privacy of personal and family life.

Portuguese courts treat the right to one's image and word (direito à imagem, direito à palavra) as independently protected fundamental freedoms. This means the right to control your own spoken words does not depend on whether the words were spoken in public or private -- what matters is whether you consented to their capture and use.

The Constitutional Court reinforced this in its 2024 case law, consistently holding that restrictions on privacy rights must satisfy the proportionality principle: any limitation must be necessary, suitable, and proportionate to the legitimate goal pursued.

Article 34: Inviolability of Communications

Article 34 extends constitutional protection to all private communications, including correspondence, telephony, and electronic messaging. It declares that public authorities may not interfere with correspondence or telecommunications except through a judicial order in criminal proceedings. This constitutional provision provides the constitutional basis for the criminal prohibitions in Article 194.

Law enforcement wiretapping requires prior authorization from a criminal judge and must be directly connected to an active investigation. Portuguese police have no authority to unilaterally decide to intercept or record calls. This framework was reinforced by Law 109/2009 (the Cybercrime Law), which transposed EU cybercrime standards into Portuguese law and governs electronic evidence collection.

GDPR, Lei 58/2019, and CNPD Enforcement

Lei 58/2019: Portugal's GDPR Implementing Law

Lei 58/2019 of August 8 is Portugal's national law implementing the EU General Data Protection Regulation. It grants the CNPD (Comissão Nacional de Proteção de Dados) enforcement authority over all data processing in Portugal, including audio and video recordings that capture personal data.

Key provisions for recording:

• Article 19 governs video surveillance, including a near-total ban on audio capture through surveillance systems during working hours.
• The law classifies electronic communication content as particularly sensitive personal data, echoing the Constitution and EU Charter of Fundamental Rights.
• Businesses recording customer calls must comply with GDPR retention limits: 90 days for general business purposes, 30 days for quality monitoring recordings (per CNPD Deliberação 2019/21).

CNPD Enforcement Activity

The CNPD has been an active enforcement authority. Notable actions include:

• A €400,000 fine against a hospital for unauthorized data access (Portugal's first GDPR fine).
• A €4.3 million fine against the National Statistics Institute (INE) for census data processing violations, confirmed by the EDPB in 2022.
• A €1.25 million fine against the Municipality of Lisbon for processing personal data of political activists.
• A €2,000 fine against a controller for failing to post video surveillance notices, confirming the CNPD pursues even small violations.
• In 2024, the CNPD imposed a temporary ban on Worldcoin's biometric data processing in Portugal under Article 58(2)(f) GDPR, citing violations of Articles 5(1)(a), 7(3), 9(1), 13(2)(c), and 17(1) GDPR.

The CNPD announced in its 2025 activity plan a commitment to increasing the efficiency of sanctioning actions. Organizations operating in Portugal should treat GDPR compliance as a live enforcement risk, not a paperwork exercise.

Call Recording Under GDPR

In CNPD Deliberação 2019/21, the authority established the following for business call recording:

• Phone call recordings are personal data subject to full GDPR protections.
• General business recordings may be retained for up to 90 days.
• Quality monitoring recordings may only be kept for 30 days.
• Data subjects have the right to access their own recordings under GDPR Article 15.
• Consent must be freely given, specific, and unambiguous. A generic "this call may be recorded" announcement is not sufficient.

Phone Calls and In-Person Conversations

Phone Call Recording

Recording a phone call in Portugal without the consent of all parties violates both Article 199 and Article 194 of the Código Penal simultaneously. Both carry the same base penalty. The constitutional protection in Article 34 extends beyond call content to metadata: the time, duration, and location of a communication are also protected.

For businesses recording customer service calls, two separate legal regimes apply at once: the criminal prohibition in Article 199/194 (requiring consent), and the data protection regime of GDPR/Lei 58/2019 (requiring a lawful basis, retention limits, and access rights). Obtaining explicit recorded consent from the caller before the recording starts satisfies both.

In-Person Conversations

Article 199's prohibition on recording spoken words applies to any private conversation regardless of medium. The decisive factor is not where the conversation occurs but whether the words were intended for public dissemination.

A private conversation at a restaurant is protected. A speech delivered to a public audience is not. Portuguese courts have consistently held that the right to one's word (direito à palavra) is a fundamental freedom that operates even when someone speaks directly to you. Recording what another person says to you, without their knowledge, is criminal under Portuguese law.

Public Places: No Blanket Exception

Portuguese law does not create a blanket recording exception for public spaces. Article 26 of the Constitution protects the right to one's image even in public settings. Courts have recognized that events occurring in public can still fall within private life protections when they target a specific individual.

Filming a crowd or documenting a general public scene is generally permissible. Zooming in on a specific person, recording their private conversation in a public space, or capturing images specifically of them without consent crosses the line under Article 199, paragraph 2.

Recording Police and Public Officials

Portugal approved Law 95/2021 on December 29, 2021, authorizing body cameras (câmaras portáteis de uso individual) for the PSP (Public Security Police) and GNR (National Republican Guard). Officers may activate recording during an active criminal offense, when facing actual aggression, or when encountering disobedience to lawful orders.

For civilians filming police, Portuguese law contains no specific statute prohibiting the practice. However, Article 199 still applies to audio. Recording an officer's voice during a private interaction -- such as a traffic stop -- could technically violate the statute. Recording officers performing public duties in a setting where they have no reasonable expectation of privacy is on firmer legal ground, though the case law in this area continues to develop.

The safest approach for anyone documenting police interactions in Portugal is to record video without capturing private conversations, and to remain transparent about the fact that you are recording.

Workplace Recording and Surveillance

Labour Code Baseline (Article 20)

Article 20 of the Código do Trabalho sets the foundational rule: employers may not use remote surveillance equipment to monitor employee work performance. Video surveillance at the workplace is only lawful when its purpose is protecting the safety of people and property, or when the specific nature of the work activity justifies it.

When cameras are installed, the employer must inform workers and post visible notices stating that CCTV surveillance is in operation. Violation of the ban on performance monitoring is classified as a "very serious" labor infraction (contraordenação muito grave). Failure to post notices is a "minor" infraction.

Audio in the Workplace: Near-Total Ban

Article 19(4) of Lei 58/2019 imposes a near-total ban on audio capture through video surveillance systems. Sound recording is prohibited except in two narrow circumstances:

• During periods when the premises are closed, meaning no workers are present in the monitored area.
• With prior authorization from the CNPD.

Even when an employer has a lawful video security system, the microphones must be off during working hours. The CNPD rarely grants exceptions to this rule.

Off-Limits Areas

Lei 58/2019 prohibits cameras (with or without audio) in specific workplace areas:

• Break rooms and rest areas
• Locker rooms and changing areas
• Restrooms
• Gymnasiums

Retention and Use Limits

The CNPD mandates that all surveillance footage must be deleted within 30 days. After that window, deletion must occur within 48 hours, unless the footage has been flagged for use in criminal proceedings. Even lawfully obtained footage may only be used for disciplinary purposes to the extent that it relates to conduct covered by criminal proceedings.

Admissibility of Recordings as Evidence in Court

Portuguese law creates a tension between the criminal prohibition on unauthorized recording and the potential evidentiary value of those recordings. The general rule is strict exclusion.

Article 32(8) of the Constitution declares that evidence obtained through torture, coercion, interference with private life, correspondence, or telecommunications is null and void. This constitutional bar makes it extremely difficult to introduce unauthorized recordings in Portuguese criminal proceedings.

However, courts have carved out narrow exceptions. Recordings are more likely to be admitted when:

• The person who made the recording was an active participant in the conversation (not a hidden third party).
• The recording was made without provocation, deceit, or coercion.
• The conversation took place in a public setting.
• In a private setting, the property owner authorized the recording.

Even when a court admits such evidence, the recording itself remains a criminal act under Article 199. Admissibility and criminal liability are separate questions. The Tribunal da Relação de Coimbra has addressed this in multiple rulings, consistently holding that the right to one's words has the structure of a fundamental freedom and that gathering evidence does not, by itself, exclude criminal liability for unauthorized recording.

The STJ's 2024 case law digest on personal data protection, published in January 2025, confirms that Portuguese superior courts continue to treat privacy rights as presumptively stronger than evidentiary interests in the absence of explicit judicial authorization.

Voyeurism and Non-Consensual Intimate Images (NCII)

Portugal has been grappling with a serious NCII problem. In 2024, reporting by Portuguese magazine NiT exposed a Telegram group of approximately 70,000 men sharing intimate images of women without their consent. The incident accelerated calls for stronger enforcement of the reforms enacted by Lei 26/2023.

Under the current framework:

• Article 192(b) and (d), as amended by Lei 26/2023, covers the capture or disclosure of intimate images or private facts with up to three years in prison.
• Article 193, as reformed, covers dissemination through social media or the internet with up to five years.
• Article 199 additionally covers the unauthorized recording of visual content with up to one year.

Voyeuristic recording -- capturing someone in intimate situations without their knowledge -- violates both Article 192 and Article 199 simultaneously. Sharing that content online layers on Article 193 liability. The 2023 reforms made the most severe cases prosecutable without a victim complaint when the victim's interests require it, addressing the problem of victims who fear or cannot navigate the complaint process.

Deepfake Law and AI-Generated Content

Portugal's Current Legal Gap

As of May 2026, Portugal has no statute that specifically criminalizes deepfakes. Existing provisions can be stretched to apply in certain scenarios:

• A sexual deepfake designed to harm or humiliate could be prosecuted under Article 192 (invasion of privacy) or Article 193 (dissemination via internet).
• A deepfake used to defraud could be prosecuted under fraud statutes.
• A defamatory deepfake could trigger civil defamation liability.

However, these are workaround applications of existing law, not purpose-built deepfake prohibitions.

EU Directive 2024/1385: Mandatory Transposition by 2027

Directive (EU) 2024/1385 on combating violence against women and domestic violence was published in May 2024. It requires all EU member states, including Portugal, to criminalize:

• The production, manipulation, or alteration of deepfake material that depicts a real person engaged in sexual activity without their consent.
• The non-consensual dissemination of such deepfakes.
• Threats to create or share such content.

Portugal must transpose this directive into national law by June 14, 2027. This will require either amendments to the Código Penal or new standalone legislation. Portuguese legal commentators have noted that the existing Article 193 framework covers some of the directive's territory but lacks the specific deepfake-focused elements required.

EU AI Act: Labeling Obligations

The EU AI Act (Regulation (EU) 2024/1689) introduces deepfake transparency requirements that apply in Portugal as part of the EU single market:

• From February 2, 2025: The Act's prohibitions and AI literacy obligations began applying.
• From August 2, 2026: The Act's general application date, including the Article 50 requirement that AI-generated or manipulated audio-visual content intended to inform the public be visibly labeled as synthetic. Systems already on the market before that date have until December 2, 2026 to add machine-readable marking.
• From December 2, 2027: The high-risk obligations for the Annex III use cases apply. That date was August 2, 2026 until Regulation (EU) 2026/1744, the July 2026 Digital Omnibus on AI, moved it.
• From August 2, 2028: The high-risk obligations apply to AI built into products already regulated under EU product-safety law (Annex I). This is the point at which the Act is fully applicable.

Providers of generative AI systems that produce deepfakes must mark outputs clearly. This creates an obligation on the creator, not just the platform. Portugal's ANACOM and the ICP-Anacom regulatory body are responsible for coordinating national AI Act implementation.

Digital Services Act: Platform Removal Obligations

The EU Digital Services Act (DSA) requires Very Large Online Platforms (VLOPs) operating in Portugal to remove illegal deepfake content once notified. In Portugal, Decree-Law 20-B/2024 designated ANACOM as the national Digital Services Coordinator, with the ERC (media regulator) and IGAC (cultural activities inspectorate) as competent authorities. Platforms cannot shelter behind safe harbor provisions for deepfake content once they have actual knowledge of its illegal character.

Civil Liability for Unauthorized Recording

Beyond criminal penalties, unauthorized recording in Portugal exposes the recorder to civil liability under the general tort provisions of the Código Civil. The affected person may sue for:

• Compensation for moral damages (danos morais), which Portuguese courts have awarded in cases involving unauthorized use of personal images.
• Injunctions requiring the deletion or removal of recordings.
• Compensation for patrimonial (economic) damages if the recording caused measurable financial harm.

Civil and criminal liability run in parallel. A successful criminal conviction under Article 199 supports a civil damages claim, but the victim does not need a criminal conviction to pursue civil remedies. The rights protected by Article 26 of the Constitution are directly enforceable through the courts even without a supporting criminal case.

Cross-Border Recording Considerations

When a recording crosses national borders, no single international rule determines which country's law applies. In practice, the laws of every jurisdiction involved may apply simultaneously.

For calls between Portugal and other countries:

• If any party is in Portugal, Article 199 and Article 194 of the Código Penal apply to the Portuguese party's conduct.
• If personal data of a Portuguese or EU resident is processed, GDPR applies regardless of where the recording organization is based.
• If a foreign company records calls with Portuguese customers, CNPD has jurisdiction over the data processing even if the company has no physical presence in Portugal.

The practical guidance: when calling Portugal or handling calls that include Portuguese residents, apply Portugal's all-party consent standard. This is stricter than many jurisdictions, so meeting it generally satisfies other countries' one-party consent standards as well.

For EU-to-EU calls, both countries' laws apply. If one country requires all-party consent and the other requires only one-party consent, the all-party standard must be satisfied to avoid liability in the stricter jurisdiction.

The Council of the EU reached a deal in June 2025 to streamline cross-border GDPR enforcement, making it easier for EU data protection authorities including the CNPD to cooperate on cases that span multiple member states. This reduces the practical ability to rely on regulatory fragmentation to avoid compliance.

Business Compliance Checklist

Companies operating in Portugal must navigate overlapping legal requirements simultaneously.

For Call Centers and Phone-Based Businesses

• Obtain explicit, informed consent before recording any call. State the purpose clearly and specifically.
• Offer callers the option to decline recording. If they decline, you must still provide the service.
• Delete general call recordings within 90 days and quality monitoring recordings within 30 days (CNPD Deliberação 2019/21).
• Provide callers access to their recordings upon request under GDPR Article 15.
• If subject to anti-money laundering rules, retain records for seven years as required by Portuguese AML legislation.
• Maintain a record of processing activities under GDPR Article 30.

For Offices and Physical Premises

• Install CCTV only for protecting people and property, not for monitoring employee performance.
• Turn off audio capture through surveillance systems during working hours unless the CNPD grants specific authorization.
• Post visible notices at all monitored locations specifying that surveillance is in operation.
• Inform all employees in advance about surveillance equipment and its purpose.
• Never install cameras in break rooms, restrooms, locker rooms, or gyms.
• Delete all footage within 30 days (with a 48-hour grace period for deletion execution).

For AI and Technology Companies

• Comply with EU AI Act labeling requirements for AI-generated audio-visual content from August 2, 2026 under Article 50. The Act's prohibitions have applied since February 2, 2025, and its high-risk rules follow on December 2, 2027 and August 2, 2028.
• Prepare for Portugal's transposition of EU Directive 2024/1385 on deepfakes (deadline: June 14, 2027).
• Cooperate with ANACOM as Portugal's Digital Services Coordinator for DSA compliance.
• Treat any AI-generated audio or video that resembles a real person as potentially subject to Article 192/193 liability if used without that person's consent.

Penalties Summary