Can I ask for my data to be deleted?
Yes: under the GDPR you have the right to access, erase and object to the use of your data. The framework is the GDPR (EU 2016/679) and Law 58/2019 (the CNPD is the authority). You have the right of access (art. 15), the right to erasure/forgetting (art. 17) and the right to object to marketing (art. 21). The controller must respond within 1 month (extendable +2 in complex cases). A complaint to the CNPD is free (online form, email or post). For marketing, prior explicit consent (opt-in) and easy objection are required. There's also a right to compensation in court. In short: yes, you can request erasure and complain free to the CNPD.
📋 The rules
- Right of access (art. 15) and erasure (art. 17)
- Right to object to marketing (art. 21)
- Controller's reply within 1 month (+2 if complex)
- Complaint to the CNPD: free
- Marketing: explicit consent + easy objection
🔓 Exceptions
- Right to be forgotten not absolute (journalism, law, public interest)
- Digital-consent age in Portugal: 13
- Legal retention duties (tax/accounting) override erasure
⚠️ Penalties & fines
Fines are set by the GDPR: up to €20 million or 4% of global turnover (most serious) and €10 million/2% (less serious); Law 58/2019 added lower minimums for SMEs. Fines are split 60% State / 40% CNPD. Note: it's not Brazil's LGPD (authority ANPD) — in Portugal it's the GDPR + Law 58/2019, with the CNPD. The right to be forgotten isn't absolute: it yields to press freedom, legal obligations, public interest or defending rights in court. To exercise your rights: ask the controller in writing (access, erasure, objection to marketing); if it doesn't reply within 1 month or refuses unjustifiably, file a free complaint to the CNPD; and you can also seek compensation in court.
📎 Official sources
❓ Frequently asked
Can I ask for my data to be deleted?
Yes. The GDPR gives you the right to erasure, also known as the right to be forgotten, in art. 17. You can ask a company to delete your personal data, and it must respond within one month. This right isn't, however, absolute, and has exceptions, such as legal obligations.
How do I file a data-protection complaint?
You can file a free complaint with the CNPD, the National Data Protection Commission, via an online form, email or post. First, you can exercise your rights directly with the responsible company. If it doesn't respond or refuses without justification, you turn to the CNPD.
How long do they have to respond to my request?
The data controller must respond to your access, erasure or objection request within one month. This period can be extended by a further two months in especially complex cases, with the controller having to inform you of the extension and its reasons.
Can they use my data for marketing?
Only with your prior explicit consent, given freely and informed, and you always have the right to object at any time, easily. Sending marketing communications without this consent, or without the possibility to object, breaches the GDPR and can be the subject of a complaint to the CNPD.
What are the fines for breaching the GDPR?
Fines can reach €20 million or 4% of annual global turnover for the most serious breaches, and up to €10 million or 2% for less serious ones. Law 58/2019 provides lower minimums for small and medium-sized enterprises. The fines are applied by the CNPD.
🔎 Common searches
What people search to land here:
- “right to be forgotten portugal”
- “delete personal data gdpr”
- “cnpd free complaint”
- “gdpr marketing consent”
- “gdpr fine 20 million”
- “law 58/2019 data protection”