In the first hours of an incident?
Speak to counsel — +351 919 497 920 — monitored outside working hours · first stepsData. AI. Cybersecurity. Digital regulation.
CyberLAWYERS.pt advises international organisations on the European rules that govern how they use data and technology — from Lisbon, across the European Union.
LISBON · PORTUGAL · EUROPEAN UNION
02The European proposition
Organisations operating in Europe are now governed by an interlocking system of digital rules — data protection, artificial intelligence, cybersecurity, digital services, data access and electronic identity — that were written separately and apply together.
CyberLAWYERS.pt is a Portuguese law firm working with organisations that face that system: international groups operating in or through Portugal, technology and financial businesses entering the European market, and foreign counsel who need specialist Portuguese and EU digital-law capability alongside their own.
We are qualified in Portugal, we work in English, and we advise on European instruments as they actually apply — including where Portuguese implementation and the practice of the national supervisory authority change the answer.
03The matters we are instructed on
04Expertise
Digital law is not one area of this firm's work. It is the whole of it.
GDPR advisory, governance and legal audits, transfers, ePrivacy, cookies and direct marketing, data subject rights, breaches, and proceedings before the CNPD.
→AI Act classification and obligations, governance, procurement and contracting, and the AI Act read against the GDPR.
→NIS2, DORA and the CRA, governance and board duties, legal incident response, notification, and supply-chain risk.
→Technology and cloud contracting, platforms, digital identity and trust services, data access and sharing.
→05EU Digital Regulation Hub
The GDPR, the AI Act, NIS2, DORA, ePrivacy and the Cyber Resilience Act were drafted separately and now apply to the same systems, the same data and the same decisions — with different definitions, different authorities and different deadlines.
One security incident can trigger three separate reporting duties at once: 24 hours to the CSIRT under NIS2, 24 hours to ENISA under the CRA, 72 hours to the CNPD under the GDPR. None of the triggers align.
Which EU rules apply to your organisation?06Defined engagements
Some matters arrive as a question. Others arrive as an obligation with a date attached. For the second kind, we offer defined engagements with a stated scope, method and set of deliverables.
07How we work
CyberLAWYERS.pt is founder-led by design. That is an operating decision, and it produces four things a client can rely on.
No delegation to junior fee-earners. The person you brief is the person who advises you.
One adviser across the life of a matter, and across matters.
Specialist questions answered by someone who has answered them before.
Where a mandate requires additional capability, we assemble named specialists — and tell you who they are.
08Where we work
Financial services, payments and FinTech · Technology, SaaS and digital platforms · Digital identity and trust services · Public sector and regulated entities
We describe our work by sector and scale, never by client name. Standing appointments include Data Protection Officer to a Portuguese payments and digital identity group operating national payment infrastructure, and to a Lisbon public authority.
09Counsel
Advises international organisations on data protection, artificial intelligence, cybersecurity and European digital regulation, and has led CyberLAWYERS.pt since 2010.
He is unusual among Portuguese lawyers in the field in three respects: he holds standing Data Protection Officer appointments rather than only advising DPOs; he has worked inside the European legislative process, in Brussels, during the Portuguese Presidency of the Council of the EU; and his legal training is matched by formal technical training in information security.
10Published analysis
Analysis of European digital regulation written for the people who have to decide what to do about it — not summaries of legislation.
11For international firms and foreign counsel
We act as Portuguese and EU digital-law counsel alongside international advisers, on referral and on co-ordinated mandates. Scope, reporting lines, conflicts and client relationships are agreed at the outset — and respected.
12Contact
João Ferreira Pinto · Managing Partner · jfp@cyberlawyers.pt · +351 919 497 920
Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.