Lesson 4 of 5 · 15 min · Checked on 16 October 2026
Legal obligations in Portugal
By the end of this lesson you will be able to:
- Go through the list of 8 points a business website in Portugal should have
- Put the Electronic Complaints Book link and the business identification on the site
- Ask AI for a draft privacy policy and review every line
- Know when you need a cookie notice and the 14-day right to return
The return after ten days
Inês sells sweets online from her home in Lisbon. A customer writes: "I want to return the order, I don't need it any more." Ten days have passed. Inês replies that she does not accept returns, and the customer says she will file a complaint. Inês did not know there was a withdrawal period. She also had no link to the complaints book on her site.
None of this is hard to comply with. It is a short list, and one afternoon handles it. Let us go through it.
This is not legal advice: check with your accountant or lawyer. (The laws below are Portuguese, so they keep their Portuguese names, with a short explanation.)
The 8 points, one by one
1. Identifying the business. Decreto-Lei n.º 7/2004 (e-commerce law) asks the site to say who is behind it: name or company name, address, email and another contact, tax number (NIF) and, if there is one, the commercial registration. The footer is the usual place. Ten minutes.
2. Prices with VAT. For consumers, the price always appears with VAT included (Decreto-Lei n.º 7/2004 and Decreto-Lei n.º 138/90). If there is postage, show it before the person pays.
3. The Electronic Complaints Book. Decreto-Lei n.º 74/2017. Anyone who sells or provides services to the public, even only online, must offer the electronic book. On the site you put a clearly visible link to www.livroreclamacoes.pt; there is an official logo to download there. You need no software: you register your business on the platform. When a complaint arrives, you have 15 working days to reply.
4. Privacy policy. A contact form, a booking or an order collects personal data. The GDPR (Regulamento (UE) 2016/679) and Lei n.º 58/2019 call for a text saying who is responsible (name and contact), what data you collect, why and on what legal basis, how long you keep it, who you share it with (for example the booking system), and the person's rights: to access, correct, erase, and complain to the CNPD (the Portuguese data protection authority, www.cnpd.pt). Collect only what is necessary.
5. Cookies. Lei n.º 41/2004, amended by Lei n.º 46/2012. Cookies that are not strictly necessary for the site to work (statistics with cookies, advertising) need prior, informed consent. If your site does not use cookies of that kind, it needs no cookie notice. Statistics tools without cookies avoid the notice.
6. Distance selling. Decreto-Lei n.º 24/2014. Before the purchase, the consumer must know the product's features, the total price with taxes and postage, the delivery time and the payment methods. Afterwards, they get the order confirmation by email. And they have 14 days to withdraw, with no reason. Exceptions: made-to-measure goods, perishable goods, sealed goods that were opened for hygiene reasons, services already fully provided with express agreement, and accommodation or catering with a fixed date.
7. Alternative dispute resolution (RAL). Lei n.º 144/2015. The site and the terms should tell the consumer about the RAL bodies they can turn to. The official list is on the Consumer Portal (www.consumidor.gov.pt, run by the Direcção-Geral do Consumidor); CNIACC is the national body with general competence.
8. Invoices. Every sale has an invoice (VAT Code, art. 29.º), issued by invoicing software certified by the tax authority (AT), with an ATCUD and QR code. The series are reported to the AT. Taking money without an invoice is illegal, even by MB WAY or bank transfer. Your accountant says which software is right.
Tip
Print this list of 8 points and open your site on your phone, as if you were a customer. Tick what you find within 10 seconds. What you cannot find on a small site, a customer cannot find either.
Two notes that may not apply to you
Email marketing. Sending advertising by email or message needs prior consent (Lei n.º 41/2004, art. 13.º-A), except to customers you already have, for similar products or services. In every case there must be an easy way to unsubscribe.
Accessibility. The European Accessibility Act (Directiva (UE) 2019/882, transposed by Decreto-Lei n.º 82/2022) has applied to e-commerce since 28 June 2025. There is an exemption for micro-enterprises providing services: fewer than 10 people and turnover up to 2 million euros. For most readers of this course it is good practice, not an obligation. Check with your accountant or lawyer if your case is different.
Watch out
Do not copy another business's privacy policy or terms. Each site collects different things, and a text that talks about data you do not collect (or says nothing about data you do) is worse than none. Do not put photos of customers or staff on the site without consent either, and do not use images from the internet without a clear licence: they are protected by copyright.
A draft with AI, reviewed by people
The privacy policy is the heaviest point. AI can give you a draft to start from (see the AI course). You write down what your site really does:
Write a draft privacy policy in plain English for a small business website in Portugal. Controller: [business name and contact]. Data the site collects: [for example name, email and message from the contact form]. Why: [to answer contact requests]. How long we keep it: [period]. We share it with: [the site and email provider, the booking system]. Include the person's rights (access, correction, erasure) and the possibility of complaining to the CNPD. Do not invent anything I have not said; if information is missing, write [TO FILL IN].
When the text comes back, check each sentence against what the site really does. Where it says [TO FILL IN], fill it in yourself. Then show it to your accountant or lawyer.
Tip
Do not put real customers' names or emails into the AI. For a draft policy, you only need to describe what kind of data the site collects.
Exercise
How I know it worked the list of 8 points all ticked, with the complaints book link and the privacy policy live.
If it didn't work
- Can't find where to register for the complaints book? Go in through the address www.livroreclamacoes.pt, typed by you in the browser, not through links received by email.
- Did the AI write things the site does not do? Delete them. The text must describe what the site really collects.
- Not sure whether the site uses cookies? Ask whoever built it or the provider. If it uses no cookies beyond the essential ones, you need no notice.
- Not sure which of the 14-day exceptions apply to you? Talk to your accountant or lawyer before writing the terms.
- Remember: this is not legal advice. Check with your accountant or lawyer.
Videos
No video selected for this lesson; the text is enough.