Portugal 2026: Draft Exchange‑of‑information Bill, What Defence Lawyers Must Know

On 24 March 2026, Portugal’s Minister of Justice presented a draft bill on the exchange of information on crime and criminal activities to the Assembleia da República, opening a parliamentary debate that will reshape how Portugal shares law‑enforcement data with EU partners. For criminal defence practitioners, the exchange of information Portugal framework under discussion introduces faster data‑sharing channels, broader categories of transmissible evidence, and new automated processes, all of which narrow the window available to raise privilege objections or challenge admissibility. The bill arrives against a backdrop of wider European moves toward integrated criminal data exchange, yet existing public commentary remains dominated by tax‑focused AEOI explainers and high‑level policy summaries, leaving a critical gap in practical, defence‑oriented guidance.

This article fills that gap with a section‑by‑section analysis of the draft provisions, a detailed assessment of fair‑trial risks, and an actionable tactical checklist that defence counsel can deploy immediately.

Executive Summary, Why Defence Lawyers Must Read This Now

The draft Exchange‑of‑Information Bill would create a unified domestic legal basis for Portuguese authorities, principally the Polícia Judiciária (PJ), the Polícia de Segurança Pública (PSP), the Guarda Nacional Republicana (GNR), and the Ministry of Justice’s central authority, to share offence‑related data with counterparts across the EU under the law‑enforcement cooperation framework. The government’s stated objectives include aligning Portugal with the EU Directive on information exchange between law‑enforcement authorities, accelerating response times for cross‑border evidence requests, and establishing minimum data‑protection safeguards for processing criminal intelligence.

Industry observers expect the most significant operational shift to be the introduction of a dual‑track system: automatic sharing of certain offence‑related metadata (suspect identifiers, offence classifications, and investigative status flags) alongside a retained exchange‑on‑request channel subject to judicial oversight. From a defence perspective, the practical effect is twofold:

• What changes. Data that previously required a formal mutual legal assistance (MLA) request, often taking months, may now flow automatically or within days. The scope of transmissible data categories widens to include digital forensic metadata, telecommunications identifiers, and financial‑transaction flags linked to organised crime and terrorism offences.
• What counsel must do in the first 30–90 days. Within 30 days of enactment, file preservation letters in every active cross‑border case. Within 90 days, audit all client matters for privilege‑sensitive material that could be caught by the automated exchange triggers and submit pre‑emptive confidentiality flags to the competent judicial authority.

Background, Existing Exchange of Information Portugal and EU Frameworks

To understand the draft bill’s significance, defence practitioners must distinguish between the tax‑focused automatic exchange of information (AEOI) regime and the law‑enforcement exchange channels the bill targets. Portugal has participated in the OECD’s Common Reporting Standard (CRS) since 2016, exchanging financial‑account information automatically with over 100 jurisdictions under the Global Forum on Transparency and Exchange of Information for Tax Purposes. The OECD’s Second Round Peer Review of Portugal assessed the country’s tax‑exchange framework as “Largely Compliant,” and a 2025 update confirmed continued adherence to CRS standards. As PwC’s Portugal tax summary notes, this AEOI framework covers financial‑institution reporting obligations and cross‑border tax transparency, it does not govern criminal‑evidence sharing.

On the law‑enforcement side, judicial cooperation Portugal has historically relied on a patchwork of instruments: bilateral MLA treaties, the Council of Europe’s 1959 Convention on Mutual Assistance in Criminal Matters, the 2000 EU Convention on Mutual Assistance, the European Investigation Order (EIO) regime, and the European Criminal Records Information System (ECRIS). Eurojust has served as the coordinating body for complex multi‑jurisdictional cases, while Europol provides intelligence‑sharing infrastructure. More recently, the EU’s legislative efforts on e‑evidence, including the European Production Order and the European Preservation Order, have further expanded the channels through which Portuguese authorities may request or provide digital evidence.

Portugal has also enacted domestic legislation transposing EU directives on combating terrorism and serious crime. A recent example is the decree‑law enhancing Portugal’s framework to combat the dissemination of terrorist content online, which imposed removal obligations on hosting‑service providers and established cooperation protocols with foreign authorities, as analysed by CMS. These successive layers mean that the draft bill does not enter a vacuum, it seeks to consolidate and streamline an already complex web of judicial cooperation Portugal relies on.

Timeline of Key Exchange Instruments in Portugal

What the 2026 Draft Exchange‑of‑Information Bill Says, Headline Provisions

The Minister of Justice’s speech on 24 March 2026 set out the government’s rationale: Portugal must domestically implement the EU directive requiring law‑enforcement authorities to share information “quickly and systematically” while maintaining proportionality and fundamental‑rights protections. The core architecture of the draft bill, as described during the parliamentary debate, includes the following headline provisions:

• Scope of application. The bill covers “crime and criminal activities”, a deliberately broad formulation that encompasses organised crime, terrorism, trafficking, cybercrime, financial crime, and potentially lower‑threshold offences where a cross‑border element is identified. The precise catalogue of triggering offences is one of the most contentious elements under debate.
• Designated competent authorities. The Polícia Judiciária (PJ) is named as the primary national contact point for outgoing and incoming requests, with supporting roles for the PSP, GNR, the Serviço de Estrangeiros e Fronteiras (where applicable), and the Ministry of Justice’s central authority for formal MLA channelling.
• Dual‑track mechanism. The bill establishes automatic exchange for pre‑defined data categories (suspect identifiers, offence classifications, digital identifiers, and vehicle‑registration data) and retains a judicial‑authorisation track for more intrusive data requests (content of communications, financial records, and location data).
• Data protection and retention. The draft imports GDPR and Law Enforcement Directive (LED) safeguards, including purpose limitation, data minimisation, logging of access, and retention ceilings. The Minister’s speech referenced maximum retention periods and mandatory deletion protocols, though the precise durations remain subject to parliamentary negotiation.
• Oversight and accountability. A supervisory mechanism involving the Comissão Nacional de Proteção de Dados (CNPD) and judicial review by the competent Portuguese courts is envisaged. Individual data subjects would retain the right to be informed of exchanges, although this right may be deferred where notification would jeopardise an ongoing investigation.
• Urgency provisions. For imminent‑threat situations (terrorism, kidnapping, attacks on critical infrastructure), the bill allows expedited exchange without prior judicial authorisation, subject to retrospective judicial validation within a defined time window.

Elements to Watch: Definitions, Scope, and Data Categories

Three areas of the draft merit particular scrutiny from defence counsel. First, the definition of “crime and criminal activities”, if interpreted broadly, routine criminal‑investigation data from minor offences could enter the automatic‑exchange pipeline, creating disproportionate surveillance risks. Second, the data categories eligible for automatic exchange: the inclusion of telecommunications identifiers and digital metadata without prior judicial approval represents a significant expansion compared with the current EIO regime, which requires dual‑authority endorsement.

Third, the urgency provisions: retrospective judicial validation is a familiar mechanism in Portuguese procedural law (compare the existing rules on urgent searches), but the time window for retrospective review and the standard of justification required will determine whether these provisions survive constitutional scrutiny under the Portuguese Constitution’s protection of fundamental rights.

Practical Impacts on Defence Rights, Admissibility, and Fair Trial Under the Exchange of Information Portugal Framework

The most consequential dimension of the draft bill for criminal defence practice lies not in its institutional architecture but in how evidence obtained through these accelerated channels will be used in Portuguese courtrooms and in coordinated prosecutions across EU Member States. Evidence circulation in the EU has long been governed by the principle of mutual recognition, but mutual recognition without harmonised procedural safeguards creates structural asymmetries that defence counsel must address proactively.

Evidence Chain and Notice Obligations

Under the current MLA and EIO framework, the defence typically learns of cross‑border evidence only at the disclosure stage or when the prosecution introduces it in court. The draft bill’s automatic‑exchange mechanism could compress this timeline dramatically: evidence may be transmitted, processed, and acted upon by Portuguese authorities before the defence has any notice. This raises fundamental questions about equality of arms under Article 6 of the European Convention on Human Rights (ECHR).

As eucrim has analysed, the fragmented nature of procedural remedies across EU Member States means that a defendant often cannot effectively challenge the legality of evidence gathering in the issuing state. If Portuguese authorities receive data from a German or French investigation, the defendant in Portugal may have no standing or mechanism to raise a procedural deficiency in the originating jurisdiction. The draft bill does not appear to create a domestic remedy for challenging foreign‑evidence gathering, a gap that early indications suggest defence practitioners will need to address through constitutional arguments and direct applications to the ECHR.

Defence counsel should demand, at the earliest possible stage, full disclosure of the chain of custody: the legal basis under which data was initially collected, the authority that authorised its transmission, the route of exchange (automatic or on‑request), and any processing or analysis carried out before it entered the Portuguese file. Without this chain, meaningful admissibility challenges are impossible.

Confidentiality and Lawyer‑Client Communications

Perhaps the most sensitive risk is that the broad data categories eligible for automatic exchange, particularly telecommunications identifiers and digital metadata, could capture lawyer‑client communications or derivative metadata revealing the fact, timing, and participants of privileged consultations. Portuguese procedural law (Code of Criminal Procedure, Articles 135–137) protects professional secrecy, and the Portuguese Bar Association has consistently defended the principle that communications between lawyers and clients are inviolable. At the European level, the CCBE’s March 2026 Contribution to the Rule of Law Report specifically warned about the risk that new information‑exchange regimes could erode legal professional privilege if adequate filtering mechanisms are not embedded at the point of transmission.

Defence counsel must proactively flag privileged material. The likely practical effect will be that passive reliance on post‑transmission judicial review will be insufficient, once metadata has been transmitted to a foreign authority, practical confidentiality is lost regardless of any subsequent exclusion order. Pre‑emptive confidentiality orders, registered privilege logs, and early notification to the competent judge are essential tools.

Admissibility Challenges and Exclusion Motions

Portuguese law provides several procedural avenues for challenging improperly obtained evidence. Article 126 of the Code of Criminal Procedure prohibits the use of evidence obtained through methods that violate fundamental rights, and Article 32 of the Portuguese Constitution guarantees the right to a fair trial and the presumption of innocence. When evidence enters the Portuguese file through the new exchange mechanism, defence counsel should consider motions grounded in the following arguments:

• Absence of judicial authorisation. If data was shared via the automatic channel without prior judicial approval, and the data category in question requires such approval under Portuguese constitutional standards, the evidence may be excludable as a nullity under Portuguese procedural law.
• Violation of proportionality. Where the scope of data transmitted exceeds what is strictly necessary for the stated investigative purpose, a proportionality challenge, grounded in both the Portuguese Constitution and Article 8 ECHR (right to privacy), may be viable.
• Failure to respect professional secrecy. If lawyer‑client metadata or communications were captured, a motion under Articles 135–137 of the Code of Criminal Procedure, combined with a reference to the CCBE’s principles and ECHR case law on lawyer confidentiality, should be filed immediately.
• Procedural deficiency in the originating state. Although Portuguese courts are generally reluctant to review foreign procedures under the principle of mutual trust, sustained ECHR jurisprudence (including the landmark M.N. and Others v. Belgium line of reasoning) supports the position that mutual trust does not preclude review where there are substantial grounds for believing that evidence was obtained in violation of fundamental rights.

Sample exclusion‑motion language: “The defence respectfully moves the court to exclude from the trial file all data items received under the automatic‑exchange channel pursuant to [reference to draft bill / enacted provision], on the grounds that said data was transmitted without prior judicial authorisation as required by Article 32 of the Constitution of the Portuguese Republic and Article 6 ECHR, and that its admission would violate the defendant’s right to a fair trial and equality of arms.”

Sample preservation‑request language: “The defence requests that the court order the competent authority to preserve, in unaltered form, all chain‑of‑custody records, transmission logs, and processing annotations pertaining to data received from [foreign authority / Member State] under the exchange‑of‑information mechanism, so as to enable meaningful review of the lawfulness of its collection, transmission, and use.”

How Domestic Procedures Interact with EU Tools, ECRIS, Eurojust, MLA, and E‑Evidence Routes

The draft bill does not replace existing judicial cooperation instruments, it adds a layer. Defence lawyers must understand which channel will be used when, because different mechanisms carry different procedural safeguards and different points of intervention for the defence. ECRIS Portugal currently handles the automated exchange of criminal‑record data and will continue to do so; the new bill would supplement ECRIS by enabling the exchange of investigative data, intelligence, evidence, and metadata, that ECRIS was never designed to transmit. Eurojust will retain its coordination role in complex multi‑jurisdictional cases, and the MLA channel will continue for requests that require the exercise of coercive powers (searches, seizures, compelled testimony).

The European Production Order and European Preservation Order, once fully operational, will create additional direct channels for obtaining digital evidence from service providers.

Scenarios, Which Mechanism Is Used When

Tactical Checklist, Steps Defence Lawyers Should Take Now for Cross‑Border Evidence Sharing

Regardless of the exact timing of enactment, the legislative direction is clear. Defence practitioners with active or anticipated cross‑border cases involving Portugal should take the following immediate steps:

1. Audit all active cross‑border matters. Identify every case in which Portuguese authorities could transmit or receive evidence under the new mechanism. Categorise data by sensitivity: privilege‑protected, personal data, commercially sensitive, or routine.
2. File evidence‑preservation requests. Submit written requests to the competent court to preserve chain‑of‑custody records, transmission logs, and processing annotations for any data that has been or may be exchanged cross‑border. Use the sample language provided above.
3. Register privilege logs. Formally notify the investigating authority and the competent judge of all communications, devices, and accounts that are subject to legal professional privilege. Request a filtering protocol before any automatic exchange is triggered.
4. Demand disclosure of the exchange legal basis. In every case where cross‑border evidence appears in the prosecution file, request written confirmation of the legal basis, the transmitting authority, the receiving authority, the date and time of transmission, and any conditions or limitations imposed.
5. Instruct co‑defence counsel abroad. Where parallel investigations exist in other Member States, coordinate with foreign defence teams to ensure that challenges are raised simultaneously in both the issuing and executing jurisdictions.
6. Prepare template admissibility motions. Draft jurisdiction‑specific motions to exclude evidence obtained without judicial authorisation, in violation of proportionality, or in breach of professional secrecy. Adapt the sample language above to the facts of each case.
7. File pre‑emptive confidentiality orders. Where there is a risk that automatic exchange could capture privilege‑sensitive metadata, apply to the competent court for an interim confidentiality order restricting the transmission of specified data categories pending judicial review.
8. Monitor parliamentary progress. Track the bill through committee, amendment, and plenary stages. Key amendments, particularly on the scope of automatic exchange, the urgency provisions, and retrospective judicial validation windows, will determine the final defence landscape.
9. Engage with the CNPD. Submit formal observations to the Comissão Nacional de Proteção de Dados regarding the bill’s data‑protection implications, particularly where the proposed processing exceeds what the Law Enforcement Directive permits.
10. Use Eurojust channels proactively. In coordinated cases, request that Eurojust facilitate defence access to case information and coordination, a power that is underused but available under the Eurojust Regulation.

Comparison Table and Timeline of Key Legislative Milestones

Parliamentary Timeline

• 24 March 2026: Minister of Justice speech and first parliamentary debate on the draft bill.
• April–May 2026 (expected): Committee scrutiny, public hearings, and amendment phase.
• Mid‑to‑late 2026 (projected): Plenary vote and, if approved, presidential promulgation followed by a transition period for implementing regulations.

Conclusion, The Exchange of Information Portugal Framework Demands Immediate Defence Action

The draft Exchange‑of‑Information Bill represents the most significant expansion of Portugal’s cross‑border evidence sharing capacity in over a decade. Defence lawyers cannot afford to wait for enactment to prepare. The tools exist now, preservation requests, privilege logs, confidentiality orders, admissibility challenges grounded in constitutional and ECHR principles, and should be deployed immediately in every active cross‑border matter. As the bill progresses through committee and plenary stages, practitioners should track amendments closely, engage with the CNPD and the Portuguese Bar Association, and coordinate with defence colleagues across the EU to ensure that the fundamental guarantees of a fair trial are not collateral damage in the pursuit of faster judicial cooperation.

This article is for informational purposes only and does not constitute legal advice. Specific matters should be discussed with a qualified legal professional. Last updated: 1 June 2026.

Sources

1. Portugal Government, Speech by the Minister of Justice (24 March 2026)
2. OECD, Peer Review of Automatic Exchange of Financial Account Information (2025 Update): Portugal
3. OECD, Global Forum on Transparency and Exchange of Information: Portugal (2022 Second Round)
4. PwC, Portugal Corporate Tax Summary: Other Issues
5. CCBE, Contribution to the Rule of Law Report 2026
6. eucrim, Justice Systems Built on Confidence
7. CMS, Portugal Enhances Its Framework to Combat the Dissemination of Terrorist Content Online
8. Global VAT Compliance, Portugal AEOI