Skip to main content
project@netbasejsc.com
Mon–Sat: 9:00–18:15, Sun: closed
91 Nguyen Chi Thanh, Hanoi
Facebook X (Twitter) LinkedIn YouTube

What are you looking for?

Explore our services and discover how we can help you achieve your goals

Portugal software delivery: CNPD enforcement, ATCUD invoicing, MB WAY and Chave Movel Digital

A Portugal-facing project turns on four decisions before a proposal is comparable: which authority enforces GDPR and how a breach is reported, whether invoicing software must carry the tax authority's ATCUD code and QR code, whether checkout needs MB WAY or Multibanco, and when Chave Movel Digital sign-in or Portuguese-language interfaces are required. Settle these first.

Submit a project Explore custom engineering

Reviewed by Huy Nguyen (David), CEO · Updated 21 Oct 2026 · 13 min read

star

OutsourcingVN is operated by Netbase JSC, and this guide is written by a supplier that would welcome your project. It separates what Portuguese and EU law actually require from what Netbase can evidence about its own practice, with the regulators' and operators' own pages named throughout for your own legal and tax advisers to verify. The guides index covers other markets, and the market index shows which question each one answers first.

Contents

Who enforces data protection for a Portugal-facing product?

GDPR applies directly across the European Union, and Portugal's national supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD), the authority responsible for monitoring and supervising compliance with the GDPR and Portugal's own data protection laws in defence of the rights, freedoms and guarantees of individuals. A controller must have a lawful basis for each use of personal data, honour access, correction, erasure and other subject-rights requests, and notify its data protection authority of a qualifying breach without undue delay and, where feasible, within 72 hours of becoming aware of it.

None of that changes because the development team sits outside Portugal. What changes is who signs the processing agreement, who is named controller or processor, and who answers the CNPD's questions if a Portuguese user complains. A buyer should settle those three roles before discovery starts, not after a defect surfaces.

What can Netbase evidence for a Portuguese brief?

Procurement, security and data protection reviewers tend to ask for the same four statements. These are the ones Netbase can give.

  • Compliance practices. Netbase's compliance practices are GDPR alignment for data privacy in Europe, HIPAA-aligned methodologies for healthcare data handling, and CCPA compliance for clients with U.S. customer bases. How Portugal's own implementing rules apply to your product stays your organisation's task.
  • Security practices. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. Your organisation decides who signs the processing agreement and who the CNPD contacts first if a breach is reported.
  • Information security management. Netbase JSC holds ISO 27001 certification for information security management. Your organisation still runs its own security review of a Portugal-facing deployment before launch.
  • Markets, language and hours. Netbase clients are in the United States, Europe and Asia-Pacific, and most projects come from clients outside Vietnam. Netbase delivery communication is in English. Portuguese copy review is owned by a reviewer the buyer names. The Hanoi office works Monday to Saturday, 9:00-18:15 Vietnam time (UTC+7), and support coverage follows those days. Mainland Portugal runs UTC+0 in winter and UTC+1 in summer, so that day falls at 2:00-11:15 Lisbon time in winter and 3:00-12:15 in summer: the overlap sits in the Lisbon morning.

Which requirement sits with which decision owner?

A Portuguese brief spreads the decision across six decision areas and several owners, and a proposal that blurs them tends to promise more than any one team can actually check once the contract is signed.

Decision area What Portuguese and EU rules expect What a supplier can evidence Who decides
Data protection A lawful basis per use, a 72-hour breach report to the CNPD A data processing agreement, an access matrix, a tested breach-response plan Data protection officer
Accessibility Public-sector websites and apps follow the Web Accessibility Directive, supported by the EN 301 549 standard; the European Accessibility Act extends similar duties to private-sector products from 28 June 2025 Per-journey test results with assistive technology, a defect log Product or service owner
Invoicing software A unique document code (ATCUD) and a QR code on every invoice, from software approved by the tax authority and reported through SAF-T A tested document-series registration and a sample invoice Finance systems owner
Payments MB WAY payment requests confirmed on the buyer's phone, Multibanco references and cards; SIBS manages the Multibanco network A tested payment flow with a fallback for a failed transfer Product owner with payments provider
Sign-in Chave Movel Digital, the state-backed sign-in and digital-signature method accepted on public and some private portals A scoped integration under the access terms the service grants Product owner
Language Portuguese copy for consumer-facing journeys; English is common for B2B tools A named copy owner and a tested translation workflow Localisation owner

Ask for this table filled in, not just a general compliance statement, before shortlisting a supplier.

Which steps come before a Portugal-facing launch?

  1. Map personal data to a lawful basis

    For each use your Portugal-facing product makes of personal data, record what is collected, why, and which GDPR lawful basis applies to that specific use.

  2. Decide the accessibility scope

    Decide what a public-sector-facing service must meet under EN 301 549, and whether the European Accessibility Act, in application since 28 June 2025, reaches a private product.

  3. Enable ATCUD and QR code invoicing

    If the business issuing the invoices is a Portuguese VAT taxpayer, choose invoicing software approved by the tax authority, register the document series to receive its validation code, and keep the ATCUD and QR code on every invoice reported through SAF-T.

  4. Scope Portuguese-language copy

    Decide which consumer journeys ship in Portuguese at launch, and name an owner for translation review.

  5. Decide go-live readiness

    Check the data map, the accessibility test results, the invoicing integration and the language scope against the plan, and record the decision with its owner.

  6. Launch and keep the record current

    Publish or update the accessibility statement, keep the breach-response plan rehearsed, and re-test the invoicing and payment integrations at the next major release.

Diagram of a Portugal-facing launch pipeline: map personal data, decide the accessibility scope, enable ATCUD and QR code invoicing and scope Portuguese-language copy, then decide readiness before launch and keep the record current
Diagram of a Portugal-facing launch pipeline

Worked scenario: a Portugal-registered vendor issues an ATCUD invoice

A SaaS vendor registered for VAT in Portugal bills a Portuguese business customer monthly for a subscription, so every invoice must carry a valid ATCUD and QR code.

  1. Series registered

    The business registers its document series with the tax authority and receives a validation code

    Owner
    Finance systems

  2. Invoice generated

    The approved software composes the ATCUD from the validation code and the sequential number, and generates the QR code

    Owner
    Engineering

  3. Buyer notified

    The invoice, carrying both codes, reaches the Portuguese buyer

    Owner
    Buyer's finance team

  4. Correction handled

    If a field is wrong, the software issues a correction document, not a manual workaround

    Owner
    Engineering with support

  5. Record kept

    The invoice and its ATCUD are recorded in the vendor's SAF-T (PT) file

    Owner
    Finance systems

  6. Review at renewal

    The series and its validation code are checked again if registration details change

    Owner
    Product owner

A proposal that cannot describe step 4, specifically what happens when an invoice field needs correction after the ATCUD has been assigned, has not yet scoped Portuguese invoicing for this product.

What has Netbase built that is relevant to a Portuguese brief?

The most relevant published evidence for a Portugal-facing brief is Netbase's own Portuguese client record. For Rebelo AG, a printer in Portugal, Netbase set up a 3D preview in the online designer for boxes and other multi-sided products, configured by uploading 3D model files and enabling the preview per product, on a go-live timeline of about three and a half months; the Rebelo AG 3D product preview record has the detail. Rebelo AG's published results are revenue +39% in the first year, engagement +98%, personalised-segment conversions +53% and productivity +25%: a single client's figures, not a benchmark. Netbase has delivered product personalisation on client print stores, including online designers, configurators and 3D cover and box previews, for print-commerce clients in Singapore, Switzerland, Hong Kong, Germany, China, the United Kingdom, the Netherlands, the United States, Poland, France and Portugal. The product personalisation and online design solution sets out how designer and configurator work is scoped.

Which questions should you ask a supplier?

  • Who signs the data processing agreement, and who is named controller? Expect a clear answer before contract, not during a breach.
  • What exactly does your security and compliance statement cover? A precise answer says what it does not cover as well as what it does.
  • Can you show an invoice your platform has actually produced with a valid ATCUD and QR code? Ask for the file, not just a claim that the connection exists.
  • How do you test against EN 301 549? Ask for real assistive-technology testing, not a tool report alone.
  • Who owns the Portuguese copy, and how does a change reach production? Translation drift is easiest to catch before launch, not after.
  • What happens in your build when an invoice field needs correction after ATCUD has been assigned? A vague answer here usually means the path has not been tested.

What usually goes wrong?

  • A generic privacy policy stands in for product-specific evidence. Signal: nobody can show a tested data map, access matrix or rehearsed breach-response plan for this particular product. Owner: the data protection officer.
  • ATCUD and QR code treated as a reporting feature added at the end. Signal: the document-series registration is missed because invoicing was bolted on late. Owner: the finance systems owner.
  • Accessibility testing left until the week before release. Signal: a defect backlog surfaces once the launch date is fixed. Owner: the product owner.
  • Portuguese copy translated once and never re-tested. Signal: error messages and generated documents drift out of Portuguese after launch. Owner: the localisation owner.

How this guide is sourced and where it stops

This guide draws on the CNPD's own description of its role, the tax authority's own pages on the unique document code and the invoice QR code, SIBS's own description of MB WAY and Multibanco, the digital-identity portal's own description of Chave Movel Digital, and the European Commission's own pages on web accessibility, all checked on 2026-10-20 or 2026-10-21, together with evidence approved in the OutsourcingVN claim register. It is written for product, procurement and operations leads scoping a Portugal-facing brief; it does not decide which accessibility duty or invoicing route fits your organisation.

Plan the next step for your project

Submit a project Explore custom engineering

Common questions

The regulation is the same across the European Union; what differs by country is which authority enforces it, and in Portugal that authority is the CNPD. Check its current guidance rather than assuming every member state applies it identically.

Since 1 January 2023, invoices and other fiscally relevant documents must carry the code, and the tax authority states that every VAT taxpayer, whether its activity is taxable or exempt, must apply it; check how it applies to your entity with your own tax adviser.

Not always. Many buyers ship the journeys Portuguese customers use most in Portuguese and keep less-used screens in English, provided a named owner reviews Portuguese copy before each release.

From 28 June 2025 the European Accessibility Act extends common accessibility requirements to a wide range of products and services across the EU, alongside the longer-standing duty on public-sector sites; your advisers should confirm which duties reach your product.

Yes, when the series registration, the validation code and the correction path are scoped with the same care as any other billing integration, and tested against real invoices before launch.

The business owner, by naming which journeys need a user's identity confirmed through the Portuguese state's sign-in; Chave Movel Digital is accepted on public and some private portals, and every other journey can use the product's own sign-in.

Plan the first release

Bring your GDPR role split, your accessibility scope, your ATCUD and QR code invoicing route, your MB WAY or Multibanco decision and your Portuguese-language boundary. The data security and compliance guide lists the contract questions behind the data protection row, and the time zone and collaboration guide covers how overlap and handoff are agreed for a European working day. For other EU markets, the Spain guide covers the AEPD, Verifactu and Cl@ve under the same EU law base, and the France guide covers CNIL guidance and the French e-invoicing reform; the product personalisation and online design solution scopes design-tool work like the Rebelo AG record in detail.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your Portugal-facing scope, and a person will reply with whether discovery or a bounded implementation is the right next step.

Custom product engineering for a bounded release outcome Custom product engineering for a bounded release outcome

One defined release of your product, built to named outcomes and handed over with acceptance evidence.

Learn More
line

Sources

91 Nguyen Chi Thanh, Hanoi

+84 937 869 689

Tell us what you want to build or automate.

Submit a project