RCBE regime (annex to Law No. 89/2017) · Chapter VI · Data protection, retention of records and statistical data

Article 28 Controller of the database

Artigo 28.º · Entidade responsável pelo tratamento da base de dados

Lei n.º 89/2017 and the annexed Regime Jurídico do RCBE · consolidated text checked 26 October 2026

#

1. IRN, I. P., is the controller of the database, within the meaning and for the purposes of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, hereinafter referred to as the General Data Protection Regulation (GDPR), without prejudice to the responsibility incumbent by law on registry staff.

1 - O IRN, I. P., é o responsável pelo tratamento da base de dados, nos termos e para os efeitos definidos no Regulamento (UE) 2016/679 do Parlamento Europeu e do Conselho, de 27 de abril de 2016, relativo à proteção das pessoas singulares no que diz respeito ao tratamento de dados pessoais e à livre circulação desses dados, doravante designado abreviadamente por Regulamento Geral de Proteção de Dados (RGPD), sem prejuízo da responsabilidade que, nos termos da lei, incumbe aos trabalhadores dos registos.

#

2. IRN, I. P., shall ensure the data subjects’ right of information and of access to the data, as provided for in this regime, and shall ensure the lawfulness of the consultation and communication of the information.

2 - Cabe ao IRN, I. P., assegurar o direito de informação e de acesso aos dados pelos respetivos titulares, nos termos previstos no presente regime, bem como velar pela legalidade da consulta e da comunicação da informação.

#

3. IRN, I. P., shall adopt the security measures referred to in Article 32 of the GDPR, in particular by providing the RCBE database with the security safeguards necessary to prevent the consultation, modification, deletion, addition or communication of data by anyone not legally authorised to do so.

3 - O IRN, I. P., deve adotar as medidas de segurança referidas no artigo 32.º do RGPD, designadamente, conferindo à base de dados do RCBE garantias de segurança necessárias a impedir a consulta, a modificação, a supressão, o acrescentamento ou a comunicação de dados por quem não esteja legalmente habilitado.

What we checked in this article

IRN, I. P., as controller under the GDPR, the saving for the liability of registry staff and the reference to Article 32 of the GDPR are retained.

Need to file or update the RCBE declaration? Article 28 is where it starts.

We file initial RCBE declarations, updates and annual confirmations for Portuguese companies with foreign owners, and map the ownership chain so the beneficial owner is identified correctly. Fixed fee, done in English.

Unofficial English translation prepared by BCA Portugal for reference. Only the Portuguese text published in the Diário da República has legal force. Editorial notes are ours and are not part of the statute.

Applying the law

The RCBE declaration, filed correctly the first time

A missing or wrong declaration blocks dividend payments, public contracts and bank onboarding. Send us the ownership chart; we identify the beneficial owners, file the declaration and keep it current.

Get a quote