Part of the AI Regulation News hub.
Portugal's CNPD approved a 2027-2029 multiannual plan naming AI competence and neurodata as priorities for the triennium
A regulator's work plan is not law. It is the closest published signal of where the next few years of supervisory attention will go, and Portugal has just named neurodata alongside AI.
Bottom line: Not binding on anyone. This is the CNPD's own multiannual activity plan for 2027-2029 plus its annual plan for 2027, approved after a public consultation. It creates no obligations for controllers.
Who this affects: DPOs and privacy counsel in Portugal, hospital and clinical research data controllers handling neurodata, and lawyers advising on the Digital Services Act regime under Lei 12-A/2026.
Issue date: 24 July 2026. The plan covers the 2027-2029 triennium, with the annual plan applying to calendar year 2027.
What changed: The CNPD approved four things at once: the multiannual plan, the report on the public consultation that preceded it, the 20 strategic actions going into the 2027 plan, and the 2027 plan itself.
Analysis: Twenty of 23 strategic actions were selected for 2027, and the Commission notes several are transversal and will not be exhausted within that year. The plan is therefore less a 2027 to-do list than a statement of what the CNPD intends to be capable of by 2029.
Primary sources: CNPD news item, 24 July 2026 · Plano Anual de Atividades 2027 (PDF) · CNPD public consultations
- Instrument (EN)
- Multiannual Activity Plan 2027-2029 and Activity Plan 2027, with the public consultation report
- Authority
- Comissao Nacional de Protecao de Dados (CNPD)
- Jurisdiction
- Portugal
- Status
- Approved and published
- Bindingness
- None. An internal planning instrument of an independent administrative entity
- Issue date / next deadline
- 24 July 2026 / plan period runs 2027 to 2029
- Consultation respondents
- AMD, APDSI, Ius Omnibus, and one lawyer who is also a DPO
- Actions
- 23 strategic actions for the triennium, 20 selected for the 2027 plan
- Primary source
- https://www.cnpd.pt/comunicacao-publica/noticias/cnpd-aprova-plano-estrategico-para-2027-2029-e-o-plano-de-atividades-para-o-ano-2027-apos-consulta-publica/
What the CNPD approved
The approval bundles several documents. The Commission adopted the Multiannual Activity Plan for the 2027-2029 triennium, the report of the public consultation that preceded it, the 20 strategic actions to be integrated into the 2027 activity plan, and the 2027 activity plan itself.
The consultation asked the public two questions: which actions are considered most priority, and what other actions should be developed over the triennium or already in 2027. Contributions came from associations connected to privacy and personal data processing, namely AMD, APDSI and Ius Omnibus, and from one lawyer who is also a DPO.
Four respondents is a small sample, and the CNPD does not present it as anything else. What it does report is that all participants stressed the importance of the public consultation exercise itself.
The three strategic objectives
The first is reinforcing the protection of personal data, with greater public dissemination of the CNPD's mission and of data subject rights, using strategic communication and new digital tools. The Commission notes that a reference to organising and optimising available resources has now been added to this objective.
The second is increasing strategic observation capacity regarding the risks and opportunities of technological acceleration and the security of the digital environment, promoting a regulatory framework that prevents and sanctions bad practices, in permanent dialogue with academic, scientific and business circles.
The third is reinforcing personal data regulation in Portugal through collaborative and cooperative mechanisms with national and international entities, with respect for the Commission's independence, autonomy and impartiality.
The priorities named for the triennium
Five themes stand out in the CNPD's own list: training in data protection in the digital environment, digital vulnerability, building the CNPD's capacity for digital regulation, reinforcing competences in artificial intelligence, and deepening the science of neurodata and its connection to AI.
The digital regulation strand is tied to a specific legal instrument. The CNPD frames it as capacity building with a view to complying with the Digital Services Regulation and its internal implementing law, Lei n. 12-A/2026 of 15 April.
The AI strand is framed in the same way, as reinforcing competences in the framework of the AI Regulation. Neither strand is described in the news item as a new supervisory competence, and we do not read it as one.
Why neurodata is the line to notice
Neurodata appears in the CNPD's priority list as its own item, coupled to AI rather than folded into the general special-category discussion. That coupling is the interesting part.
For clinicians and clinical research controllers, the practical reading is modest but real: an authority that spends 2027 to 2029 deepening its own understanding of neurodata is an authority that will ask better-informed questions about it afterwards. Nothing in this plan changes what a controller must do today.
Paula Meira Lourenco, the CNPD's president, framed the consultation itself as serving participation by interested parties in the CNPD's mission of defending citizens' fundamental rights, and as increasing the transparency of the Commission's activity as an independent administrative entity.
What we did not verify
We opened the CNPD news item of 24 July 2026 in Portuguese and took every fact and quotation from it.
We did not open the Plano Anual de Atividades 2027 PDF, the multiannual plan, or the public consultation report. We have not read the 23 strategic actions individually, and we cannot tell you which three were left out of the 2027 plan.
We make no claim that any of this creates an obligation, a deadline or an enforcement priority for controllers. It is a work plan, and the news item does not present it as more than that.
Read regulator work plans as capacity signals, not as rules. The CNPD has told the market where it intends to build expertise between 2027 and 2029, and neurodata linked to AI is on that list beside the Digital Services Regulation and the AI Regulation. If your processing touches those areas, the supervisory conversation you have in 2029 will be more technically informed than the one you would have today.
Source File
Open the CNPD news item of 24 July 2026 and confirm the four approved documents, the three strategic objectives, the named priorities including neurodata and the AI Regulation, and the count of 23 strategic actions with 20 selected for 2027.
na promocao da participacao dos interessados na missao da CNPD de defesa dos direitos fundamentais dos cidadaos [in promoting the participation of interested parties in the CNPD mission of defending citizens fundamental rights] ยท Paula Meira Lourenco, President of the CNPD, 24 July 2026
FAQ
Does this plan impose anything on controllers?
No. It is the CNPD's own multiannual and annual activity plan. It sets out what the authority intends to do, and the news item announcing it describes no new duty, deadline or reporting requirement for organisations.
How many people responded to the public consultation?
Four contributors are named: the associations AMD, APDSI and Ius Omnibus, and one lawyer who is also a DPO. The CNPD reports that all of them stressed the importance of the consultation exercise.
What is the connection to the Digital Services Regulation?
The CNPD lists building its capacity for digital regulation as a triennium priority, with a view to complying with the Digital Services Regulation and its internal implementing law, Lei n. 12-A/2026 of 15 April.
Why does neurodata appear in a data protection work plan?
The CNPD lists deepening the science of neurodata and its connection to AI among the priorities for the triennium. The news item does not explain the choice further, and we do not speculate about what supervisory action might follow.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.