Information security policy
PT.EL Portugal Economics and Legal · Version 3.0 · Public document · 1 October 2026
This Policy sets out how Portugal Economics and Legal protects the information entrusted to it. It is a public document, addressed to clients, partners and suppliers. The internal rules that implement it are not published, since their disclosure would reduce their effectiveness.
1. Purpose and scope
This Policy applies to all information processed by the firm, in any medium, whether paper or digital: client files and documents, personal data, financial information, contracts, correspondence and internal information. It applies equally to the systems and equipment that support that information, to the physical archive and to services contracted from third parties.
It is binding on the management, the lawyers, the economists, the trainees, the administrative staff and all service providers and partners who have access to information of the firm or of its clients.
2. What we protect and why
The information that clients entrust to us is covered by lawyers’ professional secrecy (Article 92 of the Statute of the Portuguese Bar Association) and by the duties of confidentiality incumbent on economists. Much of it contains personal data, sometimes of special categories, and commercial or financial information whose disclosure would cause harm. Protecting it is a legal and professional obligation and the condition of the trust on which our business rests.
3. Legal framework and references
This Policy complies with Regulation (EU) 2016/679 (GDPR) and Law no. 58/2019, the Statute of the Portuguese Bar Association, the retention and confidentiality duties under Law no. 83/2017 and the Cybercrime Law (Law no. 109/2009). As a reference for good practice, it follows the National Cybersecurity Reference Framework issued by the National Cybersecurity Centre (Centro Nacional de Cibersegurança).
4. Principles
Confidentiality: information is accessible only to those who need it for the work assigned to them.
Integrity: information is accurate and complete, and changes are logged.
Availability: information is accessible when needed, including after a failure or an incident.
Least privilege: each person has only the access rights they need, for as long as they need them.
Proportionality: measures are appropriate to the risk and to the value of the information.
Accountability: each person is answerable for the information they access and for the credentials they use.
Security by design: security is considered when a tool is chosen or a process is designed, not afterwards.
Continuous improvement: measures are reviewed in the light of incidents, audits and the evolution of threats.
5. Governance and responsibilities
The management approves this Policy, ensures the resources needed to comply with it and is informed of relevant incidents.
The management is responsible for information security: it coordinates the implementation of the Policy, maintains the asset inventory and the risk assessment, monitors incidents and proposes the review of measures.
Each person working at the firm complies with the internal rules, protects their credentials, uses the systems only for authorised purposes and immediately reports any incident or suspected incident.
Service providers comply with the security and confidentiality obligations laid down in their contracts.
Non-compliance may give rise to disciplinary, civil or criminal liability, in accordance with the law.
6. Risk management and information classification
We maintain an inventory of information assets and assess risks at least once a year and whenever there is a relevant change, such as the adoption of a new tool or a new service provider. The risks identified give rise to a treatment plan with assigned owners and deadlines.
Information is classified into three levels, each with its own rules on access, sharing, storage and destruction:
Public: intended for disclosure, such as the content of the website.
Internal: management information whose disclosure is not intended, but would not cause serious harm.
Confidential: client information and all information covered by professional secrecy or containing personal data. It never leaves the systems approved by the firm.
7. Protection measures
Access. Individual accounts, never shared; two-step authentication on all systems that process confidential information; periodic review of access rights; immediate revocation when a person leaves the firm or changes role.
Equipment. Encrypted disks, automatic locking, security updates installed without delay and protection against malicious software. Confidential information is not stored on equipment that the firm does not manage.
Communications. E-mail encrypted in transit and protected against sender spoofing; confidential documents sent through a secure channel, and never through public forms or unapproved messaging applications.
Cloud services. We use only providers that offer contractual guarantees of security and data protection, with the data held in the European Economic Area or subject to equivalent safeguards. Back-ups are made daily, stored at a separate location and tested periodically.
Physical archive. Paper documents are kept in locked cabinets, with restricted access, and securely destroyed when the retention periods expire.
Working away from the office. Access to systems only through a secure connection; rules on the use of public networks and on the protection of documents while travelling.
Continuity. A recovery plan that allows systems and data to be restored within a defined time after a failure or an attack.
8. Service providers
Before engaging a provider with access to confidential information, we assess its security guarantees. The contract includes confidentiality obligations, the clauses required by Article 28 GDPR where personal data are processed on our behalf, limitation of access to what is strictly necessary, a duty to report incidents and our right to verify compliance.
9. Security incidents
An incident is any event that compromises, or may compromise, the confidentiality, integrity or availability of information: unauthorised access, loss or theft of equipment, sending information to the wrong recipient, malicious software, unavailability of a system.
Anyone who detects an incident reports it immediately to the person responsible for information security. Clients, partners and third parties may report incidents or vulnerabilities to seguranca@pt-on.com; we undertake to respond and not to take action against anyone who reports a vulnerability in good faith.
The response follows four steps: containing the incident, assessing its scope and the persons affected, recovering systems and data, and recording what happened and the lessons to be learned. Where the incident involves personal data and presents a risk to data subjects, we notify the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority, within 72 hours and, if the risk is high, we inform the persons affected. Clients whose information has been affected are always informed.
10. Training, review and document control
All staff receive information security training when they join the firm and at least once a year thereafter, including practical exercises on the most common threats, such as fraudulent messages.
This Policy is reviewed annually and whenever there is a change in the law, a relevant incident or a significant change in the systems or the organisation. Amendments are approved by the management and communicated to all those to whom the Policy applies.
Version 3.0 · Classification: public · Approved by the management on 1 October 2026 · Next review: 1 October 2027.
