CNPD + RGPD enforcement + cookie banner, como cumprir?

RGPD is the Portuguese name for GDPR, same regulation. The Portuguese implementation is Lei n° 58/2019 («Lei de Proteção de Dados Pessoais»), enforced by the CNPD (Comissão Nacional de Proteção de Dados).

Practical Magento implications:

• Cookie consent, CNPD follows EDPB guidelines: granular opt-in per purpose (analytics, marketing, personalisation), no pre-ticked boxes, «Reject all» as prominent as «Accept all». We ship Cookiebot, Axeptio, or a custom Hyvä banner wired into Magento’s cookie API.
• Data retention, CNPD enforces clear retention schedules. Customer orders typically kept 10 years (Portuguese fiscal law via the Autoridade Tributária), abandoned carts 6 months, marketing data with revocable consent only.
• Privacy policy, must be in Portuguese, identify the controller + DPO (if required), list every processor (Cloudflare, MailChimp, GA4, Hotjar, etc.), and detail the legal basis per processing purpose.
• Data localisation, CNPD doesn’t mandate EU-only hosting but prefers it. We default to Adobe Commerce Cloud Frankfurt, AWS Madrid (eu-south-2), or PTisp / OVH Lisbon.
• DSAR (data subject access requests), must respond within 30 days. We wire a Magento admin export tool that pulls customer + orders + reviews + newsletter consent into one PDF.

CNPD has issued multi-million-euro fines against telcos and banks, they enforce.