Portugal:
What your customers there expect

Portugal as a market for South America

According to Eurostat, Portugal imported goods worth about €3.4 billion from Argentina, Bolivia, Brazil, Chile, Ecuador, Colombia, Paraguay, Peru and Uruguay in 2025. Of that, €2.7 billion came from Brazil. Exports to these countries came to €1.3 billion, again with Brazil far ahead.

About half of the imports is crude oil from Brazil (€1.7 billion). Next come soybeans and raw cane sugar from Brazil, aircraft from Brazil, fish and shrimp from Ecuador, bananas from Colombia, and beef from Uruguay and Argentina. Volumes are smaller than in Spain or Italy. In return, Brazilian companies can mostly skip translating contracts, labels and manuals.

The largest container port is Sines, with 1.9 million TEU in 2024, followed by Leixões near Porto and Lisbon (Eurostat).

What applies EU-wide and what is Portuguese

Customs, rules of origin, CE marking and food law are EU law and work the same in Portugal as anywhere else in the Union. The basics are in the guide to exporting to the EU.

Matters regulated at the Portuguese level include:

• Language: Decreto-Lei 238/86 requires information on the nature, characteristics and guarantees of goods to appear in Portuguese on labels, packaging, brochures and user manuals. Contracts for domestic sales, as well as invoices and receipts, must also be drawn up in Portuguese; other languages may be added. Brazilian Portuguese generally meets this requirement, though some technical terms differ.
• Packaging: like every EU country, Portugal has an extended producer responsibility system for packaging. Your importer reports the quantities and needs details on material and weight. Since August 12, 2026, the EU Packaging Regulation (EU) 2025/40 applies as well.
• VAT: the standard rate on the mainland is 23%, with reduced rates of 13% and 6%. Madeira and the Azores have their own, lower rates.

NIS2 in Portugal

Portugal transposed the NIS2 Directive through Decreto-Lei 125/2025 of December 4, 2025. It contains the Regime Jurídico da Cibersegurança and has applied since April 3, 2026. The competent authority is the Centro Nacional de Cibersegurança (CNCS), and the national CSIRT is CERT.PT. Banks, investment firms and insurers stay under Banco de Portugal, CMVM and ASF, and DORA applies to them as well.

The implementing rules are in CNCS Regulamento 756/2026, in force since June 23, 2026. Entities in scope had to identify themselves on the MyCiber platform; according to the CNCS, the deadline for existing entities expired on September 15, 2026. Significant incidents must be reported within 24 hours, with an update following within 72 hours. One Portuguese peculiarity is that the end of the impact is reported separately, and the final report is due 30 business days after that. Essential entities face fines of up to €10 million or 2% of worldwide annual revenue for violations, important entities up to €7 million or 1.4%. Until April 3, 2027, entities can file a reasoned request for exemption from certain fines.

Data protection and supply chain

In Portugal, the GDPR is enforced by the Comissão Nacional de Proteção de Dados (CNPD). Additional rules are set out in Lei 58/2019. Brazilian service providers are in a comfortable position: in January 2026 the EU recognized Brazil as having adequate data protection, so standard contractual clauses are no longer needed. Your customer still needs a data processing agreement under Art. 28 GDPR.

Portugal has no supply chain law of its own. If you supply a Portuguese company in the food or textile industry, expect questions about working conditions and origin anyway, because large buyers in the EU collect this data from their suppliers. The European CSDDD will set the rules, with transposition due by July 26, 2028.

What Portuguese customers typically ask for

Food retailers and processors ask for a certificate under IFS, BRCGS or FSSC 22000. For soy, beef, coffee and wood, they want geolocation data and evidence for the EUDR. Industrial customers usually expect ISO 9001.

Brazilian IT service providers working for Portuguese banks, insurers or energy companies receive security questionnaires modeled on NIS2 and DORA. An ISO 27001 certificate answers many of these questions in one go. Sightadel is available in Brazilian Portuguese and covers ISO 27001 as well as DORA, so a Brazilian team can prepare the evidence in its own language. Also expect a contractual incident reporting deadline that is shorter than your customer's own 24 hours.

Where to get help

• The Câmara Portuguesa de Comércio no Brasil in São Paulo, founded in 1912, and the other Portuguese chambers of commerce in Brazil, which are joined in a federation.
• AICEP, Portugal's government agency for trade and investment, with information on the Portugal Global portal.
• The trade section of your country's embassy in Lisbon.
• The Enterprise Europe Network in Portugal, for finding partners and questions about EU law.
• Portuguese customs: Autoridade Tributária e Aduaneira (AT).

Since May 1, 2026, goods from Brazil, Argentina, Paraguay and Uruguay have provisionally benefited from the tariff cuts of the EU-Mercosur Agreement, as long as you can prove their origin.

FAQ