Regulation — The Portuguese Framework Explained

Law No. 5-A/2026 at a glance

Law No. 5-A/2026 of 28 January (Lei n.º 5-A/2026, de 28 de janeiro) approves transparency rules for the interaction between private entities — expressly including foreign ones — and Portuguese public entities, and creates the Transparency Register of Interest Representation (Registo de Transparência da Representação de Interesses — RTRI), operating under the Assembleia da República, the Portuguese Parliament (Article 1(1)). It entered into force on 27 July 2026, 180 days after publication (Article 21).

Its scope turns on the definition of legitimate interest representation: activities carried out in accordance with the law with the aim of influencing, directly or indirectly, the preparation or execution of public policies, legislative and regulatory acts, administrative acts or public contracts, as well as the decision-making processes of public entities, whether in one’s own name, for specific groups or on behalf of third parties (Article 2(1)). Covered activities include contacts with public entities in any form, the circulation of position papers and informative material, the organisation of events promoting the interests represented, and participation in consultations on legislative proposals (Article 2(2)). Eight categories of public entities are covered, from the Presidency of the Republic and Parliament to regulators, the Banco de Portugal and regional and local government (Article 3).

The RTRI is a single register — public, free of charge and open — made available through Parliament’s portal in machine-readable, searchable, open-data formats (Article 4(4)). Registration is not a formality without consequences: entities subject to registration must appear in the RTRI before being granted a hearing (Article 8(1)), public entities disclose at least quarterly the meetings held with registered entities (Article 8(3)), Parliament discloses its own meetings monthly (Article 8(4)), and a legislative footprint mechanism requires the identification, at the end of each legislative procedure, of all consultations and interactions that occurred during its preparation (Article 10).

Registered entities carry continuing duties: identifying themselves with their RTRI registration number before the officeholders they address (Article 7(1)), keeping records of contractual relations where they professionally represent third parties (Article 7(2)) and updating registered data within 30 days (Article 5(4)). Breaches attract sanctions that include suspension of registration or of institutional contacts for up to 2 years, access limitations on individuals for up to 2 years and exclusion from public consultation procedures for up to 2 years (Article 11(1)), with sanctioning decisions published on Parliament’s portal (Article 11(2)). Unregistered representation and the provision of false information are communicated to the Public Prosecution Service (Article 11(6)). A cooling-off rule bars former holders of political and senior public offices, and their staff, from representing interests before the body in which they served for 3 years (Article 12(1)). A Code of Conduct is annexed to the law and forms an integral part of it, binding both public entities and registered representatives (Article 15(1)).

What the regime is not: the negative delimitation

The law does not swallow ordinary procedural participation. Article 2(3) excludes, among other situations, the acts exclusive to lawyers and solicitors in forensic mandate, the activity of social partners in social concertation, responses to information requests from public entities, and the exercise of procedural rights under the Portuguese Administrative Procedure Code (Código do Procedimento Administrativo — CPA) and the Public Contracts Code (Código dos Contratos Públicos — CCP). Interacting with the administration through those codes’ own channels is therefore not, in itself, registrable interest representation.

The data protection layer

Because the RTRI publishes information about identifiable persons — responsible individuals, members of governing bodies — the law expressly anchors its data processing in the General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR), requiring the safeguarding of personal data in the register’s open-data publication (Article 4(4)). International organisations should treat their RTRI submissions as a data protection matter as well as a transparency one.

Implementing rules still to come

Two implementing measures remain outstanding and are tracked on this website: [the statute on the governance and management model of the RTRI, to be approved by Parliament in a specific instrument — Article 14] and [the notice announcing the date on which the RTRI starts operating, to be published by Parliament in the Diário da República — Article 18(3)]. The 60-day registration window for professional representatives of third parties counts from that start of operation (Article 19(2)).