Portugal updates cybercrime law to exempt security researchers

Portugal introduced Article 8.º-A to its cybercrime law, establishing a legal safe harbor for good-faith security research when strict conditions are met, including purpose-limited vulnerability identification, immediate reporting to system owners and the CNCS, no service disruption or unlawful personal data processing, prohibitions on techniques like DoS, social engineering, and malware, and confidentiality with timely data deletion; similar protections are noted in Germany’s 2024 draft law and the U.S. DOJ’s 2022 CFAA policy update.