Portuguese prosecutors have issued new legal guidance for magistrates following changes to cybercrime law that pardon ethical hackers testing corporate and public security systems.
Under the practical note released by the leadership of the Public Prosecution Office, computer security testing that was previously classified as a crime punishable by imprisonment will be forgiven, provided it remains within specified limits.
Guidance for magistrates
The directive was drafted to assist magistrates in handling cases involving white hat hackers who access digital infrastructure to detect flaws in organizational networks. The measure follows an amendment to Portugal's Cybercrime Law that came into force in April 2026.
Prior to the legal revision, security researchers who breached computer systems without explicit authorization risked formal criminal prosecution and potential jail sentences, regardless of whether their intentions were benign.
Protection for security research
Ethical hackers, often referred to as white hat hackers, specialize in identifying vulnerabilities within computer networks so that system administrators can fix security flaws before malicious cybercriminals exploit them. Their testing frequently involves probing corporate databases, public sector portals, and institutional servers for code weaknesses.
The new legal framework creates specific boundaries under which unauthorized access for verification purposes is no longer treated as a criminal offense. The Public Prosecution Office issued the guidelines to ensure consistent application of the law across judicial districts when prosecutors evaluate whether a hacker's actions fall within the scope of the legal pardon.
Role of judicial authority
The Public Prosecution Office serves as Portugal's state prosecution authority, overseeing criminal investigations and guiding legal strategy across national courts. By issuing practical notes, its leadership provides magistrates with standardized criteria for applying complex statutory updates in courtroom proceedings.
Reporting on the legal change was published by Portuguese news outlet Correio da Manhã on September 22, 2026, based on details compiled by journalist João Carlos Rodrigues.
