.pt WHOIS Policy

WHOIS is a widely used consultation/response TCP - Transmission Control Protocol that provides information of registration data of domain names on the internet. ccTLD .pt has offered the WHOIS service since 2000, in strict compliance with the applicable legal provisions. Generally speaking, it is a free public directory that makes it possible to identify the data associated with the registration and technical maintenance of a domain name.

The legislative harmonisation between Member States in respect of the protection of personal data in the European Union, reflected, inter alia, in the adoption of Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation - GDPR) applicable from 25 May 2018, will enhance the level of protection of data subjects' rights, posing major challenges to organisations in terms of its materialisation and implementation.

Achieving the right balance between safeguarding the core foundations of WHOIS, such as, by way of illustration, the principles of proportionality, transparency, quality and minimisation in the context of processing of personal data and the defence of the fundamental rights and freedoms of natural persons in respect of the processing of personal data, is, therefore, a major concern of States and organisations in general, but also, in particular, of those responsible for managing top-level domains such as .PT.

At the same time, the transposition of Directive (EU) 2022/2555 (NIS 2) into the national legal framework, through Decree-Law No. 125/2025 of 4 December, which establishes the new Cybersecurity Legal Framework (RJC), has likewise impacted the regulatory framework applicable to the provision of data through the WHOIS service.

In this regard, an interpretation of the said regime establishes, on one hand, the obligation to ensure the existence of a public directory enabling the consultation of information associated with the registration of domain names, and, on the other hand, the requirement to ensure that the disclosure of such information complies with the applicable data protection rules, including the prohibition on publishing personal data (Article 36(5) of the RJC).

Therefore, the operation of the WHOIS service must comply with the security and resilience requirements for digital infrastructures set out in the RJC, as well as the requirements established under the GDPR and other applicable legislation.

For the purposes of framing the processing of personal data in the WHOIS service, .PT acts as the data controller with respect to personal data processed for the purposes of managing, administering, and making available the domain name registration directory. Accredited entities (registrars) may participate in the collection and transmission of registration data, acting as processors on behalf of .PT in relation to operations carried out on its behalf, without prejudice to situations where they process data for their own purposes, in which case they act as independent data controllers.

This Policy arises from the need to ensure the compliance of WHOIS with the new legal framework, while simultaneously ensuring the best practices in terms of the management of TLDs – Top-Level Domains – that, supported on the principles of transparency and publicity, foster confidence in the internet among all stakeholders.

In this context, and taking into account the provisions of GDPR,  the Cybersecurity Legal Framework, and other applicable legislation, as well as the recommendations issued by organisations such as CENTR – Council of European National Top-Level Domain Registries, ICANN – Internet Corporation for Assigned Names and Numbers and RIPE – Network Coordination Center, as well as the models adopted by various reference peers, the disclosure of data within the.PT WHOIS service shall be governed by the following terms and conditions:

Data supplied by the WHOIS service may be accessed through WHOIS' customer tools, command line or a web environment-based functionality. 

In order to prevent improper use of the WHOIS service, PT shall ensure the following steps:

a)searches shall be limited to a single criterion, the domain; accordingly, searches, for example, by the registrant/management body name, email or by address, shall not be possible;

b)no abusive use of the WHOIS service, based on the volume of consultations by origin (IP address) that shall be permitted;

c).PT shall maintain records of queries made to the WHOIS service for the purposes of detecting, preventing, and responding to abusive use, as well as ensuring the security and integrity of the service;

d) in the event of abusive use, access to the WHOIS service may be temporarily suspended for the originating IP address;

e)the duration of the suspension may be adjusted depending on the severity and recurrence of the abusive behavior identified;

f)consultations of domains outside the scope of .PT's powers (for instance, .com) shall be automatically excluded. In these cases, the WHOIS will reply by stating "invalid search", without making any additional search.