Agriculture data analysis in Portugal: Opportunities, risks and contractual challenges of AgriTech

In precision agriculture, farms generate multiple layers of data: production and environmental data, equipment and service data, and personal data relating to farmers and workers.

In Portugal, personal data processing is governed by the GDPR and Law No. 58/2019, complemented by the Portuguese Charter of Human Rights in the Digital Age, which reinforces digital privacy and transparency. At the same time, a significant portion of agricultural data is non‑personal.

Recent rules on agricultural digitalisation, including open access to certain non‑personal data for public policy purposes, show that some farm data is increasingly treated as infrastructure of public interest. Contracts between AgriTech providers and farmers must therefore clarify what data is shared, on what legal basis, and for which primary and secondary purposes.

In terms of AI, the new EU Artificial Intelligence Act introduces a risk‑based framework. Low‑risk systems, such as tools that simply analyse historical data to generate dashboards, are mainly subject to transparency obligations. AI systems controlling drones, agricultural robots or critical irrigation and pesticide systems may be treated as high‑risk, subject to strict requirements on data quality, testing, monitoring and human oversight.

Nationally, the Portuguese Digital Charter and guidance from the Data Protection Authority stress that AI must respect fundamental rights, prevent discrimination and ensure explainability and accountability. For engineers, this means that compliance shapes system architecture and data flows; for lawyers, it must be reflected in contracts, internal policies and impact assessments.

Liability is where these elements converge. In the data sphere, anyone who suffers damage due to unlawful personal data processing has a right to compensation, which makes it essential to define clearly in contracts who is the data controller and the processor, what security measures apply and how the parties allocate risk in case of a breach.

In the physical and operational sphere, the legal regime applicable to drones in Portugal combines the strict liability of operators with mandatory civil liability insurance for certain operations. This model is increasingly used as a reference when allocating risk for other autonomous agricultural equipment and AI‑driven services. Contracts tend to include liability caps for software/AI providers, insurance obligations for operators and cooperation clauses for incident management, notifications and evidence preservation.

Before signing AgriTech contracts, businesses should map the data lifecycle and AI use cases:

• What data is collected
• Who can reuse it
• Which decisions are supported or automated by AI
• What insurance and liability mechanisms are in place

This will help avoid disputes, ensure compliance with data protection and AI rules, and make your investments in precision agriculture more secure.

José Miguel Pinho, Associate Lawyer, RBMS – Member of Ecovis International – Lisboa, Portugal
Email: jose.mpinho@rbms.pt