LGPD.guide

LGPD

The General Data Protection Law (LGPD), Law No. 13,709/2018, is Brazilian legislation that sets out guidelines for the processing of personal data, aimed at protecting privacy and individual rights. Officially implemented in September 2020, the LGPD applies to any operation involving personal data, regardless of the medium, the country where the company is based, or the country where the data is located.

Origin and Inspiration

The LGPD was heavily inspired by the General Data Protection Regulation (GDPR) of the European Union, which came into effect in 2018. The GDPR established a global benchmark for data protection, influencing the creation of similar laws in other countries. Additionally, the LGPD also considered aspects of the California Consumer Privacy Act (CCPA) in the United States.

Laws Inspired by the LGPD

Since its implementation, the LGPD has served as a reference for other countries in Latin America and other regions looking to create or update their data protection laws. Countries such as Chile and Argentina have made progress in developing similar regulations, using the LGPD as a model.

Key Points of Attention

1. Consent

• Description: Consent must be freely given, informed, and unequivocal, meaning the data subject must know exactly what their data will be used for before granting permission.
• Importance: Without consent, processing personal data may be deemed illegal, except in specific situations allowed by law (such as compliance with legal obligations, contract execution, protection of life, etc.).
• Best Practices: Use clear and simple forms to obtain consent, avoiding technical terms or ambiguities that could confuse the data subject.

2. Data Subject Rights

• Description: The LGPD guarantees several rights to data subjects, including:
  • Data Access: The right to know what data is being processed.
  • Correction: The right to request the correction of incorrect, incomplete, or outdated data.
  • Anonymization, Blocking, or Deletion: The right to require unnecessary, excessive, or unlawfully processed data to be anonymised, blocked, or deleted.
  • Portability: The right to request that their data be transferred to another service or product provider.
  • Withdrawal of Consent: The right to withdraw consent at any time.
  • Data Deletion: The right to request the deletion of personal data processed based on consent.
• Importance: Ensuring these rights enhances consumer trust and helps avoid penalties.
• Best Practices: Establish clear and accessible channels for data subjects to exercise their rights, and keep records of all requests and their handling.

3. Specific Purpose

• Description: Data collection and processing must have a specific and legitimate purpose, clearly communicated to the data subject.
• Importance: Prohibits the use of data for purposes other than those disclosed to the data subject, unless new consent is obtained.
• Best Practices: Clearly define and document the purposes for which data is collected and ensure that all processing activities align with these purposes.

4. Transparency

• Description: Companies must be transparent about their practices regarding the collection, use, storage, and sharing of personal data.
• Importance: Transparency is vital for building and maintaining the trust of data subjects.
• Best Practices: Provide a clear and accessible privacy policy detailing data handling practices, who the data is shared with, and the rights of data subjects. Keep data subjects informed of any changes to these practices.

5. Data Security

• Description: The LGPD requires companies to implement technical and administrative measures to protect personal data against unauthorised access, destruction, loss, alteration, or any form of improper or unlawful processing.
• Importance: Data breaches can lead to severe legal and financial consequences, as well as damage to the company’s reputation.
• Best Practices: Implement encryption, access controls, regular backups, and robust information security policies. Train employees to recognise data security threats.

6. Accountability

• Description: The LGPD establishes the principle of accountability, meaning that companies must not only comply with the law but also be able to demonstrate compliance.
• Importance: Regulatory authorities may require evidence that data processing practices are in compliance with the LGPD.
• Best Practices: Maintain detailed records of all data processing activities, conduct regular audits, and ensure that all policies and procedures are documented and accessible.

7. Data Protection Officer (DPO)

• Description: The appointment of a Data Protection Officer (DPO) is mandatory for companies that engage in large-scale data processing.
• Importance: The DPO acts as the point of contact between the company, data subjects, and the National Data Protection Authority (ANPD).
• Best Practices: The DPO should have in-depth knowledge of the LGPD, be involved in reviewing all data processing practices, and be accessible to data subjects and the ANPD.

8. Breach Notification

• Description: In the event of security incidents that may pose significant risk or harm to data subjects, the company must notify the ANPD and the affected data subjects.
• Importance: Delayed or absent notifications can result in severe penalties and worsen the impact of the incident.
• Best Practices: Establish an incident response plan, including clear procedures for prompt and appropriate notification to authorities and data subjects as soon as a breach is detected.