LGPD.guide

LGPD

The General Data Protection Law (LGPD), Law No. 13,709/2018, is a Brazilian legislation that establishes guidelines for the processing of personal data, with the aim of protecting privacy and individual rights. Officially implemented in September 2020, the LGPD applies to any operation involving personal data, regardless of the medium, the country where the company is based, or the country where the data is located.

Origin and Inspiration

The LGPD was heavily inspired by the General Data Protection Regulation (GDPR) of the European Union, which came into force in 2018. The GDPR set a global benchmark for data protection, influencing the creation of similar legislation in other countries. Additionally, the LGPD also considered aspects of the California Consumer Privacy Act (CCPA) in the United States.

Laws Inspired by the LGPD

Since its implementation, the LGPD has served as a reference for other countries in Latin America and other regions seeking to create or update their data protection legislation. Countries like Chile and Argentina have advanced in creating similar regulations, using the LGPD as a model.

Key Points of Attention

1. Consent

• Description: Consent must be freely given, informed, and unequivocal, meaning that the data subject must know exactly what their data will be used for before giving permission.
• Importance: Without consent, the processing of personal data may be considered illegal, except in specific situations allowed by law (such as compliance with legal obligations, contract execution, protection of life, etc.).
• Best Practices: Use clear and simple forms to capture consent, avoiding technical terms or ambiguities that could confuse the data subject.

2. Data Subject Rights

• Description: The LGPD guarantees several rights to data subjects, including:
  • Data Access: The right to know what data is being processed.
  • Correction: The right to request the correction of incorrect, incomplete, or outdated data.
  • Anonymization, Blocking, or Deletion: The right to require unnecessary, excessive, or unlawfully processed data to be anonymized, blocked, or deleted.
  • Portability: The right to request that their data be transferred to another service or product provider.
  • Withdrawal of Consent: The right to withdraw consent at any time.
  • Data Deletion: The right to request the deletion of personal data processed based on consent.
• Importance: Ensuring these rights reinforces consumer trust and helps avoid penalties.
• Best Practices: Establish clear and accessible channels for data subjects to exercise their rights, and keep records of all requests and how they were handled.

3. Specific Purpose

• Description: Data collection and processing must have a specific and legitimate purpose, clearly informed to the data subject.
• Importance: Prohibits the use of data for purposes other than those informed to the data subject, unless new consent is obtained.
• Best Practices: Clearly define and document the purposes for which data is being collected and ensure that all processing activities are aligned with these purposes.

4. Transparency

• Description: Companies must be transparent about their practices for collecting, using, storing, and sharing personal data.
• Importance: Transparency is crucial for building and maintaining the trust of data subjects.
• Best Practices: Provide a clear and accessible privacy policy detailing how data is handled, who it is shared with, and the rights of data subjects. Keep data subjects informed of any changes to these practices.

5. Data Security

• Description: The LGPD requires companies to implement technical and administrative measures to protect personal data against unauthorized access, destruction, loss, alteration, or any form of improper or unlawful processing.
• Importance: Data breaches can result in severe legal and financial consequences, as well as damage to the company’s reputation.
• Best Practices: Implement encryption, access controls, regular backups, and robust information security policies. Train employees to recognize data security threats.

6. Accountability

• Description: The LGPD establishes the principle of accountability, meaning that companies must not only comply with the law but also be able to demonstrate compliance.
• Importance: Regulatory authorities may require evidence that data processing practices are in compliance with the LGPD.
• Best Practices: Maintain detailed records of all data processing activities, conduct regular audits, and ensure that all policies and procedures are documented and accessible.

7. Data Protection Officer (DPO)

• Description: The appointment of a Data Protection Officer (DPO) is mandatory for companies that engage in large-scale data processing.
• Importance: The DPO acts as the contact point between the company, data subjects, and the National Data Protection Authority (ANPD).
• Best Practices: The DPO should have in-depth knowledge of the LGPD, be involved in reviewing all data processing practices, and be accessible to data subjects and the ANPD.

8. Breach Notification

• Description: In case of security incidents that may pose significant risk or harm to data subjects, the company must notify the ANPD and the affected data subjects.
• Importance: Late or absent notifications can result in severe penalties and worsen the impact of the incident.
• Best Practices: Establish an incident response plan, including clear procedures for prompt and appropriate notification to authorities and data subjects as soon as a breach is detected.