LGPD.guide

Quick Overview of the LGPD

The General Data Protection Law (LGPD), Law No. 13,709/2018, is a Brazilian legislation that establishes guidelines on the processing of personal data, aiming to protect individuals’ privacy and rights. Officially implemented in September 2020, the LGPD applies to any operation involving personal data, regardless of the medium, the country where the company is based, or where the data is located.

Origin and Inspiration

The LGPD was heavily inspired by the General Data Protection Regulation (GDPR) of the European Union, which came into effect in 2018. The GDPR set a global benchmark for data protection, influencing the creation of similar laws in other countries. Additionally, the LGPD considered aspects of the California Consumer Privacy Act (CCPA) in the United States.

Laws Inspired by the LGPD

Since its implementation, the LGPD has served as a reference for other countries in Latin America and other regions seeking to create or update their data protection laws. Countries like Chile and Argentina have moved forward with creating similar regulations, using the LGPD as a model.

Key Points of Attention

1. Consent

• Description: Consent must be given freely, informed, and unequivocally, meaning that the data subject must know exactly how their data will be used before granting permission.
• Importance: Without consent, processing personal data may be considered illegal, except in specific situations allowed by law (such as legal obligations, contract execution, life protection, etc.).
• Best Practices: Use clear and simple forms to capture consent, avoiding technical terms or ambiguities that could confuse the data subject.

2. Data Subject Rights

• Description: The LGPD guarantees several rights to data subjects, including:
  • Access to Data: Right to know what data is being processed.
  • Correction: Right to request the correction of incorrect, incomplete, or outdated data.
  • Anonymization, Blocking, or Deletion: Right to demand that unnecessary, excessive, or unlawfully processed data be anonymized, blocked, or deleted.
  • Data Portability: Right to request that their data be transferred to another service or product provider.
  • Consent Withdrawal: Right to withdraw consent at any time.
  • Data Deletion: Right to request the deletion of personal data processed based on consent.
• Importance: Ensuring these rights reinforces consumer trust and helps avoid penalties.
• Best Practices: Establish clear and accessible channels for data subjects to exercise their rights, and maintain a record of all requests and how they were handled.

3. Specific Purpose

• Description: Data collection and processing must have a specific and legitimate purpose, clearly informed to the data subject.
• Importance: Prohibits the use of data for purposes other than those informed to the data subject, unless new consent is obtained.
• Best Practices: Clearly define and document the purposes for which the data is being collected and ensure that all processing activities align with these purposes.

4. Transparency

• Description: Companies must be transparent about their practices for collecting, using, storing, and sharing personal data.
• Importance: Transparency is essential for building and maintaining the trust of data subjects.
• Best Practices: Provide a clear and accessible privacy policy detailing how data is handled, with whom it is shared, and the rights of data subjects. Keep data subjects informed about any changes to these practices.

5. Data Security

• Description: The LGPD requires companies to implement technical and administrative measures to protect personal data against unauthorized access, destruction, loss, alteration, or any form of improper or unlawful processing.
• Importance: Data breaches can result in severe legal and financial consequences, as well as damage to the company’s reputation.
• Best Practices: Implement encryption, access control, regular backups, and robust information security policies. Train employees to recognize data security threats.

6. Accountability

• Description: The LGPD establishes the principle of accountability, meaning that companies must not only comply with the law but also be able to demonstrate this compliance.
• Importance: Regulatory authorities may require evidence that data processing practices comply with the LGPD.
• Best Practices: Maintain detailed records of all data processing activities, conduct regular audits, and ensure that all policies and procedures are documented and accessible.

7. Data Protection Officer (DPO)

• Description: Appointing a Data Protection Officer (DPO) is mandatory for companies that process large-scale data.
• Importance: The DPO acts as the point of contact between the company, data subjects, and the National Data Protection Authority (ANPD).
• Best Practices: The DPO should have a deep understanding of the LGPD, be involved in reviewing all data processing practices, and be accessible to data subjects and the ANPD.

8. Breach Notification

• Description: In the event of security incidents that may pose a significant risk or harm to data subjects, the company must notify the ANPD and the affected data subjects.
• Importance: Delayed or absent notifications can result in severe penalties and exacerbate the impact of the incident.
• Best Practices: Establish an incident response plan, including clear procedures for promptly and appropriately notifying authorities and data subjects as soon as a breach is detected.