Are You Ready for Brazil’s New Data Protection Law?

What is the LGPD?

The LGPD seeks to prevent the misuse of personally identifiable information (PII) and of sensitive PII, affording a level of privacy not seen in Brazil to date. The primary aspects of the new law include:

1. Compliance by organizations headquartered in Brazil and by those who process personal data in Brazil;

2. Broadly defines “personal data” as any information related to an identified or identifiable individual;

3. Provides special treatment for “sensitive personal data,” defined as the personal data related to one’s racial or ethnic origin, religious and political views, union, religious, philosophical or political affiliations, health, sexual orientation or history, biometric or genetic data;

4. Establishes separate obligations and liabilities for data controllers and data processors;

5. Introduces a legal basis to collect and process personal data;

6. Creates data subject rights, such as the right to be forgotten and access to information; and

7. Provides mechanisms for cross-border data transfers to countries that are not considered to have an adequate level of protection.

Only data that is processed exclusively for personal use, for artistic, journalistic or academic work or for national security purposes is exempted from LGPD application.

With this enactment, Brazil moves away from a sector-based regulation model to one that affords legal certainty to companies and individuals nationwide. It also joins more than 100 countries that have similar laws in place.

Who is Affected by LGPD?

The LGPD applies to all private companies, government entities, and individuals that process personal data, regardless of location, provided that:

1. Data is processed or collected in Brazil; or

2. The processing operations have the purpose of offering or providing goods or services in Brazil.

For those not in compliance, the LGPD establishes administrative and civil sanctions ranging from a warning or a fine of up to 2% of an entity’s revenue in Brazil, limited to BRL$50 million (approximately US$13 million), to public disclosure of the violation or deletion or freezing of personal data until the violation has been resolved.

Are You Ready?

Compliance with the LGPD will be dependent on the robustness of your current data protection compliance program. To be compliant, parties affected will need to meet certain requirements, including:

1. Appoint a Data Protection Officer;

2. Promote a Data Protection Impact Assessment when processing activities create risks to data subjects;

3. Monitor record and data processing activities;

4. Ensure appropriate technical, security, and administrative measures are implemented to protect personal data; and

5. Communicate any data breach through a mandatory notification.

Authored by Isabel Carvalho, Rafael Loureiro and Daniel Crespo