Brazilian General Data Protection Law
In 2018 the Brazilian General Data Protection Law (Law n. 13.709/18 – LGPD) was issued, whose purpose is to regulate the processing of personal data. Most of the provisions of LGPD became effective on September 18th, 2020, and another part of its provisions, concerning the sanctions applicable to violations of data protection rules, will become effective on August 1st, 2021.
Many of the rules set forth in LGPD were inspired by the General Data Protection Regulation (GDPR), applicable in the European Union. Before the issuance of LGPD, the regulation of personal data protection in Brazil was limited and had little practical effect. LGPD aims to considerably expand the protection provided for this type of data by creating a series of rules and principles to be observed by companies, individuals, and public bodies, as well as by creating mechanisms of control and application of penalties in case of violations.
The process of conferring effectiveness to LGPD tends to be intensified in 2021, as the National Data Protection Authority begins to consolidate itself and move towards the regulation and enforcement of the law. On February 1st, 2021, the National Data Protection Authority published its Strategic Planning for 2021-2023, which contains the guidelines for its operation in the coming years. Also, as previously mentioned, as of August 1st, 2021 the National Data Protection Authority will be authorized to start applying penalties in case of violations of data protection rules.
The processing of personal data is, to a greater or lesser degree, a reality for any company. Therefore, it is necessary for every company in Brazil to reassess its internal practices and policies, in order to identify and correct possible issues, avoiding penalties (such as fines, data blocking, compulsory data deletion, etc.), as well as direct claims from personal data holders.
Many multinational companies have already adjusted themselves to data protection rules applicable in their countries, however, have not yet addressed this issue in their Brazilian subsidiaries from the perspective of LGPD.
We are at your disposal for further clarification on this topic, as well as to assist you in adapting your internal practices and policies to LGPD.