LGPD for companies: a practical compliance guide
The LGPD brought clear rules for the processing of personal data in Brazil. Complying with it is no longer optional and has become part of the risk management of any company that handles data.
What the LGPD is
The General Data Protection Law (LGPD) governs how individuals and legal entities may collect, store, use and share personal data in Brazil. It applies to most companies, regardless of size, whenever there is processing of natural persons' data. Enforcement and the issuing of supplementary rules are the responsibility of the National Data Protection Authority (ANPD).
Main obligations of companies
- Processing data only with an appropriate legal basis, such as consent, performance of a contract or legitimate interest
- Informing transparently which data is collected and for what purposes
- Adopting technical and administrative security measures to protect the data
- Keeping records of processing operations and responding to data subjects' requests
- Reporting relevant security incidents in accordance with the applicable guidelines
Data subjects' rights
The LGPD grants data subjects a series of rights, such as confirmation of the existence of processing, access to their data, correction of incomplete or outdated information, deletion of data processed on the basis of consent, and portability. Companies need to be prepared to receive and respond to these requests within a reasonable time.
Steps toward compliance
Compliance usually starts with a mapping of the data processed (data mapping), followed by a review of legal bases, contracts, policies and security measures. It is common to appoint a data protection officer (DPO), draft internal policies and train the teams. Compliance is generally an ongoing process, not a project with a single completion date.
Consequences of non-compliance
Non-compliance with the LGPD may result in administrative sanctions applied by the ANPD, in addition to contractual and reputational repercussions and possible claims for compensation by affected data subjects. Regardless of the penalties, good data management tends to reduce risks and strengthen the trust of customers and partners.
Frequently asked questions
Does the LGPD apply to small companies?
Yes. The LGPD applies, as a rule, to companies of any size that process personal data, although the ANPD may provide for differentiated and simplified treatment for small-scale agents in some respects. Even so, the principles and the rights of data subjects continue to apply.
Does every company need to have a data protection officer (DPO)?
Appointing a data protection officer is a common and recommended practice, but the ANPD may establish situations of exemption, especially for small-scale agents. Even when not mandatory, having a clear point of contact for data matters usually makes compliance easier.
Need guidance on this topic?
This article is informational. For guidance on your specific case, talk to our team.