Regulation of Brazil’s General Data Protection Law

In September of this year, the General Data Protection Law (LGPD – Lei Geral de Proteção de Dados Pessoais) will have been in effect for three years (except for the penalties under the Law, which only came into force later, on August 1, 2021).

Since September 2020 much has changed in the regulatory environment for data protection: just a few years ago, data protection was a question of little (or no) importance for Brazilian companies that did not do business in other countries; now it has become a fundamental issue for all organizations, in both domestic and international markets.  

These days, companies that do not comply with the LGPD lose businesses, especially with organizations that have implemented privacy programs, since doing business with companies that are unable to demonstrate their compliance with the law can generate significant risks.

Evidence of this change is easy to find: since September 2020, contracts that do not contain specific provisions on data protection are rare, and often the data protection clauses contain robust representations and warranties by the supplier of goods or services as to its own data security measures, data incident response plans, and persons qualified to act as DPOs, along with other detailed provisions. Companies that decline to sign data protection clauses because they are unable to comply with them are left on the sidelines.

Despite the importance the LGPD has taken on in the last few years, one vital aspect has been missing: legal certainty. Although the legislation has been in force, its application depends on various matters that were left to the regulator to determine.

Some of these matters have been dealt with by the National Data Protection Authority (ANPD - Autoridade Nacional de Proteção de Dados), such as the set of specific rules applicable to small-scale data processing agents, regulations on the ANPD’s inspection  and control process and regulatory enforcement proceedings, and, most recently, rules on the application and scaling of penalties provided for under the LGPD.

There are still gaps in the regulations, however, that need to be filled so that data controllers and data processors can fully comply with the legislation. After all, how can parties that control or process data be in full compliance with the law if the rules governing international data transfers, the time period in which data security incidents must be reported, and minimum information security measures have not yet been issued?

In this uncertain scenario, one thing is sure: even organizations that have made significant efforts to comply with the LGPD, through implementation of a robust governance programs, will have to review the work done to date and make adjustments to their programs when the regulations under the LGPD are finally complete.

>>>This article belongs to BMA Review 80. Click here to read more articles.