The LGPD is in effect

After more than 2 years since its enactment, Brazil’s General Data Protection Law (the “LGPD” – Lei Geral da Proteção de Dados Pessoais) comes into effect this Friday, September 18, 2020.

The Law creates a new legal framework on the processing of personal data in Brazil, laying out new obligations for public and private organizations and establishing new rights for data subjects, who now have greater control over the collection and processing of their data.

Although the administrative sanctions set forth by the legislation, such as the fines of up to BRL 50 million for each violation that may be levied by Brazil’s Data Protection Authority, only come into force on August 1, 2021, the rest of the LGPD’s provisions become effective immediately.

In practice, this means that as of today other regulators such as the National Consumer Secretariat – SENACON, Consumer Protection Agencies – PROCONs, and the Public Prosecutors’ Offices may enforce the law, carrying out investigations, starting civil inquiries to ascertain possible violations, and levying fines for failure to comply with the Law.

Likewise, data subjects are now able to exercise their rights under the legislation, including their right to bring lawsuits based on possible violations of the LGPD.

It is important to note that the legislation comes into force before the National Data Protection Authority has been effectively put in place, which makes the challenge of complying with the Law even more complex, considering that a good part of the LGPD requires further regulation from the National Data Protection Authority.

At this time, it is vital to expedite or initiate LGPD compliance projects, prioritizing actions to comply with certain immediate requirements of the legislation, such as the appointment of a Data Protection Officer.

We will continue to closely monitor developments following the entry into force of the LGPD and progress on the appointment of the directors of the National Data Protection Authority, and the start-up of its operations.

Our Data Privacy, Technology and Digital Businesses team is available to answer any questions you have, and to assist in all aspects related to the compliance with the LGPD.

Photo:  Jannoon028/Freepik