Data Privacy and Cybersecurity

Dedicated to solving the digital era’s most complex challenges

BMA’s Data Privacy and Cybersecurity practice area focuses on solving problems and responding to situations that involve the most valuable asset in today’s world: data. We know how important these questions are to organizations of all kinds, and that’s why we have put together a highly specialized team, chosen for their knowledge of technology and information security as well as the law, who are fully dedicated to helping our clients address the complex challenges brought about in recent years by forced digitalization and doing business in a digital environment.

Our team has practical experience in responding to adverse scenarios and managing crises caused by security incidents and cyberattacks, including ransomware cases. We give our clients the support they need at critical moments, monitoring forensic investigations, preparing response and communications strategies, interacting with regulatory agencies and data subjects, and representing their interests in administrative, judicial, and arbitration proceedings. 

At BMA, Data Protection means much more than compliance with Brazil’s General Data Protection Law, the LGPD. Our goal is to be a business partner to our clients in all matters related to personal data processing, so that they can make data-dependent deals, products and projects happen without losing focus on risk reduction and legal compliance. We do more than plan and carry out projects to bring companies into compliance with the LGPD: we help our clients identify and mitigate risks in negotiating contracts with commercial partners, suppliers and customers; manage their relations with regulators and government institutions; structure proposals on public policies; and assess the impacts of future regulations. 

Our team has been recognized as preferred local counsel in Brazil by well-known international law firms, giving us access to some of the best data privacy attorneys in the world and facilitating the resolution of problems that produce effects in various jurisdictions. 

Along with our unique expertise, our availability is another factor that sets our Data Privacy and Cybersecurity practice apart. Every second counts when responding to security incidents and cyberattacks. Our clients have an exclusive 24/7 hotline giving immediate access to our team so that we can provide the support our clients need, right from the very beginning of an adverse critical event. 

Our services in Data Protection and Cybersecurity include:

• Conducting projects for compliance with the General Data Protection Law and other legislation on data privacy; 

• Reviewing data privacy compliance programs from other jurisdictions to ensure that they meet Brazilian requirements; 

• Drafting and reviewing internal policies, procedures and terms of use; 

• Drafting, reviewing, and negotiating contracts involving the processing of personal data with commercial partners, suppliers, and customers; 

• Drafting and reviewing instruments to support international data transfers; 

• Assistance in compliance with data privacy laws; 

• Support in responding to security incidents, at all phases; 

• Interaction with regulatory agencies and government institutions; 

• Designing security incident response plans; 

• Advising on data privacy and cybersecurity aspects in development of new products and services;

• Conducting legal due diligence in data privacy and cybersecurity matters in background checks, M&A transactions, and public offerings of securities; 

• Representing clients in before the courts and in administrative and arbitration proceedings in matters related to data privacy or cybersecurity; 

• Direct support for Data Protection Officers; 

• Support in responding to requests from data subjects; 

• Preparing opinions and memorandums on issues involving data privacy, data protection and cybersecurity; 

• Conducting training and awareness sessions on data privacy, data protection, and cybersecurity; 

• Preparing and reviewing Personal Data Protection Impact Reports (RIPD) and Legitimate Interest Assessments (LIA); 

• Monitoring new rules and regulations on data privacy and protection and cybersecurity.

Data Privacy and Cybersecurity are matters that naturally interact with other areas of the law. Our practice is based on the Data Privacy Full Circle so that we can deliver complete solutions to our clients, identifying and dealing with areas that are important in each case, and making the most of the synergies offered by a full service firm like BMA.