Bringing your company into compliance with Law No. 13,709/2018 (LGPD)

Law 13,709/2018, Brazil's General Data Protection Law (LGPD), sets rules for collecting and using personal data for many purposes, both online and offline. It establishes a new culture of data organization and protection within companies, schools and universities, or any establishment that processes data, sensitive or not.

Personal data means any information that can identify people, such as name, CPF (Brazilian taxpayer number), phone number, sexual orientation, ideology, racial and ethnic origin, political, religious or philosophical opinions, as well as data on children and adolescents.

Why the law exists

In a scenario of massive data collection and processing on the internet, the LGPD is a way to ensure that legal entities handle this information seriously, and to make transparent the purpose of its collection, storage and processing.

Many companies still have doubts, as information channels are not yet able to clearly specify the real reasons that justify the urgency of implementing the General Data Protection Law.

Another problem is that the lack of information prevents business owners from seeing how the Law applies to their company, both in terms of subject matter and territory. That is the role of the professional who implements these rules: minimizing risks and informing the client of the risks that make compliance necessary.

Penalties

As a regulatory law, it subjects data controllers to penalties in case of non-compliance, ranging from a warning to a fine of 2% of the company's annual revenue, capped at R$50 million, which may be combined with civil liability, in which case there is no limit to compensation.

Where to start

Companies are expected to begin with due diligence on personal, sensitive, children's, public or even anonymized data, in physical or digital form, in order to adopt a processing program in line with the general principles set out in article 6 of the law. This includes creating and reviewing documents (contracts, terms and privacy or processing policies) for internal and external use, making sure that personal data is not collected beyond what is needed for its intended use, and adjusting how long the data is processed by each department (accounting, human resources, finance, IT, sales).

How our advice works

Confident in our technical competence to implement the relevant regulations from a legal standpoint, our proposal meets the needs set out by the LGPD, prioritizing the legal certainty and financial health of the institution, corporation or company, in a gradual and qualitative way.

Our team provides this legal advice in modules:

1. Company diagnosis;
2. Risk mapping;
3. Advice on drafting and reviewing legal instruments;
4. Senior advice on implementing data governance and best practices;
5. Audit to review and handle any adjustments needed for up to 12 (twelve) months from the start of implementation.

The benefits of this LGPD-focused digital compliance program include:

• control over risks;
• fraud detection;
• prevention of data leaks;
• greater credibility and market expansion.

This advice is an obligation of means: successful implementation and legal compliance will only be achieved with the commitment of senior management, since the reputation of the company as a whole is at stake. Failure to comply may compromise the values of ethics and transparency at every level of the company, as well as its financial and organizational health.