LGPD, Brazil's General Data Protection Law: do business owners know what it is about?
- Elton Martins
- 8:18 am
Transparency is one of the main goals of Brazil's General Data Protection Law (LGPD) and of personal data protection rules. With it, users and data subjects can know exactly what happens to their data, with far more security and trust when using a website or service, and confidence that they are only providing the data actually needed to fill in forms, whether for purchases and sales, medical or educational purposes, or even data provided to companies as employees or job applicants.
Despite all the current debate, some still doubt the need to comply. That is why it is important to discuss a few points of the Law that have been keeping many business owners up at night.
Penalties since August 2021
In force since 2020, the LGPD, which is regulatory in nature, began applying penalties to data controllers in August 2021 in cases of non-compliance or failure to follow its guidelines and procedures.
These penalties range from a warning to fines of 2% (two percent) of the company's annual revenue, capped at R$50 million, and may be combined with civil liability, in which case there is no limit to compensation.
Administrative penalties apply to individuals and legal entities that fail to comply with the law, and they are imposed through decisions of the National Data Protection Authority (ANPD), a federal body linked to the Federal Executive Branch.
What personal data and sensitive data are
Common doubts surround the concept of personal data. Article 5, item I, of the LGPD defines personal data as "information relating to an identified or identifiable natural person." In other words, everything from your document numbers to the pages you like and the profiles you follow on social media may be considered personal data.
There is also a second category of personal data, called "sensitive" (art. 5, item II), which may lead to discrimination against a person and, for that reason, must be handled with greater care.
| Type of data | What the law says | Examples |
|---|---|---|
| Personal data (art. 5, I) | Information relating to an identified or identifiable natural person | Date of birth, nationality, profession, GPS data, electronic identifiers, tastes, interests and consumption habits |
| Sensitive personal data (art. 5, II) | Data linked to a natural person that may lead to discrimination | Racial or ethnic origin, religious belief, political opinion, trade union membership, health, sex life, genetic or biometric data |
Compliance is more than a consent form
It must be stressed that not only data leaks, but also unnecessary collection or unlawful processing of such data may lead to severe penalties. Contrary to what is often wrongly reported, compliance with the LGPD is not achieved merely with electronic or printed consents or regulations on the use of personal data. It goes further: it is a set of practices to be applied case by case among the employees and the systems used by the data controller.
Applying the LGPD correctly supports both personal and professional security, and it must be applied and respected on a regular basis, tailored to each company and line of business. There are no magic formulas.
Business owner, does your company have the support of a competent team to achieve this compliance?