General Personal Data Protection Law in Brazil: next steps

Updated: May 3

Tablet mostra a tela do Google
Com a vigência da LGPD, quais rumos as empresas devem tomar para se adequar?

Published in August 2020, the General Data Personal Protection Law (LGPD) shall fully enter into force in August 2021. Understand here.

Current impact of LGPD on businesses

The LGPD provisions currently in force regard data-processing and liability arising from personal data misuse, but not penalties from noncompliance with the law. Those shall enter into force this August.

The part currently in effect – the carrot - enables businesses to begin LGPD compliance processes, to map internal personal data flows, and to draw adequacy or improvement strategies. The stick only becomes mandatory in August.

Who is responsible for keeping a business LGPD-compliant?

The LGPD created the Data Protection Officer (DPO) (yes, this portion is already in force). The DPO is a bridge between a business entity holding personal data of third parties (clients, employees, etc.) and the Data Protection National Authority (ANPD).