LGPD
General Data Protection Law (Lei Geral de Proteção de Dados)
What you need to know
LGPD is a Brazilian law that establishes rules on the collection, use, processing, storage, and sharing of personal data, with the aim of protecting the privacy and fundamental rights of individuals.
LGPD compliance applies to any organization, regardless of its location, that processes personal data in Brazil, or that offers goods or services to individuals located in Brazil.
LGPD imposes significant fines and penalties for non-compliance and provides individuals with various rights, including the right to access, correct, and delete their personal data.
Organizations that process personal data must comply with a range of obligations, such as obtaining individuals' consent before collecting their data, implementing appropriate security measures to protect personal data, among others.
LGPD also establishes the National Data Protection Authority (ANPD), which is responsible for overseeing and enforcing the law. The ANPD has the power to impose fines of up to 2% of a company's annual revenue or a maximum of R$50 million (approximately USD $9.4 million).
LGPD applies to any organization, regardless of size, so even small businesses and startups need to comply with the law?
Brazil is one of the few countries in Latin America that has a comprehensive data protection law?
LGPD is considered one of the most comprehensive data protection laws in the world?
Under LGPD, individuals have the right to request the deletion of their personal data from an organization's database? This is known as the "right to be forgotten" and is similar to a provision in the GDPR.
Key Benefits of comforte’s LGPD Compliance services
The comforte Data Security Platform provides data discovery, classification and protection capabilities to help you:
FAQs on LGPD Compliance
What does LGPD stand for?
LGPD stands for "Lei Geral de Proteção de Dados," which translates to the General Data Protection Law. It is the comprehensive data protection law in Brazil, enacted to safeguard the rights of individuals regarding the processing of their personal data.
Who does LGPD apply to?
LGPD applies to all entities, including businesses, government agencies, and organizations of any size, that process personal data in Brazil or offer goods and services to individuals within Brazilian territory, regardless of where the company is physically located. The law covers data processing activities that involve collecting, storing, using, sharing, and transferring personal data.
Why comply with LGPD?
Complying with LGPD is essential for businesses and organizations operating in Brazil to maintain legal and regulatory compliance. By adhering to LGPD's principles, organizations can demonstrate their commitment to respecting individuals' privacy rights, which in turn fosters trust and confidence among customers and data subjects.
How to be LGPD compliant?
To be LGPD compliant, organizations need to implement privacy policies and practices that align with the law's requirements. This includes obtaining valid consent for data processing when necessary, providing clear and transparent privacy notices, establishing mechanisms for data subjects to exercise their rights (e.g., access, rectification, erasure), and implementing appropriate security measures to protect personal data.
What is the difference between GDPR and LGPD?
The GDPR provides a definition of a data processor as a "natural or legal person, public authority, agency, or any other entity that processes personal data on behalf of the controller." However, unlike the GDPR, the LGPD specifically focuses on safeguarding the personal data of natural persons, thereby excluding protection for data belonging to legal entities.
Next steps
LGPD compliance is vitally important for any business. If you would like to learn more about our LGPD compliance services, please feel free to get in touch with our experts who would be happy to discuss solutions.
Contact us