Data Protection Series: Brazil's LGPD Compliance Challenges

As companies prepare to adapt to Brazil's new GDPR-style data protection law, local GCs highlight the benefits of greater data protection legislation for businesses, but suggest the lack of an appointed authority to oversee and enforce the law will create major compliance challenges for legal teams.

After eight years of discussions in congress, on 14 August 2018, Brazil became the latest Latin American country to implement an overhaul of its data protection laws governing how companies collect, use, disclose and process personal data. The Latin American Corporate Counsel Association (LACCA) and TMF Group take a look at Brazil's new laws as well as some of the compliance challenges facing GCs and their teams.

The Lei Geral de Proteção de Dados (LGPD), which will come into effect in February 2020, reproduces some of the central points of the European General Data Protection Regulation (GDPR) and imposes significant compliance obligations on companies that process data or offer services to individuals in Brazil. "The law is about the protection of all personal data, similar to the GDPR, affecting all companies that deal with data," says Vanessa Mello, director of client legal compliance operations at TMF Group Brazil.

The LGPD applies to all legal entities that process personal data, whether public or private, operating in Brazil or that supply goods or services to individuals located in Brazil. Companies must expressly seek consent from the owner of the data, informing them exactly what data is being collected, why, and for how long it will be stored. In addition, the data must be destroyed when the company no longer has any need for it. As under most privacy frameworks, additional protections apply to certain categories of data, such as the personal data of minors and "sensitive" data. "This will have a big impact on businesses in Brazil," says Mello. "Companies used the information they collected as they wanted before, such as for commercial purposes, pricing or survey or market research type purposes but they will not be able to do that anymore."

Similar to the EU's GDPR provisions, the scope of the new law also applies to global businesses that are headquartered abroad but that affect or target Brazilian citizens.

The law also outlines fines for non-compliance; however, unlike the GDPR penalty, which can reach up to 4% of a company's global revenue, Brazil's law is less severe, reaching up to 2% and limited to 50 million reais...