LGPD

Protecting your data

Privacy, the protection of personal data and its transparent, ethical, secure and responsible use are essential values to us.

WHAT IS THE LGPD?

General Data Protection Law

The General Data Protection Law (13.709) was enacted in 2018 and brought a series of obligations that both companies and individuals who carry out any kind of personal data processing are now required to comply with.

The LGPD aims to protect the fundamental rights of Freedom and Privacy of citizens by creating a framework to control the use of personal data, consequently establishing a series of rights for the data subject and duties for the individual or legal entity that carries out the processing.

The main goal of this guide is to present, in a clear and objective way, the main concepts, contents and rights of the Law, in order to clarify doubts, raise awareness and assist with the topic of privacy and personal data protection.

Woman smiling while using her phone

Important Concepts

PRIVACY DOESN’T HAVE TO BE COMPLICATED!

LGPD Principles

Man smiling while using his phone in an office
LGPD

Fundamental Right

The Federal Constitution is the fundamental norm that governs Brazilian Law. Aware of the importance of personal data protection, the National Congress approved Constitutional Amendment 115/2022, which added item LXXIX to article 5 of the Constitution, providing that the right to the protection of personal data, including in digital media, is guaranteed under the terms of the law.

Legal Bases For Processing Personal Data

To process Personal Data, the General Data Protection Law requires that the organization present a justification to support and legitimize the processing of this data. Below are the 10 legal bases provided by the LGPD:

  1. 1 –Consent
  2. 2 –Compliance with a Legal Obligation
  3. 3 –Execution of Public Policies
  4. 4 –Studies by a Research Body
  5. 5 –Performance of a contract
  6. 6 –Regular exercise of rights
  7. 7 –Protection of life
  8. 8 –Protection of health
  9. 9 –Legitimate Interest
  10. 10 –Credit protection

It is worth noting that, although consent is the best known, there is no hierarchy among the legal bases. Data processing may be carried out as long as it falls under at least one of these 10 aforementioned bases.

Data Subject Rights

According to article 18 of the LGPD, the data subject has the right to obtain from the controller, at any time and upon request:

I.

Confirmation of the existence of processing;

II.

Access to the data;

III.

Correction of incomplete, inaccurate or outdated data;

IV.

Anonymization, blocking or deletion of unnecessary or excessive data, or data processed in non-compliance with the provisions of the LGPD;

V.

Portability of data to another service or product provider, upon express request, in accordance with the regulations of the National Authority, observing commercial and industrial secrets;

VI.

Deletion of personal data processed with the consent of the data subject, except in the cases provided for in art. 16 of the Law;

VII.

Information about the public and private entities with which the Controller carried out shared use of data;

VIII.

Information about the possibility of not providing consent and about the consequences of refusal;

IX.

Revocation of consent, under the terms of § 5 of art. 8 of the Law.

It is worth noting that all organizations must have a direct communication channel with the DPO so that data subjects can exercise their rights. We at InBot have this channel within our privacy policy, thus respecting legality and ethics in the processing and protection of personal data.

ANPD

Sanctions

As we saw earlier, the ANPD is the body responsible for monitoring and overseeing the implementation of the LGPD in organizations, also being responsible for applying the appropriate administrative sanctions to companies that are in disagreement with the provisions of the regulation.

It is worth noting that the ANPD applies its sanctions not only in the event of a leak of personal data, but also in the case of non-compliance with processes and activities. The possible penalties are provided for in Article 52 of Law 13.709/2018, as follows:

  1. 1 –a warning, with an indication of a deadline for adopting corrective measures;
  2. 2 –a simple fine of up to 2% (two percent) of the organization’s revenue, excluding taxes, limited in total to R$ 50,000,000.00 per infraction;
  3. 3 –a daily fine, observing the total limit referred to in item II;
  4. 4 –public disclosure of the infraction after it has been duly ascertained and its occurrence confirmed;
  5. 5 –blocking of the personal data to which the infraction refers until it is regularized;
  6. 6 –deletion of the personal data to which the infraction refers;
  7. 7 –partial suspension of the operation of the database to which the infraction refers for a maximum period of 6 (six) months, extendable for an equal period, until the processing activity is regularized by the controller;
  8. 8 –suspension of the exercise of the processing activity of the personal data to which the infraction refers for a maximum period of 6 (six) months, extendable for an equal period;
  9. 9 –partial or total prohibition of the exercise of activities related to data processing.
Team in a work meeting in a conference room