5 Things to Know About LGPD in 2021

Businesses faced so many issues in 2020 that they could be forgiven for not updating their protocols for Lei Geral de Proteção de Dados (“LGPD”), Brazil’s new data privacy regulation, especially in light of the government’s refusal to delay implementation of the regulation in light of COVID-19 concerns. Indeed, a number of companies are already facing LGPD enforcement and fines, so if your New Year’s resolution is to get a better handle on your LGPD obligations, the five items listed below will put you on the right track.

1) Understand if LGPD applies to you

Like most data privacy regulations (e.g. GDPR and CCPA), LGPD is considered an “extra-territorial” jurisdiction, meaning that it can be enforced on companies inside of Brazil as well as those without a physical location in the country. LGPD applies to any data collection or processing activities conducted by a company if the data concerns Brazilian citizens. That means even if you have no office, employees or contractors in Brazil, you are still considered subject to the regulation if you’re collecting consumer data. LGPD does include some exemptions for the processing of personal data, including those intended for non-economic, journalistic, artistic, academic, public safety, national defense or state security activities; if you’re a for-profit business it’s highly unlikely you’ll be exempt.

2) What information does LGPD cover?

LGPD applies to the processing of “personal data”. Personal data is considered to be information that can be used to identify a person (e.g. name, address, phone, email, IP address, among others). “Processing” is defined as “any operation carried out with personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation or control of the information, modification, communication, transfer, dissemination or extraction.”