2023 saw the Brazilian Data Protection Authority (ANPD) penalize violations of data protection law for the first time. Tasked with overseeing personal data processing in Brazil, the authority commenced efforts to clarify specific aspects of the country’s General Data Protection Law (LGPD), which it also regulates. The ANPD addressed aspects within the LGPD concerning personal data security breaches and the processing of health sector data, all while gathering public input on topics such as legitimate interest and international data transfers. There is also an expectation the ANPD will be even more proactive in addressing unregulated issues in 2024.
Five years after it took effect, the LGPD has shifted the data protection landscape in Brazil. A comprehensive law that affects business and society at large, the LGPD has provided data processors with a clearer understanding of their responsibilities and the data subjects’ rights.
“The main challenge with the LGPD is implementing it effectively amidst the rapid advancements in technology and data usage. Essentially, it is a law that sets legal guidelines for governments, companies, and other entities that process personal data“
“Companies now find themselves at a different stage from when the LGPD was initially implemented. There’s currently a keen interest in understanding the ANPD’s approach – whether it will prioritize education or enforcement. It is crucial for new business ventures to have a clear understanding of the risks and opportunities to ensure sustained investment and engagement in this area”
