LGPD turns seven: between advances and challenges

This Thursday (14th), the Brazilian General Data Protection Law (LGPD) marks seven years since its enactment. Approved in 2018, this legislation represents a watershed moment in the consolidation of fundamental rights within the Brazilian digital environment, ensuring the privacy, freedom, and protection of citizens' personal data.

Since its entry into force, the LGPD has regulated the processing of personal data, including sensitive information such as racial origin, ideological convictions, and biometric data, establishing how this data must be collected, stored, and used by companies, public bodies, and organizations. 

According to the LGPD Panel in Courts Report, prepared by the Center for Law, Internet and Society (Cedis-IDP) in partnership with Jusbrasil and with support from the United Nations Development Programme (UNDP Brazil), there has been a significant increase in the number of judicial decisions mentioning the LGPD. Between October 2023 and October 2024, 15,921 decisions citing the legislation were identified, representing a growth of 112% compared to the same period the previous year, when 7,503 decisions were recorded. 

The effective application of the sanctions provided for by the law began in August 2021, following a transition period initiated in 2020. Since then, the National Data Protection Authority (ANPD), responsible for overseeing compliance with the regulation, has acted strategically. The authority has published technical guides, conducted public consultations, analyzed security incidents, and applied penalties, including significant fines.

With the rapid advancement of technology and artificial intelligence, the challenges for data protection have become even more complex. Issues such as consent for the use of information in algorithm training, the explainability of automated decisions, and the application of the principles of data minimization and information security have become central to ongoing compliance with the LGPD.

The concept of Privacy by design gains prominence in this scenario, requiring organizations to adopt preventive data protection measures from the outset of product and service development.

For lawyer and Law Professor at Centro Universitário Itaperuna, Dr. Rayla Santos, this date reinforces the need to consolidate a robust culture of respect for privacy. "Each anniversary of the LGPD reminds us that it is not merely a legal norm, but the continuous building of a culture of respect for privacy," she states. According to her, the law emerged in response to social and technological transformations impacting how data is processed and shared. "The LGPD was inspired by international legislation, such as the EU's GDPR, but adapted to the Brazilian reality, representing a significant advancement in the protection of individual rights."

With the advancement of artificial intelligence, Dr. Rayla Santos assesses that the application of LGPD principles—such as informed consent, data minimization, and algorithmic transparency—is increasingly urgent. She emphasizes that companies and developers must adopt ethical practices in using data to train automated systems, ensuring clarity regarding the processing of personal information. The expert also highlights the need for solid data governance, emphasizing that the legislation requires security measures and best practices from the conception of technologies, in accordance with the principles of Privacy by design and privacy by default..

Another point emphasized by the expert from Afya Itaperuna is the role of educational and research institutions in training professionals prepared for the challenges of digital privacy. "It is not enough to apply the LGPD mechanically. It is necessary to understand its principles and spirit. Teaching about data protection must expand beyond Law, reaching areas such as information technology, engineering, and social sciences," she advocates.

For the coming years, several trends gain relevance: the institutional strengthening of the ANPD, specific regulation on artificial intelligence in dialogue with the LGPD, the dissemination of a data protection culture in academic and corporate environments, and the training of specialists equipped to handle the new scenarios of the information society.