This Thursday (14), the General Data Protection Law (LGPD) completes seven years since its enactment. Approved in 2018, the legislation represents a watershed moment in the consolidation of fundamental rights in the Brazilian digital environment, ensuring privacy, freedom, and the protection of citizens’ personal data.
Since its implementation, the LGPD has regulated the processing of personal data, including sensitive information such as racial origin, ideological convictions, and biometric data, determining how this data should be collected, stored, and used by companies, public agencies, and organizations.
According to the LGPD Panel Report in Courts, prepared by the Center for Law, Internet, and Society (Cedis-IDP) in partnership with Jusbrasil and with support from the United Nations Development Programme (UNDP Brazil), there has been a significant increase in the number of judicial decisions mentioning the LGPD. Between October 2023 and October 2024, 15,921 decisions citing the legislation were identified, representing a 112% growth compared to the same period the previous year, when 7,503 decisions were recorded.
The effective application of the sanctions provided by the law began in August 2021, after a transition period starting in 2020. Since then, the National Data Protection Authority (ANPD), responsible for overseeing compliance with the regulation, has acted strategically. The agency has already published technical guides, conducted public consultations, analyzed security incidents, and imposed penalties, including significant fines.
With the rapid advancement of technology and artificial intelligence, the challenges for data protection have become even more complex. Issues such as consent for the use of information in algorithm training, the explainability of automated decisions, and the application of the principles of data minimization and information security have become central to continuous compliance with the LGPD.
The concept of privacy by design gains prominence in this scenario, requiring organizations to adopt preventive data protection measures from the outset of product and service development.
For lawyer and law professor at Centro Universitário Itaperuna, Dr. Rayla Santos, the date reinforces the need to consolidate a strong culture of respect for privacy. ‘Each anniversary of the LGPD reminds us that it is not just a legal norm but the continuous construction of a culture of respect for privacy,’ she states. According to her, the law emerges as a response to social and technological transformations impacting how data is processed and shared. ‘The LGPD was inspired by international legislation, such as the EU’s GDPR, but adapted to the Brazilian reality, representing a significant advancement in the protection of individual rights.’
With the advancement of artificial intelligence, Dr. Rayla Santos assesses that the application of LGPD principles—such as informed consent, data minimization, and algorithmic transparency—is increasingly urgent. She emphasizes that companies and developers must adopt ethical practices in data usage to train automated systems, ensuring clarity about the processing of personal information. The expert also highlights the need for robust data governance, stressing that the legislation requires security measures and best practices from the conception of technologies, in line with the principles of privacy by design and privacy by default.
Another point emphasized by the expert from Afya Itaperuna is the role of educational and research institutions in training professionals prepared for digital privacy challenges. ‘It is not enough to apply the LGPD mechanically. It is necessary to understand its principles and spirit. Education on data protection must expand beyond Law, reaching areas such as information technology, engineering, and social sciences,’ she argues.
For the coming years, some trends gain relevance: the institutional strengthening of the ANPD, specific regulation on artificial intelligence in dialogue with the LGPD, the dissemination of data protection culture in academic and corporate environments, and the training of specialists equipped to handle the new scenarios of the information society.
