The General Personal Data Protection Law (LGPD) is seven years old in Brazil, at a time when data protection is already impacting various sectors of the economy, transforming the way personal data is processed. At the same time, the milestone ushered in a new era of governance, security, and transparency in the processing of personal information..
“More than a regulatory instrument, the LGPD has consolidated a new level of privacy protection in Brazil, directly influencing corporate strategies and society’s awareness of the use of personal data,” says Carla do Couto Hellu Battilana, partner in the Cybersecurity & Data Privacy practice at TozziniFreire Advogados..
Since the LGPD was published, there have been several changes in the way data protection is viewed in Brazil. Among the most significant milestones in the last seven years is Constitutional Amendment No. 115/2022, which recognized the protection of personal data as a fundamental right, alongside guarantees such as freedom of expression and human dignity. “This recognition brought greater legal certainty to citizens and companies, in addition to protecting the legislation against setbacks,” explains Battilana..
Another step forward was the more mature application of legitimate interest as a legal basis for data processing, which now includes additional clarifications in the Guide published by the National Data Protection Authority (ANPD). “By establishing clearer parameters, the ANPD has helped balance the needs of companies with the preservation of data subjects’ rights,” said Battilana..
The regulation of international data transfers marked another important step. Resolution CD/ANPD No. 19/2024 established specific rules for standard contractual clauses and technical security measures. “Today, companies rely on a series of rules to ensure that data remains protected, regardless of the destination country,” emphasizes Battilana..
According to Battilana, the ANPD’s oversight and enforcement of sanctions have become more frequent and structured, especially after Resolution CD/ANPD No. 4/2023, which defined criteria for imposing penalties. “The authority’s more active presence is increasing the maturity of organizations and the effectiveness of the law.”
The publication of CD/ANPD Ruling No. 1/2023 relaxed the requirement for consent as a legal basis for processing data on children and adolescents, provided the principle of the child’s best interests is respected. “The change does not reduce protection, but offers legitimate alternatives in cases where consent is not the most appropriate approach,” says Battilana..
In the field of technology, the ANPD has gained prominence in discussions on artificial intelligence, by launching a sandbox regulatory framework and actively participate in the debates on Bill No. 2,338/2023, which could make her the national coordinator of AI governance. “The intersection between AI and data protection is inevitable and requires increased attention so that innovation can go hand in hand with security and privacy,” Battilana says..
With advances in data protection, awareness of cyber risks and the importance of incident reporting, a key measure for mitigating damage, are growing in Brazil. Resolution CD/ANPD No. 1/2024 also helped by establishing clear protocols for companies to report incidents to authorities and data subjects..
“Looking to the future of the LGPD means keeping up with trends such as the advancement of artificial intelligence, the integration of international data protection standards, and the sophistication of cyber threats. This is a constantly evolving scenario that requires updating and commitment from all stakeholders,” emphasizes Battilana.
