This Thursday (14), the General Data Protection Law (LGPD) completes seven years since its enactment. Approved in 2018, the legislation represents a watershed in the consolidation of fundamental rights in the Brazilian digital environment, ensuring privacy, freedom, and the protection of citizens’ personal data.
Since it came into force, the LGPD has regulated the processing of personal data, including sensitive information such as racial origin, ideological beliefs and biometric data, determining how this data should be collected, stored and used by companies, public bodies and organizations..
According to the LGPD Panel Report in the Courts, prepared by the Center for Law, Internet and Society (Cedis-IDP) in partnership with Jusbrasil and with support from the United Nations Development Programme (UNDP Brazil), there was a significant increase in the number of court decisions mentioning the LGPD. Between October 2023 and October 2024, 15,921 decisions citing the legislation were identified, representing a 112% increase compared to the same period the previous year, when 7,503 decisions were recorded..
The effective implementation of the sanctions provided for in the law began in August 2021, following a transition period that began in 2020. Since then, the National Data Protection Authority (ANPD), responsible for monitoring compliance with the law, has acted strategically. The agency has published technical guides, conducted public consultations, analyzed security incidents, and imposed penalties, including significant fines.
With the rapid advancement of technology and artificial intelligence, data protection challenges have become even more complex. Issues such as consent for the use of information in algorithm training, the explainability of automated decisions, and the application of information minimization and security principles have become central to ongoing compliance with the LGPD.
The concept of privacy by design , or privacy by design, gains prominence in this scenario, requiring organizations to adopt preventive data protection measures from the beginning of the development of products and services.
For Dr. Rayla Santos, lawyer and law professor at Itaperuna University Center, the date reinforces the need to consolidate a solid culture of respect for privacy. “With each anniversary of the LGPD, we are reminded that it’s not just a legal norm, but the ongoing construction of a culture of respect for privacy,” she states. According to her, the law emerges as a response to social and technological transformations that impact how data is processed and shared. “The LGPD was inspired by international legislation, such as the European Union’s GDPR, but adapted to the Brazilian reality, representing a significant advance in the protection of individual rights.”
With the advancement of artificial intelligence, Dr. Rayla Santos believes that applying LGPD principles such as informed consent, data minimization, and algorithmic transparency is increasingly urgent. She emphasizes that companies and developers must adopt ethical practices when using data to train automated systems, ensuring clarity regarding the processing of personal information. The expert also highlights the need for solid data governance, emphasizing that the legislation requires security measures and best practices from the very design stage of technologies, in accordance with the principles of privacy by design and privacy by default.
Another point emphasized by the Afya Itaperuna specialist is the role of educational and research institutions in training professionals prepared for the challenges of digital privacy. “It’s not enough to mechanically apply the LGPD. It’s necessary to understand its principles and spirit. Data protection education must expand beyond law, encompassing areas such as information technology, engineering, and social sciences,” she argues.
For the coming years, some trends are gaining relevance: the institutional strengthening of the ANPD, specific regulations on artificial intelligence in conjunction with the LGPD, the dissemination of a data protection culture in academic and corporate environments, and the training of specialists capable of dealing with the new scenarios of the information society.
