How To Make Your website LGPD Compliant in less than 1 week

The LGPD or Lei Geral de Protecao de Dados is a long-awaited Data Protection Law in Brazil. After years of debate and consultation, it was finally implemented on August 14, 2018, and was inspired by and very similar to the EU General Data Protection Regulation (GDPR).

Beginning in August 2020 Brazil's data protection law will go into effect and require companies to comply with strict requirements related to the processing of personal data as well as sensitive personal data.

While it's much leaner than the GDPR and consists of approximately 30 pages compared to GDPR's 80+ pages almanac, the Brazilian law is very reminiscent of the European Union's data privacy law.

The LGPD focuses on national specifics, illustrated by the fact that the legal bases of this data protection law are being based on accountability, purpose limitation, data minimization as well as security and privacy by design. When you are comparing this data protection regulation to GDPR it definitely feels familiar.

The LGPD is a new standard that adds the new principles similar to GDPR requirements and will come into effect in May 2021, echoing the approximate timeframe of the GDPR's implementation period.

It will be useful to know the details of new personal data protection laws if your company is operating or planning to open a branch in Brazil.

The LGPD applies to any private or public individual or company with personal data processing activities that:

• are carried out in Brazil;
• personal data is collected in Brazil;
• involve offering and supplying goods or services in Brazil or relate to data subjects who are geographically located in Brazil;

The LGPD has an extraterritorial scope and will apply to global businesses that meet these criteria. At the same time, it doesn't matter where these companies are headquartered. But LGPD is a different standard that doesn't apply to data processing by:

• A person, who is processing data for personal purposes;
• For journalistic, artistic, literary, or academic purposes;
• For national security, national defense, public safety, a criminal investigation, etc.;

The new law affects companies in all sectors that do business or engage in data processing activity in or with Brazil. Financial, technology, healthcare, insurance, airline, and hotel companies are among those that will likely face substantial compliance obligations for lawful processing of customer data.

LGPD fines are not as punitive as the GDPR, both in sentiment and financial penalties. The maximum administrative sanctions under the LGPD is 2% of the company's Brazilian revenue of up to R$50 million (EUR 11.2 million) per infraction.

This is compared to 4% of global revenue or up to EUR 20 million under GDPR compliance.

This Brazilian law defines personal data as any information related to an identified or identifiable natural person. Anonymized/anonymous data should not be considered personal data, except when the process of anonymization has been reversed or if it can be reversed by applying reasonable efforts.

The LGPD sets out a set of general principles and legal bases of the processing of personal data, similar to GDPR requirements.

A key legal principle is purpose limitation, which means that processing must be “for legitimate, specific and explicit purposes of which the data subject is informed.” The principle of necessity likewise requires “limitation of the processing to the minimum necessary to achieve its purposes.” Other key principles include free access, transparency to the data subject, data quality. The “accountability” principle requires demonstrating the adoption of effective measures to ensure the protection of personal data. All principles are included in Article 6.

While the LGPD focuses mostly on data privacy, the ten principles also require serious data security options: companies must adopt technical meaures such as encryption as well as administrative strategies to guarantee the physical safety of personal data from unauthorized access or illegal destruction.

For companies, the key legal bases for data processing include:

• Consent, which includes all particular purposes of the processing;
• Fulfillment of legal, regulatory or contractual obligations;
• For “the legitimate interests of the controller or a third party,” where those interests outweigh, on balance, the data subject’s rights and liberties;

The LGPD applies to any private or public individual or company with personal data processing activities that:

• are carried out in Brazil;
• personal data is collected in Brazil;
• involve offering and supplying goods or services in Brazil or relate to individuals who are geographically located in Brazil

Many websites use tracking technologies, including cookies, pixels, and tags, to advertise, collect statistics and perform marketing campaigns. Under the LGPD, you are responsible for providing notice and obtaining cookie consent for each one of these technologies. LGPD cookie consent must be provided by the data subject in writing or by other means that demonstrate the data holder’s will. The controller is responsible for providing that the cookie consent was obtained in accordance with the requirements of the LGPD. Consent must be specific to particular purposes.

Make sure to do a web audit of your website and see what trackers you have enabled and running. If you are unsure what trackers you have on your website, then use our tool for free. It is free and will provide you a result within 5 minutes or less.

In order to obtain valid LGPD cookie consent, you need to follow specific requirements. The consent must be informed, explicit, freely given, specific and data subjects have the right to withdraw and written in plain language that it’s clearly visible.

Your privacy banners must clearly identify each party for which the cookie consent is being granted. It isn’t enough to state the category name, such as analytics, but should include the identity of the organization, e.g. Google, which processes the data.

The standard text phrase that is included in Cookie notices is “by using this site, you accept cookies” will not be sufficient under LGPD compliance requirements, as it only suggests implied consent, is ambiguous and generic. You will now need granular levels of control with separate consents for tracking and analytics cookies, as well as mechanisms to also signal customer consent.

Secure Privacy offers an automated and integrated solution to your website:

1. 'Do not sell' for websites: Opt-out from advertisement and other tracking plugins using our web widget
2. 'Do not sell' for other systems: A CCPA form from which users can select what data they wish to opt-out from. This can be data in e.g. your SalesForce system.

Yes, we CCPA readiness tests, webite audits, training and more. Please write us at hello at secureprivacy.ai about your inquiries.

Yes, we offer full support for GDPR among other data privacy laws.

Yes, we offer volume discounts. Please contact us at hello at secureprivacy.ai

Yes, you can. We offer a FREE trial. You can cancel anytime. See our pricing here.

You sure can. Go to your administration panel at any time, and you will find cancel in the account section.