How To Make Your website LGPD Compliant in less than 1 week

The LGPD or Lei Geral de Protecao de Dados is a long-awaited Data Protection Law in Brazil. After years of debate and consultation, it was finally adopted on August 14, 2018. It was inspired by, and is very similar to the EU General Data Protection Regulation (GDPR).

On September 17th, 2020 Brazil's data protection law went into effect and requires companies to comply with strict requirements related to the processing of personal data as well as sensitive personal data.

While it's much leaner than the GDPR and consists of approximately 30 pages compared to GDPR's 80+ pages almanac, the Brazilian law is very reminiscent of the European Union's data privacy law.

The LGPD focuses on national specifics, illustrated by the fact that the legal bases of this data protection law are being based on accountability, purpose limitation, data minimization as well as security and privacy by design. When you are comparing this data protection regulation to GDPR it definitely feels familiar.

The LGPD is a new standard that adds the new principles similar to GDPR requirements and will see its enforcement begin into August 2021, echoing the approximate timeframe of the GDPR's implementation period.

It will be useful to know the details of new personal data protection laws if your company is operating or planning to open a branch in Brazil.

The LGPD applies to any private or public individual or company with personal data processing activities that:

• are carried out in Brazil;
• personal data is collected in Brazil;
• involve offering and supplying goods or services in Brazil or relate to data subjects who are geographically located in Brazil;

The LGPD has an extraterritorial scope and will apply to global businesses that meet these criteria. At the same time, it doesn't matter where these companies are headquartered. But LGPD is a different standard that doesn't apply to data processing by:

• A person, who is processing data for personal purposes;
• For journalistic, artistic, literary, or academic purposes;
• For national security, national defense, public safety, a criminal investigation, etc.;

The new law affects companies in all sectors that do business or engage in data processing activity in or with Brazil. Financial, technology, healthcare, insurance, airline, and hotel companies are among those that will likely face substantial compliance obligations for lawful processing of customer data.

The LGPD is not as punitive as the GDPR, both in in sentiment and financial penalties. The LGPD establishes two types of monetary fines:
1. simple fines

2. daily fines.

both fines have the same limit of BRL 50,000,000 (approx. €11,582,750).

A daily fine is normally used to enforce a previous decision.

On the other hand, depending on the violation, a simple fine of up to 2% of a private legal person's, group, or organization's revenues in
Brazil for the previous financial year, excluding taxes may be issued with the total maximum fine capped at BRL 50,000,000 per infraction.

This Brazilian law defines personal data as any information related to an identified or identifiable natural person. Anonymized/anonymous data should not be considered personal data, except when the process of anonymization has been reversed or if it can be reversed by applying reasonable efforts.

The principles of processing personal data under the LGPD are;

Purpose Limitation
Brazil’s new data privacy law requires you to collect consumer information only for legal, specific, and clear purposes. You must make sure that users are aware of why you are collecting their data before obtaining their consent.
Necessity
This principle requires you to limit the personal information you process to the minimum necessary to achieve the purposes you stated.
Free Access
To be considered LGPD-compliant, you need to ensure your data subjects can get free and easy consultation regarding the type and duration of the data processing, in addition to the accuracy of their information.
Suitability
LGPD compliance also requires you to guarantee that the processing is consistent with the defined purposes.
Accountability
According to this principle, your business needs to demonstrate that you have put effective measures in place to ensure the protection of the personal information belonging to Brazilian residents.

On the other hand, the legal bases for processing personal data under the LGPD are;

- Consent of the data subject
- Fulfilling legal, regulatory or contractual requirements
- For conducting research studies. In this case, anonymization of the data is encouraged whenever possible
-To meet the legitimate interests of the controller or a third-party. The only exception is when the data subject’s fundamental rights and freedoms that need the protection of their personal data prevail
-To safeguard the life or physical wellbeing of the user or a third-party
-By public administration, for the processing and shared use of personal information that is vital for the implementation of public policies guaranteed in the law or dependent on contracts and other related instruments
-For the regular exercise of rights in judicial, administrative, or arbitration processes.
-To safeguard the health of a data subject in a procedure conducted by health professionals or by health bodiesIn cases where the data is vital for the performance of a contract or the preliminary processes connected to a contract of which the consumer is a party and at his/her request

-To safeguard credit history of user

The Lei Geral de Protecao de Dados (LGPD) is based on the risk-based approach, which is similar to what is required for businesses to be GDPR compliant. Companies/organizations processing personal data are encouraged to implement protective measures corresponding to the level of risk of their data processing activities. Therefore, the LGPD cookie consent obligations on a company processing a lot of data are more onerous than on a company processing a small amount of data.

The LGPD focuses on national specifics, the principles of data protection law are being based on accountability, purpose limitation, data minimization as well as security and privacy by design. When you are comparing this document to GDPR it definitely feels familiar.

The LGPD applies to any private or public individual or company with personal data processing activities that:

• are carried out in Brazil;
• personal data is collected in Brazil;
• involve offering and supplying goods or services in Brazil or relate to individuals who are geographically located in Brazil

Many websites use tracking technologies, including cookies, pixels, and tags, to advertise, collect statistics and perform marketing campaigns. Under the LGPD, you are responsible for providing notice and obtaining cookie consent for each one of these technologies. LGPD cookie consent must be provided by the data subject in writing or by other means that demonstrate the data holder’s will. The controller is responsible for providing that the cookie consent was obtained in accordance with the requirements of the LGPD. Consent must be specific to particular purposes.

Make sure to do a web audit of your website and see what trackers you have enabled and running. If you are unsure what trackers you have on your website, then use our tool for free. It is free and will provide you a result within 5 minutes or less.

In order to obtain valid LGPD cookie consent, you need to follow specific requirements. The consent must be informed, explicit, freely given, specific and data subjects have the right to withdraw and written in plain language that it’s clearly visible.

Your privacy banners must clearly identify each party for which the cookie consent is being granted. It isn’t enough to state the category name, such as analytics, but should include the identity of the organization, e.g. Google, which processes the data.

The standard text phrase that is included in Cookie notices is “by using this site, you accept cookies” will not be sufficient under LGPD compliance requirements, as it only suggests implied consent, is ambiguous and generic. You will now need granular levels of control with separate consents for tracking and analytics cookies, as well as mechanisms to also signal customer consent.

To learn how our cookie blocking works, please see this guide.

Yes, we offer LGPD readiness tests, website audits, training and more. Please schedule a call here.

Yes, we offer full support for a wide range of privacy laws including CCPA and LGPD.

Yes, we offer volume discounts. Please schedule a call here.

Yes, you can. We offer a FREE trial. You can cancel anytime.

You sure can. Go to your administration panel at any time, and you will find cancel in the account section.