Creation of Brazil's National Data Protection Authority will impact the corporate world

The General Data Protection Law will come into effect in just over a year, and its adaptation in the corporate environment must be implemented with the urgency the topic requires The General Data Protection Law (LGPD) was enacted in August 2018 and is scheduled to come into effect in August 2020. This week, it gained a new and important chapter with the creation of the National Data Protection Authority (ANPD). The ANPD was approved by the Chamber of Deputies and the Federal Senate. Now, it awaits approval from the Presidency of the Republic. This government initiative requires significant changes for the corporate world, as it is no longer an option but a commitment to adapt and care for people's information. Guidelines for a National Policy on Personal Data Protection and Privacy are still being developed and include oversight and enforcement of sanctions. The ANPD is essential for compliance with the law and will add even more value to the LGPD's credibility, ensuring the rules are followed, in addition to fostering a culture and education around data privacy. The National Authority can substantially contribute to communication, updating, dissemination, and educational processes regarding the regulations, and consequently, to ensuring compliance with the law. And those who fail to adapt will be left out of the global market. Certainly, the impact on the market is quite broad. It will be necessary to implement another model of operation and information handling, and we will undergo a digital re-education. Our data is available and exposed in a vast environment (physical or virtual) where we leave traces, whether through simple searches, information retrieval, or spontaneous queries we make, revealing important identification references. Privacy risks are real, and therefore, there are requirements and specifications on some crucial points that must now be taken into account with strong information security. This requires a high level of effort and attention from all of us—individuals, companies, and institutions from various areas—to take effective actions for proper data protection. That is the goal of the LGPD, which has been moving the entire Brazilian market.

Frequently asked questions

What is the ANPD and what is it for?

The National Data Protection Authority (ANPD) is the Brazilian body created to oversee compliance with the General Data Protection Law and to apply sanctions. It was approved by the Chamber of Deputies and the Federal Senate, and its role also covers communicating, updating and spreading the rules so companies know what is expected of them.

When was the LGPD enacted and when was it due to take effect?

The General Data Protection Law (LGPD) was enacted in August 2018, with entry into force scheduled for August 2020. The creation of the ANPD added a new chapter to that timeline, because oversight and sanctions depend on a constituted authority.

What does this change for companies in practice?

Adapting stopped being an option: the company needs another model for operating and handling information, with strong information security over the traces people leave in physical and virtual environments. Other markets keep equivalent rules, such as the European GDPR, and an organisation that does not adapt is left out of the global market.