LGPD · · Davi Netto
3 business activities affected by the LGPD
How Brazil's data protection law (LGPD) affects the collection, processing and use of personal data in your company, and what you should do about it.
Ensuring the privacy of personal information is a requirement of Brazil’s General Data Protection Law (LGPD) and of Europe’s GDPR. On top of that, privacy is a fundamental human right, according to the UN’s Universal Declaration of Human Rights:
“No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.” Article 12 of the Universal Declaration of Human Rights (UDHR).
Here in Brazil, the law that governs privacy and the processing of personal data is the General Data Protection Law (Law No. 13,709), in force since August 2020. A number of activities carried out by Brazilian companies will need extra attention. Here’s a list of the most important ones:
Collecting personal data in Brazil
Any collection of personal data in Brazil needs the free and express consent of the person the data belongs to, such as full name, address, email, date of birth, CPF (taxpayer number) and others. In addition, the law gives citizens the right to ask for the personal data collected to be changed or deleted, and to withdraw any consent given before.
Processing data in Brazil
All personal data may only be used for the purpose it was collected for; personal information can’t be reused, replicated or processed for other purposes. In other words: a company can’t send ads and promotions using a database of personal information provided when buying a product.
Offering goods and services to individuals in Brazil
Communications, sales, marketing and call center companies can’t buy databases or offer goods and services to individuals in Brazil without a record of those individuals’ free and express consent that their data may be used for advertising. In addition, individuals can withdraw consent previously given at any time.
Note that we’re talking about individuals in Brazil, so the law applies to people of any nationality within Brazilian territory.
What data isn’t covered by the LGPD?
The LGPD mostly applies to personal information used for commercial purposes in Brazil, so it doesn’t cover:
- Data passing through Brazil that comes from and is bound for other countries
- Information for personal use
- Non-commercial purposes
- Artistic purposes
- Journalistic purposes
- Academic purposes
- Public security
