Skip to content
Raszio
EN

Security · · Davi Netto

Which information security laws must your business follow?

Three steps, drawn from ISO 27001, to identify the data protection and information security laws that apply to your business, including foreign ones.

The first step to ensure your company complies with data protection and information security laws is to identify the legislation that applies to its business and operations. Applicable legislation covers not only the company’s relationship with its customers, but the whole structure of its business, which may include suppliers, partners, physical and organizational structure, information systems and internal processes.

From ISO 27001, we can derive a few steps to effectively identify the laws that cover your company’s operations.

1. Assign responsibilities to individuals

Responsibilities should never be assigned to a group. Divide your company into segments and identify key people to find the information security laws and standards for each area of the business.

These responsibilities are often wrongly assigned to the IT team, but IT rarely has the skills needed to identify and interpret the legal texts that govern the business’s operations. Identifying legislation is multidisciplinary work that involves the company’s legal team, and in many cases, when those skills aren’t available in-house, it can be delegated to law firms or technology companies specialized in information security.

2. Find solutions that apply to your line of business

Regulations vary according to each company’s field and operations. The legislation for hospitals, e-commerce and construction is completely different, and there may even be variations and details within each of these fields.

For example, selling alcoholic beverages or medicines online comes with some restrictions, and those working in that market need to take extra precautions.

The same goes for hospitals and clinics that deal directly with databases containing information the LGPD considers sensitive, such as their patients’ medical records and health conditions.

3. Watch out for regional and international laws

We all know how complex and varied Brazil’s laws are. Laws apply differently from state to state and sometimes even from city to city, and that’s nothing new.

However, with recent advances in data protection and information security regulations, we also need to pay attention to international regulations on the subject.

“But my company is in Brazil, so I don’t need to worry about foreign laws”

Yes, you do, my dear business owner. Picture the following example:

An Argentine tourist, while traveling in France, buys medicines online from a Canadian company and asks for the goods to be delivered to the Paris hotel where he’s staying.

The Canadian company is subject to the GDPR (General Data Protection Regulation), since its operations may extend into the territory of the countries of the European Economic Area, and the Argentine citizen has a series of rights to the protection of his personal data under the GDPR.

Below are some examples of national and international regulations that may affect your business:

Keep reading

Still have a question?

Ask a technician directly. No bots and no ticket queue.

Chat on WhatsAppsuporte@raszio.com