The General Law of Data Protection (LGPD) is already in force in Brazil, with the exception of sanctions that include millionaire fines and that only begin to take effect as of August 1.
Developing around the world – in Europe it is called the General Personal Data Protection Regulation (RGPD) and in California, the “Consumer Privacy Act (CCPA) – the new legislation is already having an effect in legal environment. The goals are to protect and to establish a system for monitoring the use of personal data, giving the holder back the power to make decisions about them.
LGPD is still new to the corporate sector, but it already demands at least three types of services: implementation to achieve compliance with the law; administrative and judicial defenses; and the need to hire a Manager for Personal Data Processing, called a Data Protection Officer (DPO) under the GDPR.
The Manager’s duties include receiving requests from holders, adopting the necessary measures; communicating with the National Authority for Personal Data Protection (ANPD); advising company employees and suppliers; and keeping the corporation in compliance with the LGPD on an ongoing basis.
In a recent Guideline, the ANPD defined the duties of the DPO, including, in particular, that he or she may be an individual or a legal entity, and created the requirement for the presence of a professional with this function in all companies. It is also important to point out that the position does not allow for the accumulation of functions and must have independence and autonomy to expose its guidelines and decision-making.
Research conducted in 2019 in Europe found that 500,000 companies there had already registered a DPO on their staff. It is expected that this market will also grow here in Brazil, however, there are still no surveys that point out how the national companies are facing this issue.
But it is a fact: with the ANPD’s Guideline, the obligation to have a Manager within the company became clear in order to avoid the sanctions provided by law. It is necessary to understand that the DPO is a great opportunity to improve the company’s communication with its customers, since they need to be available to answer the many questions that may arise. For this reason, it is clear that if the company has a Manager, it will differentiate itself from the competition, because as is already known, the LGPD requires all data processing participants to be adapted to the new legislation.