It’s Now Official: Brazil’s LGPD Goes into Effect

Brazil’s General Data Protection Law (“Lei Geral de Proteção de Dados” or “LGPD”) will take effect on September 18, 2020.  President Bolsonaro signed a bill that establishes the beginning of the new law.  At the end of August, the Chamber of Deputies sought to postpone the effective date until December 31, 2020 but the measure was subsequently rejected by the Brazilian Senate.

The LGPD creates a new legal framework for the use of personal data in Brazil, replacing and/or supplementing a sectoral regulatory framework. The law, largely modeled on the European Union’s GDPR, deals with the concept of personal data, lists the legal bases that authorize its use, and provides various rights to data subjects such as access to data, rectification, cancellation or exclusion, opposition to treatment, right to information and explanation about the use of data.

Even though the LGPD is now in effect, it would not be subject to administrative enforcement until August of 2021.  The main obstacle there is that the National Data Protection Authority, which is tasked with enforcing the law, was just created on August 27, 2020.  While the administrative sanctions might be delayed, other enforcement mechanisms, such as the LGPD’s private right of action, come into force at the effective date.

Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653