When Does Brazil’s General Personal Data Protection Law Come into Effect?

Brazil’s General Personal Data Protection Law (“Lei Geral de Proteção de Dados” or “LGPD”) creates a new legal framework for the use of personal data in Brazil, replacing and/or supplementing a sectoral regulatory framework.  The law, largely modeled on the European Union’s GDPR, deals with the concept of personal data, lists the legal bases that authorize its use, and provides various rights to data subjects such as access to data, rectification, cancellation or exclusion, opposition to treatment, right to information and explanation about the use of data.

The law was originally scheduled to go into effect on August 15, 2020.  On April 4, 2020, the Brazilian Senate passed an emergency bill addressing various pandemic-related legal issues which, among other measures, would have postponed the entry of the LGPD to January 1, 2021, and the enforcement until August 1, 2021.  However, the Final Bill sent by the Brazilian Congress to President Bolsonaro kept the original effective date and only delayed the administrative sanctions until August 1, 2021.

Separately, in April of 2020, President Bolsonaro issued a Provisional Measure (PM) 959/2020 which postponed the effective date of the LGPD until May 3, 2021.  The Provisional Measure is currently the law in Brazil but for it to stay in effect, the Congress needs to approve it by August 26, 2020.

At this point, there are several scenarios which might result in a different effective date of the LGPD:

• If the Congress approves the Provisional Measure, the effective date of the LGPD would be May 3, 2021.

• If the Congress fails to approve the Provisional Measure, the effective date of the LGPD would be August 15, 2020.

• If the President approves the Final Bill, the effective date of the LGPD would be August 15, 2020.

• If the President vetoes the Final Bill, the Provisional Measure will remain in effect until August 26 unless approved by Congress. In that case, the effective date of the LGPD would also (effectively) be August 15, 2020.

In either case, it appears that the enforcement date of the LGPD would be pushed back to August of 2021 regardless of the effective date of the law.  While the administrative sanctions might be delayed, other enforcement mechanisms, such as the LGPD’s private right of action, will come into force at the effective date.

Sources:

https://www.lexology.com/library/detail.aspx?g=95613fab-866b-4d24-a1f3-58c39a1ab66c

https://www.engage.hoganlovells.com/knowledgeservices/news/brazil-update-congress-sends-bill-delaying-lgpd-sanctions-but-not-effective-date-to-president

Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653