LGPD

General Personal Data Protection Law (LGPD)

Enacted on August 14, 2018, Brazil's General Personal Data Protection Law, also known as the LGPD, is a major regulatory milestone that establishes rules and limits for the collection, storage, processing and sharing of personal data. Its main goal is to balance data processing activities with the rights of data subjects, with the transparency of operations as its greatest hallmark.

Key concepts

Personal data

Information that identifies or makes it possible to identify a natural person.

Sensitive personal data

A category of data with greater protection: racial or ethnic origin, religious belief, membership in a union or a religious, philosophical or political organization, genetic or biometric data.

Anonymized data

Information that does not identify (directly or indirectly) the data subject, considering the reasonable technical means available at the time of processing.

Who are the main parties under the LGPD

Data subject — The natural person to whom the personal data refers.

Controller — The natural or legal person responsible for decisions regarding the processing of personal data.

Processor — The natural or legal person that processes personal data on behalf of the controller.

Data Protection Officer (DPO) — The party responsible for ensuring the controller or processor complies with the LGPD, as well as mediating communication between the controller, the data subjects and the ANPD.

ANPD — The National Data Protection Authority (Autoridade Nacional de Proteção de Dados Pessoais), the body responsible for ensuring, overseeing and regulating compliance with the law.

Data subjects' rights

Confirmation that their personal data is being processed.
Access to, and updating and correction of, outdated, incomplete or incorrect data.
Information about who the data has been shared with.
Anonymization, blocking or deletion of unnecessary data.
Freedom to consent and information about the right not to consent and its consequences.
Withdrawal of consent and deletion of data.
Data portability (safeguarding commercial or industrial secrets).
Review of automated decisions.

Legal bases for processing

Credit protection · Legitimate interest · Consent · Execution of public policies · Compliance with a legal or regulatory obligation of the controller · Studies by research bodies · Regular exercise of rights · Judicial, administrative or arbitration proceedings · Protection of life · Protection of health.

Data processing principles under the LGPD

Adequacy: data processing must be carried out in line with the purposes disclosed to the data subject.
Purpose: processing must pursue legitimate, explicit and specific purposes that are disclosed to the data subject.
Necessity: processing must use only the data essential to achieve the intended purpose.
Transparency: the data subject has the right to clear and easily accessible information about the processing.
Security: security measures to protect data from unauthorized access.
Free access: easy access to data, including on the form and duration of processing.
Non-discrimination: processing may not be carried out for discriminatory, unlawful or abusive purposes.
Prevention: measures to prevent harm arising from the processing of personal data.
Data quality: ensuring personal data is kept up to date and accurate.
Accountability: effective measures to demonstrate compliance with the law.

Frequently asked questions

Who does the law apply to?

The LGPD applies to any natural or legal person, under public or private law, that processes personal data, such as collecting, storing and sharing data with third parties.

With this law, what changes for data subjects?

In practice, data subjects have their rights expanded by the LGPD, allowing them to monitor and track all processing of their personal data, increasing transparency in operations.

Can I remove my data from ds.marketing's database?

At any time, and after having your identity validated, the data subject may view, edit and request the deletion of their information from our database under the terms of the law. To do so, simply get in touch through one of our service channels.

If I remove my data from ds.marketing, does it leave every database in Brazil?

No, ds.marketing is just one of the companies operating in the sector. You must reach out to every other company where you have an active registration and request the removal of your data.

Why can ds.marketing process my data if I did not give consent?

The data subject's consent is one of the ten legal bases that legitimize the processing of personal data. There are nine other legal bases that can be used as legal support to justify processing, depending on the purpose and use of the data, such as credit protection or legitimate interest. In these cases, processing may be carried out legally without the need for the data subject's express authorization, while all other rights remain intact.

Where can I exercise my rights?

ds.marketing is committed to the protection and transparency of personal data processing. That's why we provide a service channel ready to answer all your questions.