Brazil LGPD Compliance

Start with a processing record that identifies purposes, people, data categories, collection points, systems, controller and operators, recipients, countries, retention, security, and the Article 7 or 11 legal basis. Article 37 requires controllers and operators to maintain processing records, especially for legitimate-interest processing.

Group remediation by dependency: scope and roles; principles, purpose, and basis; notices and rights; retention and vendors; security and incidents; transfers; then governance testing. A later control cannot repair an invalid purpose or missing legal basis.

Assign each control to the team that can change the processing. Product owns purpose and collection design; data and engineering own system implementation and retention; procurement and business owners manage operators; security manages preventive and incident controls; privacy or legal reviews the legal route; the controller approves residual risk.

Use dated evidence such as a scope memo, role map, processing record, live notice, consent record, legitimate-interest test, rights log, operator instructions, deletion result, access review, security test, transfer record, or incident exercise. A Relatório de Impacto à Proteção de Dados Pessoais (RIPD) should describe the processing, risks, safeguards, and mitigation when the ANPD requires one; organisations may also use it as a governance tool for high-risk processing.

Small-agent status does not erase the LGPD. Resolution 2/2022 offers specified simplified records, an encarregado dispensation, and differentiated periods only to eligible agents; high-risk processing and revenue or group thresholds can prevent access to that treatment.

Children and adolescents require a concrete best-interest assessment. Sensitive data requires an Article 11 basis; Article 7 legitimate interest is unavailable. International transfers require both a processing basis and a transfer mechanism. Reassess after changes to purpose, data, role, system, vendor, market, people, transfer, complaint, or incident.

Test the program against a sample of live processing activities. Confirm that the notice matches the system, rights requests reach every relevant system and recipient, retention jobs run, operator instructions are followed, access controls are reviewed, incident clocks can start, and transfer mechanisms match the actual importer and onward transfers.

Keep an owned remediation register with the source provision, affected activity, gap, action, interim measure, evidence, reviewer, due date, exception, and reassessment trigger. Escalate repeated or high-impact failures for controller decision and, where appropriate, a RIPD or other risk review.

Use the statutory and regulatory clocks as test cases. For example, a complete confirmation or access declaration must be supportable within Article 19's 15-day period, a reportable incident must reach the ANPD and affected people within the applicable Resolution 15 period, and a standard-clause transfer must support the 15-day clause-access request in Resolution 19.