Technology and LGPD (Brazilian Data Protection Law)
Personal data governance and technology contracts aligned with the operation's responsibilities.
Compliance with the LGPD starts with understanding the data processed, the purposes and the agents involved. The controller is the one who makes the decisions relevant to the processing; the processor acts on behalf of the controller. The classification depends on the reality of the activity and may vary between operations, and is not settled merely by the title assigned in the contract. Consent is one of the possible legal bases, and its use must be assessed according to the purpose and the other grounds provided by law.
The advisory work covers technology contracts, privacy policies, procedures for data subjects' rights and analysis of data sharing and international transfers. Security and incident response must be integrated into governance, with defined responsibilities and records. The data protection officer performs a function of its own and does not replace the processing agents. The legal work also considers retention, deletion and the use of data in new products, seeking consistency between the documents presented to data subjects and the processes actually carried out by the organization.
Our work
- Legal mapping of purposes and legal bases
- Contracts between agents and technology providers
- Data subjects' rights and incident governance
Can a contract designate as processor the party that decides on the use of the data?
The contractual label does not automatically prevail over the facts. Each agent's role must be assessed based on the decisions and activities actually carried out in the processing.
Editorial review: