Sanctioned by President Jair Bolsonaro, the General Data Protection Law (LGPD) came into force on September 18th. The Law establishes several rules on how companies and public bodies should handle the processing of personal data, such as the need for authorization of the holder allowing the use of the information. Authorization is not required in cases such as public policies, but at any time holders may request to access their data.
The processing of data must also respect principles such as the purpose, i.e., holders must be informed about the reason why their information is being collected. The LGPD also requires that information controllers offer data portability to other services and report as soon as possible on any data leaks.
