LGPD
General Data Protection Law (Law 13.709/2018)
LGPD is the law about Privacy and Security of
Data currently in effect in Brazilian territory.
Based on the European GDPR, the LGPD regulates and establishes certain parameters regarding the privacy and security of personal data collected and processed within the national territory. The LGPD lists a series of factors that must be implemented by all companies, regardless of their size, state, or tax contribution.
For companies that do not comply with the LGPD (Brazilian General Data Protection Law), the penalties range from administrative sanctions, which can include blocking the database containing personal data, interrupting data processing and consequently causing the company to temporarily shut down, to daily fines that can total up to R$ 50,000,000.00 or 2% of the annual gross revenue of the company caught in violation.
"For compliance, companies must follow minimum information security standards related to personal data, and for this, BRAPIS uses the standards established by ABNT/ISO 27001/27701."
With a team that includes an EXIN-certified DPO and leading certification in implementing the ISO/ABNT 27701 standard, BRAPIS mirrors the processes and models specified in ABNT/ISO 27701, which deals with the implementation of a privacy and information security management system.
This model is executed in 3 (three) stages:
Planning/
Diagnosis
The first stage involves a diagnostic roadmap, where the entire lifecycle of personal data processed by the organization is identified and mapped, along with training for key users, analysis and assessment of risks and vulnerabilities regarding the leakage of personal data in the organizational and technological environment. Finally, an action plan is developed based on the identified risks.
Execution
of the project
In the execution phase, the actions identified in the analyses are put into practice with the aim of implementing procedural and technological techniques to meet the rights of data subjects, the requirements of the ANPD (National Data Protection Authority), and mitigate the risks identified in the first phase of the project.
Monitoring
constant
The third stage, monitoring, is based on the PDCA model found in most ISO standards, which consists of monitoring the entire organizational and technological environment, applying continuous improvement to the processes of handling personal data.
Protect yourself against multimillion-dollar fines.
Adapt your company today!