The importance of being compliant with the LGPD

We discussed the importance of LGPD compliance with Paulo Salvador Ribeiro Perrotti, Lawyer, LGPDSolution Consultant, and Professor of Postgraduate Cybersecurity at Sorocaba Engineering College (FACENS), and Aline Figueiredo, Lawyer and LGPDSolution Consultant—a topic that, beyond its inherent relevance, resonates strongly due to the forced digitalization brought about by the pandemic. In this article, we explain what the LGPD is and how to stay compliant, and you will also discover how Level Group earned its compliance seal through LGPDSolution. Check it out!

After all, what is the LGPD?

Currently, there is an ever-increasing collection of insights regarding consumption habits, information access, and data availability. Consequently, personal data has become the raw material for business management—both in sales and human resources—where all strategic decisions increasingly rely on user information to be formulated.

The LGPD mandates that, prior to any user data collection, companies must obtain the data subject's freely given, explicit consent for a specific purpose. In other words, before collecting any information from a customer or employee, the company is advised to disclose the purpose of such collection and emphasize that the gathered data is required for that particular end.

With the LGPD taking effect, companies will need complete control over the data stored in their databases to prove regulatory compliance. They must keep detailed records of data processing operations, including collection, use, storage, and sharing. This information will form part of the Data Protection Impact Assessment (DPIA), which is mandatory under the LGPD and may be requested by the National Data Protection Authority (ANPD) to inspect any vulnerabilities in data processing activities.

The Brazilian General Data Protection Law (LGPD No. 13,709/2018), which took effect on September 18, 2020, brought significant impacts to all companies, requiring a complete overhaul of practices involving the collection, processing, and storage of data subjects' personal information to ensure greater security and transparency in relationships among companies, customers, employees, and users.

For businesses, data collection and processing must become more transparent and clear for users, enabling them to have greater control over their data usage and privacy—hence the importance of LGPD compliance.

How to Achieve LGPD Compliance?

Despite the major changes required by law, the dynamics of this new regulation should be viewed as a positive opportunity. Companies can embrace these rules as an innovation milestone, advancing their strategies to transparently identify customer and employee preferences while improving corporate governance.

Therefore, it is essential for companies to comply with the new Brazilian General Data Protection Law (LGPD) in order to continue their data collection, processing, and storage activities while avoiding administrative and/or legal liabilities set forth by the regulatory framework, strictly respecting the principles of good faith, purpose, adequacy, necessity, free access, and transparency.

It is worth noting that in daily business operations, the collected personal data extends beyond what is defined in Article 5 of the LGPD ("information related to an identified or identifiable natural person") to include Article 12, Paragraph 2 ("data used to build the behavioral profile of a particular natural person, if identified, may also be considered personal data for the purposes of this Law"). Therefore, beyond capturing data such as names, addresses, and email addresses, companies also collect user interests and consumption habits to understand how people search for and consume products and services.

The collection and processing of user data must adhere to the 10 (ten) legal bases authorizing data processing established in Article 7 of the LGPD, highlighting three of them for marketing purposes: consent, contractual performance, regulatory compliance, and legitimate interest.

Another widely known business strategy involves cookie-based advertising. Cookies are small, automatically executable files placed on major e-commerce websites that are stored on the user's device (phone, computer, tablet, etc.) to help map their online browsing. The LGPD requires users to be able to accept or decline various types of cookies for transparency purposes. This consent process must be user-friendly, allowing individuals to choose which data to provide and to revoke consent at any time. Companies cannot force users to accept specific cookies as a condition for accessing web applications.

It is crucial for companies to remain transparent with their users by providing as much information as possible regarding the data being collected, stored, and subsequently processed. A clear action from the user demonstrating acceptance—whether via a click or an electronic signature—is required. In short, the LGPD demands valid, verifiable consent. Silence can never be construed as consent. Consequently, data subjects gain greater control over the use of their information and maintain the right to request access to or deletion of all data held by the company.

Another legal basis allowing data usage by companies is legitimate interest. A legitimate interest may exist, for instance, when there is a relevant and appropriate relationship between the data subject and the controller, such as when the data subject is an existing client or performs services for the controller. However, the interpretation of legitimate interest is subjective and must be evaluated independently, considering every interaction variable between the company and the data subject.

Regarding data stored by the enterprise, data subjects hold the right to request access to or removal of all information maintained in its database. Access to customer personal data must be provided clearly and completely, and requests for erasure must be fulfilled promptly.

However, this requirement can pose challenges for businesses that store data across disparate locations for various purposes, making data retrieval difficult.

In this context, information security professionals must remain vigilant about which data is being collected, whether appropriate user consent has been secured, and whether privacy policies and terms of use satisfy legal mandates. Companies complying with the LGPD will distinguish themselves in the marketplace, building greater trust and credibility, and ultimately securing loyal customers who are willing to share their data. Furthermore, business partners and contractors will only engage with LGPD-compliant organizations. In short: failing to comply means being excluded from business opportunities!

Finally, businesses across all sectors must adopt clearer, more natural methods to connect with consumers and manage employees transparently. When tools and methodologies align with the LGPD and respect transparency and explicit consent rules, collecting consumer and employee data legally and effectively becomes possible—fostering a bond of trust that benefits all parties: hiring clients, companies, employees, and customers alike.

In light of this, we sat down with Gabriel de Oliveira, Solutions & Technology Manager, and Sthefany Pereira Nolasco de Souza, IT Business Analyst and DPO at Level Group, to understand firsthand the practical importance of LGPD compliance.

The Importance of LGPD Compliance for Level Group

“Level Group has continually pursued adherence to best practices in data collection and processing. We already had internal policies in place, and with the introduction of the LGPD, a strategic plan was developed to mitigate risks, streamline processes, and enhance existing policies. Consequently, we adopted new processes that were previously out of scope in accordance with Law No. 13,709. We also leveraged these initiatives across every department—not just in technology—to serve our clients with our standard professionalism and transparency,” says Gabriel de Oliveira, Solutions & Technology Manager at Level Group.

“Level Group is dedicated not only to complying with the provisions of Law No. 13,709, but also to delivering peace of mind and transparency to our clients regarding data collection and processing. The company has addressed this topic internally since February of last year, well before the LGPD formally went into effect (September 18, 2020). During that period, we engaged with specialized consultants and even hosted a webinar in July 2020 dedicated exclusively to minimizing data exposure risks for companies and employees during a period of crisis (the pandemic).

We understand that data breaches are an imminent risk, and we have taken comprehensive preventive measures, such as establishing policies, educating Level Group team members through annual presentations on data processing and collection (the first employee session took place in December 2020), delivering Information Security training to technology analysts, and more. For Level Group, the LGPD is not a one-time project, but an ongoing journey,” adds Sthefany Pereira Nolasco de Souza, IT Business Analyst and DPO at Level Group.

The Current State of LGPD Compliance at Level Group

As a result of Level Group’s proactive efforts and dedication to LGPD compliance, in March 2021 we were awarded a certification SEAL by LGPD Solution, validating that Level Group successfully completed its LGPD journey. We also received the Data Protection Impact Assessment confirming that all requirements were met, which you can review here.