BRAZIL

On September 18, the Executive enacted Law No. 14,058, formalizing the entry into force of the General Data Protection Law (LGPD for its Portuguese acronym). The final text of the regulations does not make reference to the LGPD since Congress rejected the Executive’s proposal to extend the deadlines for its entry into force. As a result, this implies that the LGPD is effective in practice. Fines and penalties for non-compliance will however only begin to be applied as from August 2021, according to Law No. 14,010. 

It should be remembered that in April, the government issued Provisional Measure 959/20 (MP), postponing the start of data protection rules until May 2021. Although the Chamber of Deputies had approved the text and brought the deadline forward to the end of 2020, the Senate rejected the proposed extension, although it ratified the other provisions in the MP.

The new law enacted by Bolsonaro does not refer to the LGPD, as it was passed into law upon leaving the Senate. In practice, this formalizes the fact that the proposed extension has not been ratified and that the LGPD is thus in force.  

Among other points, the LGPD stipulates rules on the processing of sensitive personal data, liability and compensation for damages, and the processing of information by public authorities. In addition, it defines what personal or sensitive data are, and provides rules on how this information should be handled and stored by companies.