Data Processing Agreement Brazil

April 8th, 2021

The processing of personal data of minors (i.e. persons under the age of 18) must be carried out in their best interest. The subcontractor is the individual or private person who processes personal data on behalf of the processing manager. If you continue your data allocation effort, you need to keep that in mind. Otherwise, you can ignore the data collection and processing activities covered by the LGPD regulations. Second, the RGPD, the CCAC and the LGPD apply only to personal data. Therefore, when it comes to non-personal data, as it is used for business-to-business (B2B) marketing, these data protection laws do not apply. From a marketing point of view, it`s easy to forget that all data protection rules are censored by technology. Although there are currently no functional articles on these agreements, this does not mean that you should neglect this approach. Most experts recommend the implementation of data processing agreements so that all parties involved understand their respective responsibilities.

What are the responsibilities of such a data processing agreement? From collection to data use and protection. The LGPD applies to the processing of personal data, including digital data, by a public or private corporation. A DSB must be designated by the controllers. The ANPD could exempt others from the appointment of a DPD based on the nature and size of the business or the extent of data processing operations. The ANPD may issue a warning specifying the period of corrective action. It can also: (i) make an offence public; (ii) block the processing of personal data subject to the breach until the breach has been corrected; and (iii) to order the erasure of the personal data to which the breach relates. In addition, cross-border transfer is permitted where: (i) international legal cooperation between public intelligence services, investigations and law enforcement agencies is necessary; (ii) it is approved by the ANPD; (iii) it is necessary for public actions or public service activities; (iv) gave explicit and striking consent to the transmission to individuals concerned, on the basis of prior information; v) it is necessary to comply with a legal or regulatory obligation of the person in charge of the treatment; (vi) it is a contract or procedure concerning a contract involving the person concerned, as required by the person concerned; and (vii) it is intended for the regular exercise of rights, including contractual benefits, and in the context of legal, administrative or arbitration proceedings.

Comments are closed.