adequação com a LGPD - Lei Geral de Proteção de Dados brasileira

Data Protection Officer (DPO) and Accountability

DPO Appointment

Ensure the appointment of a Data Protection Officer (DPO) or a person responsible for data protection within your organization.

Verify if the DPO has the necessary qualifications and expertise.

Data Protection Policy

Develop and implement a comprehensive Data Protection Policy.

Ensure the policy aligns with the principles and requirements of the LGPD.

Regularly review and update the policy as needed.

Data Protection Impact Assessment (DPIA)

Conduct a DPIA for all data processing activities that may pose a high risk to individuals' rights and freedoms.

Document the DPIA process and outcomes.

Implement appropriate measures to mitigate identified risks.

Data Processing and Consent

Lawfulness of Processing

Ensure that all data processing activities have a valid legal basis as defined by the LGPD.

Determine the appropriate legal basis for each processing activity.

Document the legal basis for each processing activity.

Consent Management

Review and update consent mechanisms to comply with the specific requirements outlined in the LGPD.

Obtain explicit and informed consent from individuals for the processing of their personal data.

Maintain records of obtained consent.

Data Subject Rights

Establish procedures to handle data subject requests related to their rights under the LGPD.

Ensure the organization can respond to requests within the specified timeframes.

Document the steps taken to address data subject rights requests.

Data Security and Incident Response

Data Security Measures

Implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration, or disclosure.

Regularly review and update security measures to address emerging threats and vulnerabilities.

Incident Response Plan

Develop and implement an incident response plan to address personal data breaches.

Establish procedures for identifying, reporting, and containing breaches.

Train employees on their roles and responsibilities in responding to incidents.

Data Breach Notification

Establish procedures for notifying the relevant authorities and affected individuals in the event of a personal data breach.

Ensure notifications are made within the prescribed timeframe specified in the LGPD.

Vendor Management and International Transfers

Vendor Due Diligence

Assess and review the data protection practices of vendors and service providers.

Ensure that appropriate data protection clauses are included in contracts with vendors.

Monitor vendor compliance with the LGPD.

International Data Transfers

Assess the necessity and legality of transferring personal data to countries outside of Brazil.

Implement appropriate safeguards, such as standard contractual clauses or binding corporate rules, for such transfers.

Data Retention and Privacy by Design

Data Retention Policies

Establish policies and procedures for the retention and disposal of personal data.

Ensure personal data is not retained for longer than necessary.

Privacy by Design and Default

Integrate data protection measures into the design of systems and processes from the outset.

Implement privacy settings and safeguards by default to protect individuals' rights and data.

Note: This checklist provides a general overview of the steps involved in ensuring compliance with the LGPD. It is advisable to consult legal professionals and experts in data protection to tailor the checklist to your organization's specific needs and ensure full compliance with the applicable laws and regulations.