LGPD: check out 10 good data protection and privacy practices

[soniya55531]

Data mapping is not only a good practice, but an essential step to ensure compliance with the LGPD .

This involves knowing the life cycle of the personal data that the company holds, understanding all collection channels, storage locations, who they are shared with, who has access, storage period and final destination, among other issues.

This knowledge acquired through data mapping is what allows us to create a governance and legal compliance plan .

Without data mapping, it is not possible to identify the risks to which the company is exposed, such as irregular treatment and unnecessary collection of sensitive data.

Furthermore, data mapping also ensures that the organization has clarity and understanding in data management. After all, you can only protect what you know.

2. Invest in Privacy by Design
Privacy by Design is a framework that, in addition to facilitating chinese america data compliance with the LGPD, also constitutes good practice in the processing of personal data.

Its central proposal is to incorporate privacy and the protection of personal data into all projects developed by an organization, from its conception.

The concept was developed in the 90s by a data privacy expert, Canadian Ph.D. Ann Cavoukian , but gained traction with the emergence of new privacy regulations.

The LGPD, for example, determines that controllers must adopt security measures from the design phase of the product or service to its execution, which is precisely one of the goals of Privacy by Design.

As we explained in detail in this post on the subject, the steps outlined in the methodology also facilitate compliance with the LGPD and help reduce costs. This is because they allow you to start a project, service or technology that is already compliant with the law, even with few resources.

3. Keep a record of processing operations
Another good data protection practice is to keep a record of processing operations. In terms of the LGPD, this record should include the classification of operations according to their legal basis and purpose.

Registration is essential to demonstrate to regulatory bodies, such as the ANPD (National Data Protection Authority) , that data processing is carried out legally and that the company is committed to data protection and compliance with the law.

The operations record can be created after the stage of mapping the personal data that the company holds, understanding its entire life cycle.

Legitimate interest and the registration of processing operations
One point of attention when recording processing activities is when the legal basis – that is, the LGPD hypothesis that justifies data processing – is legitimate interest.

Legitimate interest is one of the most generic and flexible legal bases provided for in the LGPD. The law states that personal data may be processed “when necessary to meet the legitimate interests of the controller or third party” , as long as this does not override the fundamental rights and freedoms of the data subject.

Precisely because of its generic nature, legitimate interest also brings more responsibilities for the company, which must be prepared to justify the use of data at any time.

Therefore, it is good practice to keep a record of the assessment made in relation to the legitimate interest that the company intends to serve, identifying it as necessary and assessing whether there are no fundamental rights that override this interest.